{"ok":true,"data":{"evidence_id":"ev_8e5dc5e7181bc3607cdf2a2bd04703af4f2407810a038ec22946779716402a54","subject":{"name":"Tabbit.dll","digest":{"sha256":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c"},"local_path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","format":"unknown","architecture":null},"provider":{"id":"rizin","name":"Rizin","version":null},"analysis_profile":null,"predicate_type":"rea.reverse-engineering.command-observation","operation":"execute_rizin_command","parameters":{"path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","command":"e scr.color=0;af @ 0x18366c5a0;pdgo @ 0x18366c5a0;afij @ 0x18366c5a0","provider_executable":"C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe","command_arguments":["-N","-q","-c","e scr.color=0;af @ 0x18366c5a0;pdgo @ 0x18366c5a0;afij @ 0x18366c5a0","C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"]},"raw_result":{"stdout":"    0x18366c5a0    |\r\n    0x18366c5a0    |// WARNING: [rz-ghidra] Detected overlap for variable var_81h\r\n    0x18366c5a0    |// WARNING: [rz-ghidra] Detected overlap for variable var_69h\r\n    0x18366c5a0    |// WARNING: [rz-ghidra] Detected overlap for variable var_a8h\r\n    0x18366c5a0    |// WARNING: [rz-ghidra] Detected overlap for variable var_70h\r\n    0x18366c5a0    |// WARNING: [rz-ghidra] Detected overlap for variable var_88h\r\n                   |\r\n    0x18366c5a0    |int64_t fcn.18366c5a0(int64_t arg1, int64_t arg_40h)\r\n                   |{\r\n                   |    int64_t unaff_GS_OFFSET;\r\n                   |    undefined auStack_e8 [40];\r\n                   |    int64_t var_c0h;\r\n                   |    int64_t var_b8h;\r\n                   |    unkbyte7 Stack_b0;\r\n                   |    int64_t var_a9h;\r\n                   |    int64_t iStack_a0;\r\n                   |    int64_t var_98h;\r\n                   |    int64_t var_90h;\r\n                   |    unkbyte7 var_88h;\r\n                   |    char var_81h;\r\n                   |    int64_t var_80h;\r\n                   |    int64_t var_78h;\r\n                   |    unkbyte7 var_70h;\r\n                   |    char var_69h;\r\n                   |    int64_t var_68h;\r\n                   |    undefined8 uStack_60;\r\n                   |    int64_t var_58h;\r\n                   |    int64_t var_50h;\r\n                   |    int64_t var_48h;\r\n                   |    int64_t var_40h;\r\n                   |    int64_t *piStack_38;\r\n                   |    int64_t iStack_30;\r\n                   |    int64_t var_28h;\r\n                   |    \r\n    0x18366c5b6    |    var_28h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_e8;\r\n    0x18366c5c1    |    func_0x0001806a4c60(&var_80h);\r\n    0x18366c5d6    |    var_50h = (int64_t)var_69h;\r\n    0x18366c5d6    |    var_58h = (int64_t)&var_80h;\r\n    0x18366c5d6    |    if ((int64_t)var_69h < 0) {\r\n    0x18366c5dd    |        var_50h = var_78h;\r\n    0x18366c5dd    |        var_58h = var_80h;\r\n                   |    }\r\n    0x18366c5f9    |    var_48h = 0x190678fd8;\r\n    0x18366c601    |    var_40h = 3;\r\n    0x18366c62c    |    if (*(int32_t *)(*(int64_t *)(*(int64_t *)(unaff_GS_OFFSET + 0x58) + (uint64_t)*(uint32_t *)0x191d832e0 * 8) + 4) <\r\n    0x18366c62c    |        *(int32_t *)0x191de58ec) goto code_r0x00018366c7ad;\r\n    0x18366c78b    |    while( true ) {\r\n    0x18366c63a    |        func_0x0001806a5270();\r\n    0x18366c647    |        iStack_30 = (int64_t)var_81h;\r\n    0x18366c647    |        piStack_38 = &var_98h;\r\n    0x18366c647    |        if ((int64_t)var_81h < 0) {\r\n    0x18366c64e    |            iStack_30 = var_90h;\r\n    0x18366c64e    |            piStack_38 = (int64_t *)var_98h;\r\n                   |        }\r\n    0x18366c678    |        uStack_60 = 3;\r\n    0x18366c688    |        var_68h = (int64_t)&var_58h;\r\n    0x18366c680    |        func_0x0001841d5a70(&var_c0h);\r\n    0x18366c692    |        if (var_81h < '\\0') {\r\n    0x18366c6a1    |            func_0x0001841dcbe0(var_98h, CONCAT17(var_81h, var_88h) & 0x7fffffffffffffff);\r\n                   |        }\r\n    0x18366c6ab    |        if (var_69h < '\\0') {\r\n    0x18366c6ba    |            func_0x0001841dcbe0(var_80h, CONCAT17(var_69h, var_70h) & 0x7fffffffffffffff);\r\n                   |        }\r\n    0x18366c6bf    |        var_50h = (int64_t)(char)var_a9h;\r\n    0x18366c6c8    |        var_58h = (int64_t)&var_c0h;\r\n    0x18366c6c8    |        if (var_50h < 0) {\r\n    0x18366c6ce    |            var_58h = var_c0h;\r\n    0x18366c6ce    |            var_50h = var_b8h;\r\n                   |        }\r\n    0x18366c6eb    |        var_48h = 0x190bffeb8;\r\n    0x18366c6f3    |        var_40h = 0x13;\r\n    0x18366c707    |        var_90h = 2;\r\n    0x18366c717    |        var_98h = (int64_t)&var_58h;\r\n    0x18366c70f    |        func_0x0001841d5a70(&var_80h);\r\n    0x18366c724    |        iStack_a0 = (int64_t)var_69h;\r\n    0x18366c724    |        unique0x100001ab = &var_80h;\r\n    0x18366c724    |        if ((int64_t)var_69h < 0) {\r\n    0x18366c72b    |            iStack_a0 = var_78h;\r\n    0x18366c72b    |            unique0x100001b3 = (int64_t *)var_80h;\r\n                   |        }\r\n    0x18366c73f    |        func_0x0001845baba0(arg1);\r\n    0x18366c749    |        if (var_69h < '\\0') {\r\n    0x18366c758    |            func_0x0001841dcbe0(var_80h, CONCAT17(var_69h, var_70h) & 0x7fffffffffffffff);\r\n                   |        }\r\n    0x18366c762    |        if ((char)var_a9h < '\\0') {\r\n    0x18366c771    |            func_0x0001841dcbe0(var_c0h, CONCAT17((char)var_a9h, Stack_b0) & 0x7fffffffffffffff);\r\n                   |        }\r\n    0x18366c78b    |        if (*(uint64_t *)0x191c71040 == (var_28h ^ (uint64_t)auStack_e8)) break;\r\n    0x18366c7a5    |        func_0x000185f05b40(var_28h ^ (uint64_t)auStack_e8);\r\n                   |code_r0x00018366c7ad:\r\n    0x18366c7b4    |        func_0x000185f00fe8(0x191de58ec);\r\n    0x18366c7c0    |        if (*(int32_t *)0x191de58ec == -1) {\r\n    0x18366c7cd    |            func_0x000185f00f7c(0x191de58ec);\r\n                   |        }\r\n                   |    }\r\n    0x18366c79c    |    return arg1;\r\n                   |}\r\n[{\"offset\":6499517856,\"name\":\"fcn.18366c5a0\",\"size\":567,\"is-pure\":false,\"realsz\":567,\"noreturn\":false,\"stackframe\":232,\"calltype\":\"ms\",\"cost\":154,\"cc\":11,\"loops\":2,\"bits\":64,\"type\":\"fcn\",\"nbbs\":20,\"edges\":29,\"ebbs\":1,\"signature\":\"fcn.18366c5a0(int64_t arg1, int64_t arg_40h);\",\"minbound\":6499517856,\"maxbound\":6499518423,\"callrefs\":[{\"from\":6499517897,\"to\":6449417312,\"type\":\"CALL\"},{\"from\":6499518010,\"to\":6449418864,\"type\":\"CALL\"},{\"from\":6499518088,\"to\":6511483504,\"type\":\"CALL\"},{\"from\":6499518113,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6499518138,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6499518231,\"to\":6511483504,\"type\":\"CALL\"},{\"from\":6499518271,\"to\":6515567520,\"type\":\"CALL\"},{\"from\":6499518296,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6499518321,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6499518376,\"to\":6542089024,\"type\":\"CALL\"},{\"from\":6499518388,\"to\":6542069736,\"type\":\"CALL\"},{\"from\":6499518413,\"to\":6542069628,\"type\":\"CALL\"},{\"from\":6499518418,\"to\":6499518002,\"type\":\"CODE\"}],\"datarefs\":[{\"from\":6499517871,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6499517938,\"to\":6717673432,\"type\":\"DATA\"},{\"from\":6499517965,\"to\":6742235372,\"type\":\"DATA\"},{\"from\":6499517971,\"to\":6741