{"ok":true,"data":{"evidence_id":"ev_a6161a19a5a380c7c54009cc3a908cc2264b96c737aba74bd5d527804d05e49a","subject":{"name":"Tabbit.dll","digest":{"sha256":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c"},"local_path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","format":"unknown","architecture":null},"provider":{"id":"rizin","name":"Rizin","version":null},"analysis_profile":null,"predicate_type":"rea.reverse-engineering.command-observation","operation":"execute_rizin_command","parameters":{"path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","command":"e scr.color=0;af @ 0x183675cf0;pdgo @ 0x183675cf0;afij @ 0x183675cf0","provider_executable":"C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe","command_arguments":["-N","-q","-c","e scr.color=0;af @ 0x183675cf0;pdgo @ 0x183675cf0;afij @ 0x183675cf0","C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"]},"raw_result":{"stdout":"    0x183675cf0    |\r\n    0x183675cf0    |// WARNING: [rz-ghidra] Detected overlap for variable var_61h\r\n    0x183675cf0    |// WARNING: [rz-ghidra] Detected overlap for variable var_e0h\r\n    0x183675cf0    |// WARNING: [rz-ghidra] Detected overlap for variable var_1b1h\r\n    0x183675cf0    |// WARNING: [rz-ghidra] Detected overlap for variable var_251h\r\n    0x183675cf0    |// WARNING: [rz-ghidra] Detected overlap for variable var_d8h\r\n    0x183675cf0    |// WARNING: [rz-ghidra] Detected overlap for variable var_211h\r\n    0x183675cf0    |// WARNING: [rz-ghidra] Detected overlap for variable var_e4h\r\n    0x183675cf0    |// WARNING: [rz-ghidra] Detected overlap for variable var_264h\r\n    0x183675cf0    |// WARNING: [rz-ghidra] Detected overlap for variable var_25ch\r\n    0x183675cf0    |// WARNING: [rz-ghidra] Detected overlap for variable var_254h\r\n    0x183675cf0    |// WARNING: [rz-ghidra] Detected overlap for variable var_250h\r\n    0x183675cf0    |// WARNING: [rz-ghidra] Detected overlap for variable var_109h\r\n    0x183675cf0    |// WARNING: [rz-ghidra] Detected overlap for variable var_238h\r\n    0x183675cf0    |// WARNING: [rz-ghidra] Detected overlap for variable var_191h\r\n    0x183675cf0    |// WARNING: [rz-ghidra] Detected overlap for variable var_1f1h\r\n    0x183675cf0    |// WARNING: [rz-ghidra] Detected overlap for variable var_f1h\r\n    0x183675cf0    |// WARNING: [rz-ghidra] Detected overlap for variable var_1d1h\r\n    0x183675cf0    |// WARNING: [rz-ghidra] Detected overlap for variable var_121h\r\n    0x183675cf0    |// WARNING: [rz-ghidra] Detected overlap for variable var_c1h\r\n    0x183675cf0    |// WARNING: [rz-ghidra] Detected overlap for variable var_f8h\r\n    0x183675cf0    |// WARNING: [rz-ghidra] Detected overlap for variable var_110h\r\n                   |\r\n    0x183675cf0    |undefined8\r\n    0x183675cf0    |fcn.183675cf0(int64_t arg1, int64_t arg2, int64_t arg3, undefined8 placeholder_3, undefined8 placeholder_4,\r\n                   |             int64_t arg_30h)\r\n                   |{\r\n                   |    int32_t *piVar1;\r\n                   |    int32_t iVar2;\r\n                   |    char cVar3;\r\n                   |    int64_t *piVar4;\r\n                   |    int32_t iVar5;\r\n                   |    int64_t iVar6;\r\n                   |    undefined8 uVar7;\r\n                   |    int64_t iVar8;\r\n                   |    int64_t unaff_RSI;\r\n                   |    uint64_t uVar9;\r\n                   |    undefined8 uVar10;\r\n                   |    undefined8 unaff_R13;\r\n                   |    int64_t var_178h;\r\n                   |    int64_t var_170h;\r\n                   |    int64_t var_160h;\r\n                   |    int64_t var_158h;\r\n                   |    int64_t iStackY_150;\r\n                   |    int64_t var_118h;\r\n                   |    int64_t var_108h;\r\n                   |    int64_t var_f0h;\r\n                   |    \r\n    0x183675d1b    |    if (((int32_t)arg1 < 0) || (*(int64_t **)0x191dd79c0 == (int64_t *)0x0)) {\r\n    0x183675f6b    |    // WARNING: Could not recover jumptable at 0x000183675f6b. Too many branches\r\n    0x183675f6b    |    // WARNING: Treating indirect jump as call\r\n    0x183675f6b    |        uVar7 = (*_sym.imp.USER32.dll_CallNextHookEx)(0, arg1 & 0xffffffffU, arg2, arg3);\r\n    0x183675f6b    |        return uVar7;\r\n                   |    }\r\n    0x183675d21    |    iVar6 = (*_sym.imp.USER32.dll_GetForegroundWindow)();\r\n    0x183675d2a    |    if (iVar6 == 0) goto code_r0x000183675f29;\r\n    0x183675d35    |    var_170h = var_170h & 0xffffffff00000000;\r\n    0x183675d42    |    (*_sym.imp.USER32.dll_GetWindowThreadProcessId)(iVar6, &var_170h);\r\n    0x183675d48    |    iVar2 = (int32_t)var_170h;\r\n    0x183675d4b    |    iVar5 = (*(code *)0x11c218d0)();\r\n    0x183675d5c    |    if ((arg3 == 0) || (iVar2 != iVar5)) goto code_r0x000183675f29;\r\n    0x183675d65    |    uVar9 = arg2 & 0xfffffffffffffffb;\r\n    0x183675d79    |    if ((1 < *(int32_t *)arg3 - 0xa4U) && (*(int32_t *)arg3 != 0x12)) {\r\n    0x183675f18    |        if (uVar9 == 0x100) {\r\n    0x183675f21    |            (*(int64_t **)0x191dd79c0)[3] = 0;\r\n                   |        }\r\n                   |        goto code_r0x000183675f29;\r\n                   |    }\r\n    0x183675d90    |    if (*(int32_t *)0x191de85c0 < 3) {\r\n    0x183675db3    |        fcn.18030d390(&var_170h, 0x190c01080, 0x30, 2);\r\n    0x183675de1    |        uVar7 = fcn.184dcd0d0(&var_160h, 0x190c01290, 0x28);\r\n    0x183675deb    |        uVar7 = fcn.1803127c0(uVar7, *(undefined4 *)arg3);\r\n    0x183675e00    |        uVar7 = fcn.184dcd0d0(uVar7, 0x190c012c0, 10);\r\n    0x183675e0b    |        uVar7 = fcn.18084a240(uVar7, CONCAT71((unkint7)((uint64_t)unaff_R13 >> 8), uVar9 == 0x100) & 0xffffffff);\r\n    0x183675e20    |        uVar7 = fcn.184dcd0d0(uVar7, 0x190c012d0, 8);\r\n    0x183675e35    |        uVar7 = fcn.18084a240(uVar7, CONCAT71(0x7fffffffffffff, uVar9 == 0x101) & 0xffffffff);\r\n    0x183675e4a    |        uVar7 = fcn.184dcd0d0(uVar7, 0x190c012e0, 0xc);\r\n    0x183675e54    |        fcn.18084a240(uVar7, 1);\r\n    0x183675e60    |        var_170h = 0x18ff81648;\r\n    0x183675e67    |        fcn.18030e9d0(unaff_RSI);\r\n    0x183675e7a    |        *(undefined8 *)((int64_t)&var_160h + (int64_t)*(int32_t *)(var_160h + 4)) = 0x18fe1b290;\r\n    0x183675e86    |        var_158h = 0x18fe20d40;\r\n    0x183675e8f    |        if (var_108h._7_1_ < '\\0') {\r\n    0x183675ea4    |            fcn.1841dcbe0(var_118h, CONCAT17(var_108h._7_1_, (unkbyte7)var_108h) & 0x7fffffffffffffff);\r\n                   |        }\r\n    0x183675eb5    |        var_158h = 0x18fe20db0;\r\n    0x183675ec6    |        if (iStackY_150 != 0x191de1450) {\r\n    0x1836762e5    |            LOCK();\r\n    0x1836762e5    |            piVar1 = (int32_t *)(iStackY_150 + 8);\r\n    0x1836762e5    |            iVar2 = *piVar1;\r\n    0x1836762e5    |            *piVar1 = *piVar1 + -1;\r\n    0x1836762e5    |            UNLOCK();\r\n    0x1836762ec    |            if (iVar2 == 0) {\r\n    0x1836762f9    |                (*case.0x1841dcc6f.0)();\r\n                   |            }\r\n                   |        }\r\n    0x183675ea9    |        fcn.18424db70(&var_158h);\r\n    0x183675ecc    |        fcn.1848f8b80(&var_f0h);\r\n                   |    }\r\n    0x183675ee4    |    piVar4 = *(int64_t **)0x191dd79c0;\r\n    0x183675eeb    |    if (uVar9 == 0x100) {\r\n    0x183675efd    |        if ((char)(*(int64_t **)0x191dd79c0)[2] != '\\x01') {\r\n    0x183675f9b    |            *(undefined *)(*(int64_t **)0x191dd79c0 + 2) = 1;\r\n    0x183675fa7    |            if (*piVar4 != 0) {\r\n    0x183675fc0    |                if ((*(int64_t *)0x191dd79b8 == 0) || (*(char *)(*(int64_t *)0x191dd79b8 + 0x92) != '\\x01')) {\r\n    0x183676164    |                    var_178h = 0;\r\n    0x18367617e    |                    if (_str.dle == 0x185a33870) {\r\n    0x183676185    |                        var_170h = 0;\r\n    0x18367618f    |                        (*(code *)0x11c22866)(&var_170h);\r\n    0x1836761a5    |                        if (var_170h < 0x8637bd05af7) {\r\n    0x1836761b4    |                            var_178h = (var_170h * 1000000) / *(int64_t *)0x191de5628;\r\n                   |                        } else {\r\n    0x183676367    |                            var_178h = ((var_170h % *(int64_t *)0x191de5628) * 1000000) / *(int64_t *)0x191de5628 +\r\n    0x183676351    |                                       (var_170h / *(int64_t *)0x191de5628) * 1000000;\r\n                   |                        }\r\n                   |                    } else {\r\n    0x183676159    |                        (*case.0x1841dcc6f.0)(&var_178h);\r\n                   |                    }\r\n    0x1836761c0    |                    iVar6 = piVar4[3];\r\n    0x1836761d7    |                    iVar8 = var_178h - iVar6;\r\n    0x1836761d7    |                    if (SBORROW8(var_178h, iVar6)) {\r\n    0x1836761d7    |                        iVar8 = (uint64_t)(-1 < var_178h - iVar6) + 0x7fffffffffffffff;\r\n                   |                    }\r\n    0x1836761eb    |                    if ((iVar6 == 0) || (500000 < iVar8)) {\r\n    0x183676105    |                        piVar4[3] = var_178h;\r\n    0x183676110    |                        if (*(int32_t *)0x191de85c0 < 3) {\r\n    0x183676119    |                            fcn.18030d390(&var_170h, 0x190c01080, 0x9a, 2);\r\n    0x183676132    |                            fcn.184dcd0d0(&var_160h, 0x190c01260, 0x2e);\r\n    0x18367614c    |                            goto code_r0x00018367606c;\r\n                   |                        }\r\n                   |                        goto code_r0x0001836760fb;\r\n                   |                    }\r\n    0x1836761f1    |                    piVar4[3] = 0;\r\n    0x1836761f9    |                    fcn.18366fbc0(*piVar4, CONCAT71((unkint7)((uint64_t)iVar6 >> 8), 1));\r\n    0x18367620b    |                    if (2 < *(int32_t *)0x191de85c0) goto code_r0x0001836762d1;\r\n    0x183676218    |                    fcn.18030d390(&var_170h, 0x190c01080, 0x92, 2);\r\n    0x183676236    |                    uVar7 = 0x190c01220;\r\n    0x18367623d    |                    uVar10 = 0x3b;\r\n                   |                } else {\r\n    0x183675fc6    |                    piVar4[3] = 0;\r\n    0x183675fa0    |                    fcn.18366fbc0(*piVar4, 0);\r\n    0x183675fdc    |                    if (2 < *(int32_t *)0x191de85c0) goto code_r0x0001836762d1;\r\n    0x183675fe9    |                    fcn.18030d390(&var_170h, 0x190c01080, 0x88, 2);\r\n    0x183676007    |                    uVar7 = 0x190c011e8;\r\n    0x18367600e    |                    uVar10 = 0x30;\r\n                   |                }\r\n    0x183676002    |                fcn.184dcd0d0(&var_160h, uVar7, uVar10);\r\n    0x183676252    |                var_170h = 0x18ff81648;\r\n    0x183676259    |                fcn.18030e9d0(unaff_RSI);\r\n    0x18367626c    |                *(undefined8 *)((int64_t)&var_160h + (int64_t)*(int32_t *)(var_160h + 4)) = 0x18fe1b290;\r\n    0x183676278    |                var_158h = 0x18fe20d40;\r\n    0x183676280    |                if (var_108h._7_1_ < '\\0') {\r\n    0x183676295    |                    fcn.1841dcbe0(var_118h, CONCAT17(var_108h._7_1_, (unkbyte7)var_108h) & 0x7fffffffffffffff);\r\n                   |                }\r\n    0x1836762a6    |                var_158h = 0x18fe20db0;\r\n    0x1836762b7    |                if (iStackY_150 != 0x191de1450) {\r\n    0x18367632d    |                    LOCK();\r\n    0x18367632d    |                    piVar1 = (int32_t *)(iStackY_150 + 8);\r\n    0x18367632d    |                    iVar2 = *piVar1;\r\n    0x18367632d    |                    *piVar1 = *piVar1 + -1;\r\n    0x18367632d    |                    UNLOCK();\r\n    0x183676334    |                    if (iVar2 == 0) {\r\n    0x18367633d    |                        (*case.0x1841dcc6f.0)();\r\n                   |                    }\r\n                   |                }\r\n    0x18367629a    |                fcn.18424db70(&var_158h);\r\n    0x1836762b9    |                fcn.1848f8b80(&var_f0h);\r\n                   |code_r0x0001836762d1:\r\n    0x1836762d1    |                *(undefined *)((int64_t)piVar4 + 0x11) = 1;\r\n    0x183675f4d    |                return 1;\r\n                   |            }\r\n    0x183676020    |            if (*(int32_t *)0x191de85c0 < 3) {\r\n    0x18367602d    |                fcn.18030d390(&var_170h, 0x190c01080, 0x7f, 2);\r\n    0x18367605b    |                uVar7 = fcn.184dcd0d0(&var_160h, 0x190c011b0, 0x34);\r\n    0x183676067    |                fcn.180190e70(uVar7, *piVar4);\r\n                   |code_r0x00018367606c:\r\n    0x183676073    |                var_170h = 0x18ff81648;\r\n    0x18367607b    |                fcn.18030e9d0(unaff_RSI);\r\n    0x18367608f    |                *(undefined8 *)((int64_t)&var_160h + (int64_t)*(int32_t *)(var_160h + 4)) = 0x18fe1b290;\r\n    0x18367609b    |                var_158h = 0x18fe20d40;\r\n    0x1836760a6    |                if (var_108h._7_1_ < '\\0') {\r\n    0x1836760bb    |                    fcn.1841dcbe0(var_118h, CONCAT17(var_108h._7_1_, (unkbyte7)var_108h) & 0x7fffffffffffffff);\r\n                   |                }\r\n    0x1836760cc    |                var_158h = 0x18fe20db0;\r\n    0x1836760dd    |                if (iStackY_150 != 0x191de1450) {\r\n    0x183676309    |                    LOCK();\r\n    0x183676309    |                    piVar1 = (int32_t *)(iStackY_150 + 8);\r\n    0x183676309    |                    iVar2 = *piVar1;\r\n    0x183676309    |                    *piVar1 = *piVar1 + -1;\r\n    0x183676309    |                    UNLOCK();\r\n    0x183676310    |                    if (iVar2 == 0) {\r\n    0x18367631d    |                        (*case.0x1841dcc6f.0)();\r\n                   |                    }\r\n                   |                }\r\n    0x1836760c0    |                fcn.18424db70(&var_158h);\r\n    0x1836760e3    |                fcn.1848f8b80(&var_f0h);\r\n                   |            }\r\n                   |code_r0x0001836760fb:\r\n    0x1836760fb    |            *(undefined *)((int64_t)piVar4 + 0x11) = 0;\r\n    0x183676100    |            goto code_r0x000183675f29;\r\n                   |        }\r\n    0x183675f08    |        cVar3 = *(char *)((int64_t)*(int64_t **)0x191dd79c0 + 0x11);\r\n                   |    } else {\r\n    0x183675f86    |        if ((uVar9 != 0x101) || ((char)(*(int64_t **)0x191dd79c0)[2] != '\\x01')) goto code_r0x000183675f29;\r\n    0x183675f88    |        cVar3 = *(char *)((int64_t)*(int64_t **)0x191dd79c0 + 0x11);\r\n    0x183675f8c    |        *(undefined2 *)(*(int64_t **)0x191dd79c0 + 2) = 0;\r\n                   |    }\r\n    0x183675f97    |    if (cVar3 != '\\0') {\r\n    0x183675f4d    |        return 1;\r\n                   |    }\r\n                   |code_r0x000183675f29:\r\n    0x183675f33    |    uVar7 = (*_sym.imp.USER32.dll_CallNextHookEx)(0, arg1 & 0xffffffffU, arg2, arg3);\r\n    0x183675f4d    |    return uVar7;\r\n                   |}\r\n[{\"offset\":6499556592,\"name\":\"fcn.183675cf0\",\"size\":1663,\"is-pure\":false,\"realsz\":1663,\"noreturn\":false,\"stackframe\":408,\"calltype\":\"ms\",\"cost\":501,\"cc\":37,\"loops\":18,\"bits\":64,\"type\":\"fcn\",\"nbbs\":60,\"edges\":93,\"ebbs\":2,\"signature\":\"fcn.183675cf0(int64_t arg1, int64_t arg2, int64_t arg3, int64_t arg_30h);\",\"minbound\":6499556592,\"maxbound\":6499558255,\"callrefs\":[{\"from\":6499556641,\"to\":6741826192,\"type\":\"CALL\"},{\"from\":6499556674,\"to\":6741826568,\"type\":\"CALL\"},{\"from\":6499556683,\"to\":6740378144,\"type\":\"CALL\"},{\"from\":6499556807,\"to\":6445650832,\"type\":\"CALL\"},{\"from\":6499556833,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6499556843,\"to\":6445672384,\"type\":\"CALL\"},{\"from\":6499556864,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6499556875,\"to\":6451143232,\"type\":\"CALL\"},{\"from\":6499556896,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6499556917,\"to\":6451143232,\"type\":\"CALL\"},{\"from\":6499556938,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6499556948,\"to\":6451143232,\"type\":\"CALL\"},{\"from\":6499556967,\"to\":6445656528,\"type\":\"CALL\"},{\"from\":6499557028,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6499557079,\"to\":6511975280,\"type\":\"CALL\"},{\"from\":6499557087,\"to\":6518967168,\"type\":\"CALL\"},{\"from\":6499557135,\"to\":6499557178,\"type\":\"CODE\"},{\"from\":6499557171,\"to\":6741825592,\"type\":\"CALL\"},{\"from\":6499557273,\"to\":6499557178,\"type\":\"CODE\"},{\"from\":6499557328,\"to\":6499531712,\"type\":\"CALL\"},{\"from\":6499557373,\"to\":6445650832,\"type