832416,\"type\":\"DATA\"},{\"from\":6499518180,\"to\":6723468984,\"type\":\"DATA\"},{\"from\":6499518337,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6499518381,\"to\":6742235372,\"type\":\"DATA\"},{\"from\":6499518393,\"to\":6742235372,\"type\":\"DATA\"},{\"from\":6499518406,\"to\":6742235372,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6499518418,\"to\":6499518002,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":1,\"outdegree\":12,\"nlocals\":18,\"nargs\":2,\"stackvars\":[{\"name\":\"var_c0h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-192}},{\"name\":\"var_b8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-184}},{\"name\":\"var_a9h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-169}},{\"name\":\"var_a8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-168}},{\"name\":\"var_98h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-152}},{\"name\":\"var_90h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-144}},{\"name\":\"var_88h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-136}},{\"name\":\"var_81h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-129}},{\"name\":\"var_80h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-128}},{\"name\":\"var_78h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-120}},{\"name\":\"var_70h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-112}},{\"name\":\"var_69h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-105}},{\"name\":\"var_68h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-104}},{\"name\":\"var_58h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-88}},{\"name\":\"var_50h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-80}},{\"name\":\"var_48h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-72}},{\"name\":\"var_40h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-64}},{\"name\":\"var_28h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-40}},{\"name\":\"arg_40h\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":64}}],\"regvars\":[{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"normalized_result":{"stdout":"    0x18366c5a0    |\r\n    0x18366c5a0    |// WARNING: [rz-ghidra] Detected overlap for variable var_81h\r\n    0x18366c5a0    |// WARNING: [rz-ghidra] Detected overlap for variable var_69h\r\n    0x18366c5a0    |// WARNING: [rz-ghidra] Detected overlap for variable var_a8h\r\n    0x18366c5a0    |// WARNING: [rz-ghidra] Detected overlap for variable var_70h\r\n    0x18366c5a0    |// WARNING: [rz-ghidra] Detected overlap for variable var_88h\r\n                   |\r\n    0x18366c5a0    |int64_t fcn.18366c5a0(int64_t arg1, int64_t arg_40h)\r\n                   |{\r\n                   |    int64_t unaff_GS_OFFSET;\r\n                   |    undefined auStack_e8 [40];\r\n                   |    int64_t var_c0h;\r\n                   |    int64_t var_b8h;\r\n                   |    unkbyte7 Stack_b0;\r\n                   |    int64_t var_a9h;\r\n                   |    int64_t iStack_a0;\r\n                   |    int64_t var_98h;\r\n                   |    int64_t var_90h;\r\n                   |    unkbyte7 var_88h;\r\n                   |    char var_81h;\r\n                   |    int64_t var_80h;\r\n                   |    int64_t var_78h;\r\n                   |    unkbyte7 var_70h;\r\n                   |    char var_69h;\r\n                   |    int64_t var_68h;\r\n                   |    undefined8 uStack_60;\r\n                   |    int64_t var_58h;\r\n                   |    int64_t var_50h;\r\n                   |    int64_t var_48h;\r\n                   |    int64_t var_40h;\r\n                   |    int64_t *piStack_38;\r\n                   |    int64_t iStack_30;\r\n                   |    int64_t var_28h;\r\n                   |    \r\n    0x18366c5b6    |    var_28h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_e8;\r\n    