\":\"CALL\"},{\"from\":6499557396,\"to\":6499557955,\"type\":\"CODE\"},{\"from\":6499557441,\"to\":6445650832,\"type\":\"CALL\"},{\"from\":6499557467,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6499557479,\"to\":6444093040,\"type\":\"CALL\"},{\"from\":6499557499,\"to\":6445656528,\"type\":\"CALL\"},{\"from\":6499557563,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6499557614,\"to\":6511975280,\"type\":\"CALL\"},{\"from\":6499557622,\"to\":6518967168,\"type\":\"CALL\"},{\"from\":6499557632,\"to\":6499557161,\"type\":\"CODE\"},{\"from\":6499557677,\"to\":6445650832,\"type\":\"CALL\"},{\"from\":6499557703,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6499557708,\"to\":6499557484,\"type\":\"CODE\"},{\"from\":6499557721,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6499557730,\"to\":6499557824,\"type\":\"CODE\"},{\"from\":6499557775,\"to\":6740379656,\"type\":\"CALL\"},{\"from\":6499557887,\"to\":6499531712,\"type\":\"CALL\"},{\"from\":6499557932,\"to\":6445650832,\"type\":\"CALL\"},{\"from\":6499557958,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6499557977,\"to\":6445656528,\"type\":\"CALL\"},{\"from\":6499558037,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6499558084,\"to\":6511975280,\"type\":\"CALL\"},{\"from\":6499558092,\"to\":6518967168,\"type\":\"CALL\"},{\"from\":6499558107,\"to\":6499557178,\"type\":\"CODE\"},{\"from\":6499558137,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6499558143,\"to\":6499557068,\"type\":\"CODE\"},{\"from\":6499558173,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6499558179,\"to\":6499557603,\"type\":\"CODE\"},{\"from\":6499558205,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6499558211,\"to\":6499558073,\"type\":\"CODE\"},{\"from\":6499558250,\"to\":6499557819,\"type\":\"CODE\"}],\"datarefs\":[{\"from\":6499556627,\"to\":6742178240,\"type\":\"DATA\"},{\"from\":6499556735,\"to\":6742246848,\"type\":\"DATA\"},{\"from\":6499556780,\"to\":6723473536,\"type\":\"DATA\"},{\"from\":6499556817,\"to\":6723474064,\"type\":\"DATA\"},{\"from\":6499556848,\"to\":6723474112,\"type\":\"DATA\"},{\"from\":6499556880,\"to\":6723474128,\"type\":\"DATA\"},{\"from\":6499556922,\"to\":6723474144,\"type\":\"DATA\"},{\"from\":6499556953,\"to\":6710367816,\"type\":\"DATA\"},{\"from\":6499556979,\"to\":6708900496,\"type\":\"DATA\"},{\"from\":6499556991,\"to\":6708923712,\"type\":\"DATA\"},{\"from\":6499557038,\"to\":6708923824,\"type\":\"DATA\"},{\"from\":6499557052,\"to\":6742217808,\"type\":\"DATA\"},{\"from\":6499557105,\"to\":6742178240,\"type\":\"DATA\"},{\"from\":6499557146,\"to\":6742178240,\"type\":\"DATA\"},{\"from\":6499557227,\"to\":6741825592,\"type\":\"DATA\"},{\"from\":6499557243,\"to\":6742178240,\"type\":\"DATA\"},{\"from\":6499557289,\"to\":6742178232,\"type\":\"DATA\"},{\"from\":6499557333,\"to\":6742246848,\"type\":\"DATA\"},{\"from\":6499557346,\"to\":6723473536,\"type\":\"DATA\"},{\"from\":6499557383,\"to\":6723473896,\"type\":\"DATA\"},{\"from\":6499557401,\"to\":6742246848,\"type\":\"DATA\"},{\"from\":6499557414,\"to\":6723473536,\"type\":\"DATA\"},{\"from\":6499557451,\"to\":6723473840,\"type\":\"DATA\"},{\"from\":6499557484,\"to\":6710367816,\"type\":\"DATA\"},{\"from\":6499557512,\"to\":6708900496,\"type\":\"DATA\"},{\"from\":6499557524,\"to\":6708923712,\"type\":\"DATA\"},{\"from\":6499557573,\"to\":6708923824,\"type\":\"DATA\"},{\"from\":6499557587,\"to\":6742217808,\"type\":\"DATA\"},{\"from\":6499557641,\"to\":6742246848,\"type\":\"DATA\"},{\"from\":6499557650,\"to\":6723473536,\"type\":\"DATA\"},{\"from\":6499557687,\"to\":6723474016,\"type\":\"DATA\"},{\"from\":6499557741,\"to\":6741125872,\"type\":\"DATA\"},{\"from\":6499557748,\"to\":6537033840,\"type\":\"DATA\"},{\"from\":6499557892,\"to\":6742246848,\"type\":\"DATA\"},{\"from\":6499557905,\"to\":6723473536,\"type\":\"DATA\"},{\"from\":6499557942,\"to\":6723473952,\"type\":\"DATA\"},{\"from\":6499557963,\"to\":6710367816,\"type\":\"DATA\"},{\"from\":6499557989,\"to\":6708900496,\"type\":\"DATA\"},{\"from\":6499558001,\"to\":6708923712,\"type\":\"DATA\"},{\"from\":6499558047,\"to\":6708923824,\"type\":\"DATA\"},{\"from\":6499558061,\"to\":6742217808,\"type\":\"DATA\"},{\"from\":6499558216,\"to\":6742234664,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6499557135,\"to\":6499557178,\"type\":\"CODE\"},{\"from\":6499557273,\"to\":6499557178,\"type\":\"CODE\"},{\"from\":6499557396,\"to\":6499557955,\"type\":\"CODE\"},{\"from\":6499557632,\"to\":6499557161,\"type\":\"CODE\"},{\"from\":6499557708,\"to\":6499557484,\"type\":\"CODE\"},{\"from\":6499557730,\"to\":6499557824,\"type\":\"CODE\"},{\"from\":6499558107,\"to\":6499557178,\"type\":\"CODE\"},{\"from\":6499558143,\"to\":6499557068,\"type\":\"CODE\"},{\"from\":6499558179,\"to\":6499557603,\"type\":\"CODE\"},{\"from\":6499558211,\"to\":6499558073,\"type\":\"CODE\"},{\"from\":6499558250,\"to\":6499557819,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":11,\"outdegree\":40,\"nlocals\":7,\"nargs\":4,\"stackvars\":[{\"name\":\"var_178h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-376}},{\"name\":\"var_170h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-368}},{\"name\":\"var_160h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-352}},{\"name\":\"var_158h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-344}},{\"name\":\"var_118h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-280}},{\"name\":\"var_108h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-264}},{\"name\":\"var_f0h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-240}},{\"name\":\"arg_30h\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":48}}],\"regvars\":[{\"name\":\"arg3\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"r8\"}},{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"normalized_result":{"stdout":"    0x183675cf0    |\r\n    0x183675cf0    |// WARNING: [rz-ghidra] Detected overlap for variable var_61h\r\n    0x183675cf0    |// WARNING: [rz-ghidra] Detected overlap for variable var_e0h\r\n    0x183675cf0    |// WARNING: [rz-ghidra] Detected overlap for variable var_1b1h\r\n    0x183675cf0    |// WARNING: [rz-ghidra] Detected overlap for variable var_251h\r\n    0x183675cf0    |// WARNING: [rz-ghidra] Detected overlap for variable var_d8h\r\n    0x183675cf0    |// WARNING: [rz-ghidra] Detected overlap for variable var_211h\r\n    0x183675cf0    |// WARNING: [rz-ghidra] Detected overlap for variable var_e4h\r\n    0x183675cf0    |// WARNING: [rz-ghidra] Detected overlap for variable var_264h\r\n    0x183675cf0    |// WARNING: [rz-ghidra] Detected overlap for variable var_25ch\r\n    0x183675cf0    |// WARNING: [rz-ghidra] Detected overlap for variable var_254h\r\n    0x183675cf0    |// WARNING: [rz-ghidra] Detected overlap for variable var_250h\r\n    0x183675cf0    |// WARNING: [rz-ghidra] Detected overlap for variable var_109h\r\n    0x183675cf0    |// WARNING: [rz-ghidra] Detected overlap for variable var_238h\r\n    0x183675cf0    |// WARNING: [rz-ghidra] Detected overlap for variable var_191h\r\n    0x183675cf0    |// WARNING: [rz-ghidra] Detected overlap for variable var_1f1h\r\n    0x183675cf0    |// WARNING: [rz-ghidra] Detected overlap for variable var_f1h\r\n    0x183675cf0    |// WARNING: [rz-ghidra] Detected overlap for variable var_1d1h\r\n    0x183675cf0    |// WARNING: [rz-ghidra] Detected overlap for variable var_121h\r\n    0x183675cf0    |// WARNING: [rz-ghidra] Detected overlap for variable var_c1h\r\n    0x183675cf0    |// WARNING: [rz-ghidra] Detected overlap for variable var_f8h\r\n    0x183675cf0    |// WARNING: [rz-ghidra] Detected overlap for variable var_110h\r\n                   |\r\n    0x183675cf0    |undefined8\r\n    0x183675cf0    |fcn.183675cf0(int64_t arg1, int64_t arg2, int64_t arg3, undefined8 placeholder_3, undefined8 placeholder_4,\r\n                   |             int64_t arg_30h)\r\n                   |{\r\n                   |    int32_t *piVar1;\r\n                   |    int32_t iVar2;\r\n                   |    char cVar3;\r\n                   |    int64_t *piVar4;\r\n                   |    int32_t iVar5;\r\n                   |    int64_t iVar6;\r\n                   |    undefined8 uVar7;\r\n                   |    int64_t iVar8;\r\n                   |    int64_t unaff_RSI;\r\n                   |    uint64_t uVar9;\r\n                   |    undefined8 uVar10;\r\n                   |    undefined8 unaff_R13;\r\n                   |    int64_t var_178h;\r\n                   |    int64_t var_170h;\r\n                   |    int64_t var_160h;\r\n                   |    int64_t var_158h;\r\n                   |    int64_t iStackY_150;\r\n                   |    int64_t var_118h;\r\n                   |    int64_t var_108h;\r\n                   |    int64_t var_f0h;\r\n                   |    \r\n    0x183675d1b    |    if (((int32_t)arg1 < 0) || (*(int64_t **)0x191dd79c0 == (int64_t *)0x0)) {\r\n    0x183675f6b    |    // WARNING: Could not recover jumptable at 0x000183675f6b. Too many branches\r\n    0x183675f6b    |    // WARNING: Treating indirect jump as call\r\n    0x183675f6b    |        uVar7 = (*_sym.imp.USER32.dll_CallNextHookEx)(0, arg1 & 0xffffffffU, arg2, arg3);\r\n    0x183675f6b    |        return uVar7;\r\n                   |    }\r\n    0x183675d21    |    iVar6 = (*_sym.imp.USER32.dll_GetForegroundWindow)();\r\n    0x183675d2a    |    if (iVar6 == 0) goto code_r0x000183675f29;\r\n    0x183675d35    |    var_170h = var_170h & 0xffffffff00000000;\r\n    0x183675d42    |    (*_sym.imp.USER32.dll_GetWindowThreadProcessId)(iVar6, &var_170h);\r\n    0x183675d48    |    iVar2 = (int32_t)var_170h;\r\n    0x183675d4b    |    iVar5 = (*(code *)0x11c218d0)();\r\n    0x183675d5c    |    if ((arg3 == 0) || (iVar2 != iVar5)) goto code_r0x000183675f29;\r\n    0x183675d65    |    uVar9 = arg2 & 0xfffffffffffffffb;\r\n    0x183675d79    |    if ((1 < *(int32_t *)arg3 - 0xa4U) && (*(int32_t *)arg3 != 0x12)) {\r\n    0x183675f18    |        if (uVar9 == 0x100) {\r\n    0x183675f21    |            (*(int64_t **)0x191dd79c0)[3] = 0;\r\n                   |        }\r\n                   |        goto code_r0x000183675f29;\r\n                   |    }\r\n    0x183675d90    |    if (*(int32_t *)0x191de85c0 < 3) {\r\n    0x183675db3    |        fcn.18030d390(&var_170h, 0x190c01080, 0x30, 2);\r\n    0x183675de1    |        uVar7 = fcn.184dcd0d0(&var_160h, 0x190c01290, 0x28);\r\n    0x183675deb    |        uVar7 = fcn.1803127c0(uVar7, *(undefined4 *)arg3);\r\n    0x183675e00    |        uVar7 = fcn.184dcd0d0(uVar7, 0x190c012c0, 10);\r\n    0x183675e0b    |        uVar7 = fcn.18084a240(uVar7, CONCAT71((unkint7)((uint64_t)unaff_R13 >> 8), uVar9 == 0x100) & 0xffffffff);\r\n    0x183675e20    |        uVar7 = fcn.184dcd0d0(uVar7, 0x190c012d0, 8);\r\n    0x183675e35    |        uVar7 = fcn.18084a240(uVar7, CONCAT71(0x7fffffffffffff, uVar9 == 0x101) & 0xffffffff);\r\n    0x183675e4a    |        uVar7 = fcn.184dcd0d0(uVar7, 0x190c012e0, 0xc);\r\n    0x183675e54    |        fcn.18084a240(uVar7, 1);\r\n    0x183675e60    |        var_170h = 0x18ff81648;\r\n    0x183675e67    |        fcn.18030e9d0(unaff_RSI);\r\n    0x183675e7a    |        *(undefined8 *)((int64_t)&var_160h + (int64_t)*(int32_t *)(var_160h + 4)) = 0x18fe1b290;\r\n    0x183675e86    |        