0x18366c5c1    |    func_0x0001806a4c60(&var_80h);\r\n    0x18366c5d6    |    var_50h = (int64_t)var_69h;\r\n    0x18366c5d6    |    var_58h = (int64_t)&var_80h;\r\n    0x18366c5d6    |    if ((int64_t)var_69h < 0) {\r\n    0x18366c5dd    |        var_50h = var_78h;\r\n    0x18366c5dd    |        var_58h = var_80h;\r\n                   |    }\r\n    0x18366c5f9    |    var_48h = 0x190678fd8;\r\n    0x18366c601    |    var_40h = 3;\r\n    0x18366c62c    |    if (*(int32_t *)(*(int64_t *)(*(int64_t *)(unaff_GS_OFFSET + 0x58) + (uint64_t)*(uint32_t *)0x191d832e0 * 8) + 4) <\r\n    0x18366c62c    |        *(int32_t *)0x191de58ec) goto code_r0x00018366c7ad;\r\n    0x18366c78b    |    while( true ) {\r\n    0x18366c63a    |        func_0x0001806a5270();\r\n    0x18366c647    |        iStack_30 = (int64_t)var_81h;\r\n    0x18366c647    |        piStack_38 = &var_98h;\r\n    0x18366c647    |        if ((int64_t)var_81h < 0) {\r\n    0x18366c64e    |            iStack_30 = var_90h;\r\n    0x18366c64e    |            piStack_38 = (int64_t *)var_98h;\r\n                   |        }\r\n    0x18366c678    |        uStack_60 = 3;\r\n    0x18366c688    |        var_68h = (int64_t)&var_58h;\r\n    0x18366c680    |        func_0x0001841d5a70(&var_c0h);\r\n    0x18366c692    |        if (var_81h < '\\0') {\r\n    0x18366c6a1    |            func_0x0001841dcbe0(var_98h, CONCAT17(var_81h, var_88h) & 0x7fffffffffffffff);\r\n                   |        }\r\n    0x18366c6ab    |        if (var_69h < '\\0') {\r\n    0x18366c6ba    |            func_0x0001841dcbe0(var_80h, CONCAT17(var_69h, var_70h) & 0x7fffffffffffffff);\r\n                   |        }\r\n    0x18366c6bf    |        var_50h = (int64_t)(char)var_a9h;\r\n    0x18366c6c8    |        var_58h = (int64_t)&var_c0h;\r\n    0x18366c6c8    |        if (var_50h < 0) {\r\n    0x18366c6ce    |            var_58h = var_c0h;\r\n    0x18366c6ce    |            var_50h = var_b8h;\r\n                   |        }\r\n    0x18366c6eb    |        var_48h = 0x190bffeb8;\r\n    0x18366c6f3    |        var_40h = 0x13;\r\n    0x18366c707    |        var_90h = 2;\r\n    0x18366c717    |        var_98h = (int64_t)&var_58h;\r\n    0x18366c70f    |        func_0x0001841d5a70(&var_80h);\r\n    0x18366c724    |        iStack_a0 = (int64_t)var_69h;\r\n    0x18366c724    |        unique0x100001ab = &var_80h;\r\n    0x18366c724    |        if ((int64_t)var_69h < 0) {\r\n    0x18366c72b    |            iStack_a0 = var_78h;\r\n    0x18366c72b    |            unique0x100001b3 = (int64_t *)var_80h;\r\n                   |        }\r\n    0x18366c73f    |        func_0x0001845baba0(arg1);\r\n    0x18366c749    |        if (var_69h < '\\0') {\r\n    0x18366c758    |            func_0x0001841dcbe0(var_80h, CONCAT17(var_69h, var_70h) & 0x7fffffffffffffff);\r\n                   |        }\r\n    0x18366c762    |        if ((char)var_a9h < '\\0') {\r\n    0x18366c771    |            func_0x0001841dcbe0(var_c0h, CONCAT17((char)var_a9h, Stack_b0) & 0x7fffffffffffffff);\r\n                   |        }\r\n    0x18366c78b    |        if (*(uint64_t *)0x191c71040 == (var_28h ^ (uint64_t)auStack_e8)) break;\r\n    0x18366c7a5    |        func_0x000185f05b40(var_28h ^ (uint64_t)auStack_e8);\r\n                   |code_r0x00018366c7ad:\r\n    0x18366c7b4    |        func_0x000185f00fe8(0x191de58ec);\r\n    0x18366c7c0    |        if (*(int32_t *)0x191de58ec == -1) {\r\n    0x18366c7cd    |            func_0x000185f00f7c(0x191de58ec);\r\n                   |        }\r\n                   |    }\r\n    0x18366c79c    |    return arg1;\r\n                   |}\r\n[{\"offset\":6499517856,\"name\":\"fcn.18366c5a0\",\"size\":567,\"is-pure\":false,\"realsz\":567,\"noreturn\":false,\"stackframe\":232,\"calltype\":\"ms\",\"cost\":154,\"cc\":11,\"loops\":2,\"bits\":64,\"type\":\"fcn\",\"nbbs\":20,\"edges\":29,\"ebbs\":1,\"signature\":\"fcn.18366c5a0(int64_t