var_158h = 0x18fe20d40;\r\n    0x183675e8f    |        if (var_108h._7_1_ < '\\0') {\r\n    0x183675ea4    |            fcn.1841dcbe0(var_118h, CONCAT17(var_108h._7_1_, (unkbyte7)var_108h) & 0x7fffffffffffffff);\r\n                   |        }\r\n    0x183675eb5    |        var_158h = 0x18fe20db0;\r\n    0x183675ec6    |        if (iStackY_150 != 0x191de1450) {\r\n    0x1836762e5    |            LOCK();\r\n    0x1836762e5    |            piVar1 = (int32_t *)(iStackY_150 + 8);\r\n    0x1836762e5    |            iVar2 = *piVar1;\r\n    0x1836762e5    |            *piVar1 = *piVar1 + -1;\r\n    0x1836762e5    |            UNLOCK();\r\n    0x1836762ec    |            if (iVar2 == 0) {\r\n    0x1836762f9    |                (*case.0x1841dcc6f.0)();\r\n                   |            }\r\n                   |        }\r\n    0x183675ea9    |        fcn.18424db70(&var_158h);\r\n    0x183675ecc    |        fcn.1848f8b80(&var_f0h);\r\n                   |    }\r\n    0x183675ee4    |    piVar4 = *(int64_t **)0x191dd79c0;\r\n    0x183675eeb    |    if (uVar9 == 0x100) {\r\n    0x183675efd    |        if ((char)(*(int64_t **)0x191dd79c0)[2] != '\\x01') {\r\n    0x183675f9b    |            *(undefined *)(*(int64_t **)0x191dd79c0 + 2) = 1;\r\n    0x183675fa7    |            if (*piVar4 != 0) {\r\n    0x183675fc0    |                if ((*(int64_t *)0x191dd79b8 == 0) || (*(char *)(*(int64_t *)0x191dd79b8 + 0x92) != '\\x01')) {\r\n    0x183676164    |                    var_178h = 0;\r\n    0x18367617e    |                    if (_str.dle == 0x185a33870) {\r\n    0x183676185    |                        var_170h = 0;\r\n    0x18367618f    |                        (*(code *)0x11c22866)(&var_170h);\r\n    0x1836761a5    |                        if (var_170h < 0x8637bd05af7) {\r\n    0x1836761b4    |                            var_178h = (var_170h * 1000000) / *(int64_t *)0x191de5628;\r\n                   |                        } else {\r\n    0x183676367    |                            var_178h = ((var_170h % *(int64_t *)0x191de5628) * 1000000) / *(int64_t *)0x191de5628 +\r\n    0x183676351    |                                       (var_170h / *(int64_t *)0x191de5628) * 1000000;\r\n                   |                        }\r\n                   |                    } else {\r\n    0x183676159    |                        (*case.0x1841dcc6f.0)(&var_178h);\r\n                   |                    }\r\n    0x1836761c0    |                    iVar6 = piVar4[3];\r\n    0x1836761d7    |                    iVar8 = var_178h - iVar6;\r\n    0x1836761d7    |                    if (SBORROW8(var_178h, iVar6)) {\r\n    0x1836761d7    |                        iVar8 = (uint64_t)(-1 < var_178h - iVar6) + 0x7fffffffffffffff;\r\n                   |                    }\r\n    0x1836761eb    |                    if ((iVar6 == 0) || (500000 < iVar8)) {\r\n    0x183676105    |                        piVar4[3] = var_178h;\r\n    0x183676110    |                        if (*(int32_t *)0x191de85c0 < 3) {\r\n    0x183676119    |                            fcn.18030d390(&var_170h, 0x190c01080, 0x9a, 2);\r\n    0x183676132    |                            fcn.184dcd0d0(&var_160h, 0x190c01260, 0x2e);\r\n    0x18367614c    |                            goto code_r0x00018367606c;\r\n                   |                        }\r\n                   |                        goto code_r0x0001836760fb;\r\n                   |                    }\r\n    0x1836761f1    |                    piVar4[3] = 0;\r\n    0x1836761f9    |                    fcn.18366fbc0(*piVar4, CONCAT71((unkint7)((uint64_t)iVar6 >> 8), 1));\r\n    0x18367620b    |                    if (2 < *(int32_t *)0x191de85c0) goto code_r0x0001836762d1;\r\n    0x183676218    |                    fcn.18030d390(&var_170h, 0x190c01080, 0x92, 2);\r\n    0x183676236    |                    uVar7 = 0x190c01220;\r\n    0x18367623d    |                    uVar10 = 0x3b;\r\n                   |                } else {\r\n    0x183675fc6    |                    piVar4[3] = 0;\r\n    0x183675fa0    |                    fcn.18366fbc0(*piVar4, 0);\r\n    0x183675fdc    |                    if (2 < *(int32_t *)0x191de85c0) goto code_r0x0001836762d1;\r\n    0x183675fe9    |                    fcn.18030d390(&var_170h, 0x190c01080, 0x88, 2);\r\n    0x183676007    |                    uVar7 = 0x190c011e8;\r\n    0x18367600e    |                    uVar10 = 0x30;\r\n                   |                }\r\n    0x183676002    |                fcn.184dcd0d0(&var_160h, uVar7, uVar10);\r\n    0x183676252    |                var_170h = 0x18ff81648;\r\n    0x183676259    |                fcn.18030e9d0(unaff_RSI);\r\n    0x18367626c    |                *(undefined8 *)((int64_t)&var_160h + (int64_t)*(int32_t *)(var_160h + 4)) = 0x18fe1b290;\r\n    0x183676278    |                var_158h = 0x18fe20d40;\r\n    0x183676280    |                if (var_108h._7_1_ < '\\0') {\r\n    0x183676295    |                    fcn.1841dcbe0(var_118h, CONCAT17(var_108h._7_1_, (unkbyte7)var_108h) & 0x7fffffffffffffff);\r\n                   |                }\r\n    0x1836762a6    |                var_158h = 0x18fe20db0;\r\n    0x1836762b7    |                if (iStackY_150 != 0x191de1450) {\r\n    0x18367632d    |                    LOCK();\r\n    0x18367632d    |                    piVar1 = (int32_t *)(iStackY_150 + 8);\r\n    0x18367632d    |                    iVar2 = *piVar1;\r\n    0x18367632d    |                    *piVar1 = *piVar1 + -1;\r\n    0x18367632d    |                    UNLOCK();\r\n    0x183676334    |                    if (iVar2 == 0) {\r\n    0x18367633d    |                        (*case.0x1841dcc6f.0)();\r\n                   |                    }\r\n                   |                }\r\n    0x18367629a    |                fcn.18424db70(&var_158h);\r\n    0x1836762b9    |                fcn.1848f8b80(&var_f0h);\r\n                   |code_r0x0001836762d1:\r\n    0x1836762d1    |                *(undefined *)((int64_t)piVar4 + 0x11) = 1;\r\n    0x183675f4d    |                return 1;\r\n                   |            }\r\n    0x183676020    |            if (*(int32_t *)0x191de85c0 < 3) {\r\n    0x18367602d    |                fcn.18030d390(&var_170h, 0x190c01080, 0x7f, 2);\r\n    0x18367605b    |                uVar7 = fcn.184dcd0d0(&var_160h, 0x190c011b0, 0x34);\r\n    0x183676067    |                fcn.180190e70(uVar7, *piVar4);\r\n                   |code_r0x00018367606c:\r\n    0x183676073    |                var_170h = 0x18ff81648;\r\n    0x18367607b    |                fcn.18030e9d0(unaff_RSI);\r\n    0x18367608f    |                *(undefined8 *)((int64_t)&var_160h + (int64_t)*(int32_t *)(var_160h + 4)) = 0x18fe1b290;\r\n    0x18367609b    |                var_158h = 0x18fe20d40;\r\n    0x1836760a6    |                if (var_108h._7_1_ < '\\0') {\r\n    0x1836760bb    |                    fcn.1841dcbe0(var_118h, CONCAT17(var_108h._7_1_, (unkbyte7)var_108h) & 0x7fffffffffffffff);\r\n                   |                }\r\n    0x1836760cc    |                var_158h = 0x18fe20db0;\r\n    0x1836760dd    |                if (iStackY_150 != 0x191de1450) {\r\n    0x183676309    |                    LOCK();\r\n    0x183676309    |                    piVar1 = (int32_t *)(iStackY_150 + 8);\r\n    0x183676309    |                    iVar2 = *piVar1;\r\n    0x183676309    |                    *piVar1 = *piVar1 + -1;\r\n    0x183676309    |                    UNLOCK();\r\n    0x183676310    |                    if (iVar2 == 0) {\r\n    0x18367631d    |                        (*case.0x1841dcc6f.0)();\r\n                   |                    }\r\n                   |                }\r\n    0x1836760c0    |                fcn.18424db70(&var_158h);\r\n    0x1836760e3    |                fcn.1848f8b80(&var_f0h);\r\n                   |            }\r\n                   |code_r0x0001836760fb:\r\n    0x1836760fb    |            *(undefined *)((int64_t)piVar4 + 0x11) = 0;\r\n    0x183676100    |            goto code_r0x000183675f29;\r\n                   |        }\r\n    0x183675f08    |        cVar3 = *(char *)((int64_t)*(int64_t **)0x191dd79c0 + 0x11);\r\n                   |    } else {\r\n    0x183675f86    |        if ((uVar9 != 0x101) || ((char)(*(int64_t **)0x191dd79c0)[2] != '\\x01')) goto code_r0x000183675f29;\r\n    0x183675f88    |        cVar3 = *(char *)((int64_t)*(int64_t **)0x191dd79c0 + 0x11);\r\n    0x183675f8c    |        *(undefined2 *)(*(int64_t **)0x191dd79c0 + 2) = 0;\r\n                   |    }\r\n    0x183675f97    |    if (cVar3 != '\\0') {\r\n    0x183675f4d    |        return 1;\r\n                   |    }\r\n                   |code_r0x000183675f29:\r\n    0x183675f33    |    uVar7 = (*_sym.imp.USER32.dll_CallNextHookEx)(0, arg1 & 0xffffffffU, arg2, arg3);\r\n    0x183675f4d    |    return uVar7;\r\n                   |}\r\n[{\"offset\":6499556592,\"name\":\"fcn.183675cf0\",\"size\":1663,\"is-pure\":false,\"realsz\":1663,\"noreturn\":false,\"stackframe\":408,\"calltype\":\"ms\",\"cost\":501,\"cc\":37,\"loops\":18,\"bits\":64,\"type\":\"fcn\",\"nbbs\":60,\"edges\":93,\"ebbs\":2,\"signature\":\"fcn.183675cf0(int64_t arg1, int64_t arg2, int64_t arg3, int64_t arg_30h);\",\"minbound\":6499556592,\"maxbound\":6499558255,\"callrefs\":[{\"from\":6499556641,\"to\":6741826192,\"type\":\"CALL\"},{\"from\":6499556674,\"to\":6741826568,\"type\":\"CALL\"},{\"from\":6499556683,\"to\":6740378144,\"type\":\"CALL\"},{\"from\":6499556807,\"to\":6445650832,\"type\":\"CALL\"},{\"from\":6499556833,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6499556843,\"to\":6445672384,\"type\":\"CALL\"},{\"from\":6499556864,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6499556875,\"to\":6451143232,\"type\":\"CALL\"},{\"from\":6499556896,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6499556917,\"to\":6451143232,\"type\":\"CALL\"},{\"from\":6499556938,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6499556948,\"to\":6451143232,\"type\":\"CALL\"},{\"from\":6499556967,\"to\":6445656528,\"type\":\"CALL\"},{\"from\":6499557028,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6499557079,\"to\":6511975280,\"type\":\"CALL\"},{\"from\":6499557087,\"to\":6518967168,\"type\":\"CALL\"},{\"from\":6499557135,\"to\":6499557178,\"type\":\"CODE\"},{\"from\":6499557171,\"to\":6741825592,\"type\":\"CALL\"},{\"from\":6499557273,\"to\":6499557178,\"type\":\"CODE\"},{\"from\":6499557328,\"to\":6499531712,\"type\":\"CALL\"},{\"from\":6499557373,\"to\":6445650832,\"type\":\"CALL\"},{\"from\":6499557396,\"to\":6499557955,\"type\":\"CODE\"},{\"from\":6499557441,\"to\":6445650832,\"type\":\"CALL\"},{\"from\":6499557467,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6499557479,\"to\":6444093040,\"type\":\"CALL\"},{\"from\":6499557499,\"to\":6445656528,\"type\":\"CALL\"},{\"from\":6499557563,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6499557614,\"to\":6511975280,\"type\":\"CALL\"},{\"from\":6499557622,\"to\":6518967168,\"type\":\"CALL\"},{\"from\":6499557632,\"to\":6499557161,\"type\":\"CODE\"},{\"from\":6499557677,\"to\":6445650832,\"type\":\"CALL\"},{\"from\":6499557703,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6499557708,\"to\":6499557484,\"type\":\"CODE\"},{\"from\":6499557721,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6499557730,\"to\":6499557824,\"type\":\"CODE\"},{\"from\":6499557775,\"to\":6740379656,\"type\":\"CALL\"},{\"from\":6499557887,\"to\":6499531712,\"type\":\"CALL\"},{\"from\":6499557932,\"to\":6445650832,\"type\":\"CALL\"},{\"from\":6499557958,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6499557977,\"to\":6445656528,\"type\":\"CALL\"},{\"from\":6499558037,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6499558084,\"to\":6511975280,\"type\":\"CALL\"},{\"from\":6499558092,\"to\":6518967168,\"type\":\"CALL\"},{\"from\":6499558107,\"to\":6499557178,\"type\":\"CODE\"},{\"from\":6499558137,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6499558143,\"to\":6499557068,\"type\":\"CODE\"},{\"from\":6499558173,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6499558179,\"to\":6499557603,\"type\":\"CODE\"},{\"from\":6499558205,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6499558211,\"to\":6499558073,\"type\":\"CODE\"},{\"from\":6499558250,\"to\":6499557819,\"type\":\"CODE\"}],\"datarefs\":[{\"from\":6499556627,\"to\":6742178240,\"type\":\"DATA\"},{\"from\":6499556735,\"to\":6742246848,\"type\":\"DATA\"},{\"from\":6499556780,\"to\":6723473536,\"type\":\"DATA\"},{\"from\":6499556817,\"to\":6723474064,\"type\":\"DATA\"},{\"from\":6499556848,\"to\":6723474112,\"type\":\"DATA\"},{\"from\":6499556880,\"to\":6723474128,\"type\":\"DATA\"},{\"from\":6499556922,\"to\":6723474144,\"type\":\"DATA\"},{\"from\":6499556953,\"to\":6710367816,\"type\":\"DATA\"},{\"from\":6499556979,\"to\":6708900496,\"type\":\"DATA\"},{\"from\":6499556991,\"to\":6708923712,\"type\":\"DATA\"},{\"from\":6499557038,\"to\":6708923824,\"type\":\"DATA\"},{\"from\":6499557052,\"to\":6742217808,\"type\":\"DATA\"},{\"from\":6499557105,\"to\":6742178240,\"type\":\"DATA\"},{\"from\":6499557146,\"to\":6742178240,\"type\":\"DATA\"},{\"from\":6499557227,\"to\":6741825592,\"type\":\"DATA\"},{\"from\":6499557243,\"to\":6742178240,\"type\":\"DATA\"},{\"from\":6499557289,\"to\":6742178232,\"type\":\"DATA\"},{\"from\":6499557333,\"to\":6742246848,\"type\":\"DATA\"},{\"from\":6499557346,\"to\":6723473536,\"type\":\"DATA\"},{\"from\":6499557383,\"to\":6723473896,\"type\":\"DATA\"},{\"from\":6499557401,\"to\":6742246848,\"type\":\"DATA\"},{\"from\":6499557414,\"to\":6723473536,\"type\":\"DATA\"},{\"from\":6499557451,\"to\":6723473840,\"type\":\"DATA\"},{\"from\":6499557484,\"to\":6710367816,\"type\":\"DATA\"},{\"from\":6499557512,\"to\":6708900496,\"type\":\"DATA\"},{\"from\":6499557524,\"to\":6708923712,\"type\":\"DATA\"},{\"from\":6499557573,\"to\":6708923824,\"type\":\"DATA\"},{\"from\":6499557587,\"to\":6742217808,\"type\":\"DATA\"},{\"from\":6499557641,\"to\":6742246848,\"type\":\"DATA\"},{\"from\":6499557650,\"to\":6723473536,\"type\":\"DATA\"},{\"from\":6499557687,\"to\":6723474016,\"type\":\"DATA\"},{\"from\":6499557741,\"to\":6741125872,\"type\":\"DATA\"},{\"from\":6499557748,\"to\":6537033840,\"type\":\"DATA\"},{\"from\":6499557892,\"to\":6742246848,\"type\":\"DATA\"},{\"from\":6499557905,\"to\":6723473536,\"type\":\"DATA\"},{\"from\":6499557942,\"to\":6723473952,\"type\":\"DATA\"},{\"from\":6499557963,\"to\":6710367816,\"type\":\"DATA\"},{\"from\":6499557989,\"to\":6708900496,\"type\":\"DATA\"},{\"from\":6499558001,\"to\":6708923712,\"type\":\"DATA\"},{\"from\":6499558047,\"to\":6708923824,\"type\":\"DATA\"},{\"from\":6499558061,\"to\":6742217808,\"type\":\"DATA\"},{\"from\":6499558216,\"to\":6742234664,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6499557135,\"to\":6499557178,\"type\":\"CODE\"},{\"from\":6499557273,\"to\":6499557178,\"type\":\"CODE\"},{\"from\":6499557396,\"to\":6499557955,\"type\":\"CODE\"},{\"from\":6499557632,\"to\":6499557161,\"type\":\"CODE\"},{\"from\":6499557708,\"to\":6499557484,\"type\":\"CODE\"},{\"from\":6499557730,\"to\":6499557824,\"type\":\"CODE\"},{\"from\":6499558107,\"to\":6499557178,\"type\":\"CODE\"},{\"from\":6499558143,\"to\":6499557068,\"type\":\"CODE\"},{\"from\":6499558179,\"to\":6499557603,\"type\":\"CODE\"},{\"from\":6499558211,\"to\":6499558073,\"type\":\"CODE\"},{\"from\":6499558250,\"to\":6499557819,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":11,\"outdegree\":40,\"nlocals\":7,\"nargs\":4,\"stackvars\":[{\"name\":\"var_178h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-376}},{\"name\":\"var_170h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-368}},{\"name\":\"var_160h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-352}},{\"name\":\"var_158h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-344}},{\"name\":\"var_118h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-280}},{\"name\":\"var_108h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-264}},{\"name\":\"var_f0h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-240}},{\"name\":\"arg_30h\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":48}}],\"regvars\":[{\"name\":\"arg3\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"r8\"}},{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"confidence":"observed","authority":"shipped-artifact","environment":null,"limitations":["The executable version and supported formats are reported as unknown because no reliable version probe was performed.","A non-zero process exit is preserved as an observed command result.","Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.","When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call."],"relationship_coverage":null,"locations":[{"kind":"artifact-path","path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"}],"evidence_links":[]},"meta":{"command":"execute-rizin-command","duration":"5224ms"}}