arg1, int64_t arg_40h);\",\"minbound\":6499517856,\"maxbound\":6499518423,\"callrefs\":[{\"from\":6499517897,\"to\":6449417312,\"type\":\"CALL\"},{\"from\":6499518010,\"to\":6449418864,\"type\":\"CALL\"},{\"from\":6499518088,\"to\":6511483504,\"type\":\"CALL\"},{\"from\":6499518113,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6499518138,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6499518231,\"to\":6511483504,\"type\":\"CALL\"},{\"from\":6499518271,\"to\":6515567520,\"type\":\"CALL\"},{\"from\":6499518296,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6499518321,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6499518376,\"to\":6542089024,\"type\":\"CALL\"},{\"from\":6499518388,\"to\":6542069736,\"type\":\"CALL\"},{\"from\":6499518413,\"to\":6542069628,\"type\":\"CALL\"},{\"from\":6499518418,\"to\":6499518002,\"type\":\"CODE\"}],\"datarefs\":[{\"from\":6499517871,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6499517938,\"to\":6717673432,\"type\":\"DATA\"},{\"from\":6499517965,\"to\":6742235372,\"type\":\"DATA\"},{\"from\":6499517971,\"to\":6741832416,\"type\":\"DATA\"},{\"from\":6499518180,\"to\":6723468984,\"type\":\"DATA\"},{\"from\":6499518337,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6499518381,\"to\":6742235372,\"type\":\"DATA\"},{\"from\":6499518393,\"to\":6742235372,\"type\":\"DATA\"},{\"from\":6499518406,\"to\":6742235372,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6499518418,\"to\":6499518002,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":1,\"outdegree\":12,\"nlocals\":18,\"nargs\":2,\"stackvars\":[{\"name\":\"var_c0h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-192}},{\"name\":\"var_b8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-184}},{\"name\":\"var_a9h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-169}},{\"name\":\"var_a8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-168}},{\"name\":\"var_98h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-152}},{\"name\":\"var_90h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-144}},{\"name\":\"var_88h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-136}},{\"name\":\"var_81h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-129}},{\"name\":\"var_80h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-128}},{\"name\":\"var_78h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-120}},{\"name\":\"var_70h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-112}},{\"name\":\"var_69h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-105}},{\"name\":\"var_68h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-104}},{\"name\":\"var_58h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-88}},{\"name\":\"var_50h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-80}},{\"name\":\"var_48h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-72}},{\"name\":\"var_40h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-64}},{\"name\":\"var_28h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-40}},{\"name\":\"arg_40h\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":64}}],\"regvars\":[{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"confidence":"observed","authority":"shipped-artifact","environment":null,"limitations":["The executable version and supported formats are reported as unknown because no reliable version probe was performed.","A non-zero process exit is preserved as an observed command result.","Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.","When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call."],"relationship_coverage":null,"locations":[{"kind":"artifact-path","path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"}],"evidence_links":[]},"meta":{"command":"execute-rizin-command","duration":"4962ms"}}