{"ok":true,"data":{"evidence_id":"ev_3c75e51a92835d327e3ff02283f2873a45a3bcf8e02180c00e04490911465c9f","subject":{"name":"Tabbit.dll","digest":{"sha256":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c"},"local_path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","format":"unknown","architecture":null},"provider":{"id":"rizin","name":"Rizin","version":null},"analysis_profile":null,"predicate_type":"rea.reverse-engineering.command-observation","operation":"execute_rizin_command","parameters":{"path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","command":"e scr.color=0;af @ 0x1837c8ce0;pdgo @ 0x1837c8ce0;afij @ 0x1837c8ce0","provider_executable":"C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe","command_arguments":["-N","-q","-c","e scr.color=0;af @ 0x1837c8ce0;pdgo @ 0x1837c8ce0;afij @ 0x1837c8ce0","C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"]},"raw_result":{"stdout":"    0x1837c8ce0    |\r\n    0x1837c8ce0    |// WARNING: [rz-ghidra] Detected overlap for variable var_1f8h\r\n                   |\r\n    0x1837c8ce0    |void fcn.1837c8ce0(int64_t arg1, int64_t arg2, int64_t arg3)\r\n                   |{\r\n                   |    int64_t iVar1;\r\n                   |    int32_t *piVar2;\r\n                   |    int32_t iVar3;\r\n                   |    int64_t iVar4;\r\n                   |    char cVar5;\r\n                   |    int64_t *piVar6;\r\n                   |    int64_t iVar7;\r\n                   |    int64_t var_228h;\r\n                   |    int64_t var_220h;\r\n                   |    int64_t var_218h;\r\n                   |    int64_t var_208h;\r\n                   |    int64_t var_200h;\r\n                   |    undefined var_1f8h [7];\r\n                   |    int64_t var_1f1h;\r\n                   |    int64_t var_1e8h;\r\n                   |    undefined4 uStack_1e0;\r\n                   |    undefined4 uStack_1dc;\r\n                   |    int64_t var_1d8h;\r\n                   |    undefined4 uStack_1d0;\r\n                   |    undefined4 uStack_1cc;\r\n                   |    int64_t var_1c8h;\r\n                   |    undefined4 uStack_1c0;\r\n                   |    undefined4 uStack_1bc;\r\n                   |    int64_t var_1b8h;\r\n                   |    undefined4 uStack_1b0;\r\n                   |    undefined4 uStack_1ac;\r\n                   |    int64_t var_1a0h;\r\n                   |    undefined8 uStack_198;\r\n                   |    int64_t var_190h;\r\n                   |    undefined8 uStack_188;\r\n                   |    int64_t var_180h;\r\n                   |    undefined8 uStack_178;\r\n                   |    int64_t var_170h;\r\n                   |    undefined8 uStack_168;\r\n                   |    int64_t var_160h;\r\n                   |    undefined8 uStack_158;\r\n                   |    int64_t var_150h;\r\n                   |    int64_t *piStack_148;\r\n                   |    int64_t var_140h;\r\n                   |    int64_t var_138h;\r\n                   |    int64_t iStack_130;\r\n                   |    int64_t var_f8h;\r\n                   |    int64_t var_e8h;\r\n                   |    int64_t var_d0h;\r\n                   |    \r\n    0x1837c8cfd    |    var_228h = 0;\r\n    0x1837c8cfd    |    var_220h = 0;\r\n    0x1837c8d00    |    var_218h = 0;\r\n    0x1837c8d17    |    var_160h = 0x19042dfa0;\r\n    0x1837c8d1a    |    uStack_158 = 5;\r\n    0x1837c8cf8    |    func_0x000180eb9ad0(&var_228h, &var_160h, 0x190c20e50);\r\n    0x1837c8d31    |    var_1b8h._0_4_ = *(undefined4 *)arg1;\r\n    0x1837c8d31    |    var_1b8h._4_4_ = *(undefined4 *)(arg1 + 4);\r\n    0x1837c8d31    |    uStack_1b0 = *(undefined4 *)(arg1 + 8);\r\n    0x1837c8d31    |    uStack_1ac = *(undefined4 *)(arg1 + 0xc);\r\n    0x1837c8d50    |    var_170h = 0x1904094d0;\r\n    0x1837c8d59    |    uStack_168 = 6;\r\n    0x1837c8cf8    |    func_0x000180d020a0(&var_228h);\r\n    0x1837c8d65    |    var_1c8h._0_4_ = *(undefined4 *)arg3;\r\n    0x1837c8d65    |    var_1c8h._4_4_ = *(undefined4 *)(arg3 + 4);\r\n    0x1837c8d65    |    uStack_1c0 = *(undefined4 *)(arg3 + 8);\r\n    0x1837c8d65    |    uStack_1bc = *(undefined4 *)(arg3 + 0xc);\r\n    0x1837c8d83    |    var_180h = 0x1904025a8;\r\n    0x1837c8d86    |    uStack_178 = 6;\r\n    0x1837c8cf8    |    func_0x000180d020a0(&var_228h);\r\n    0x1837c8d97    |    if (*(int64_t *)(arg2 + 0x10) != 0) {\r\n    0x1837c8d99    |        var_1d8h._0_4_ = *(undefined4 *)(arg2 + 8);\r\n    0x1837c8d99    |        var_1d8h._4_4_ = *(undefined4 *)(arg2 + 0xc);\r\n    0x1837c8d99    |        uStack_1d0 = *(undefined4 *)(arg2 + 0x10);\r\n    0x1837c8d99    |        uStack_1cc = *(undefined4 *)(arg2 + 0x14);\r\n    0x1837c8db5    |        var_190h = 0x1908fe844;\r\n    0x1837c8db8    |        uStack_188 = 6;\r\n    0x1837c8dc0    |        func_0x000180d020a0(&var_228h);\r\n                   |    }\r\n    0x1837c8dcf    |    if (*(int64_t *)(arg2 + 0x20) != 0) {\r\n    0x1837c8dd1    |        var_1e8h._0_4_ = *(undefined4 *)(arg2 + 0x18);\r\n    0x1837c8dd1    |        var_1e8h._4_4_ = *(undefined4 *)(arg2 + 0x1c);\r\n    0x1837c8dd1    |        uStack_1e0 = *(undefined4 *)(arg2 + 0x20);\r\n    0x1837c8dd1    |        uStack_1dc = *(undefined4 *)(arg2 + 0x24);\r\n    0x1837c8ded    |        var_1a0h = 0x190616b90;\r\n    0x1837c8df0    |        uStack_198 = 8;\r\n    0x1837c8df8    |        func_0x000180d020a0(&var_228h);\r\n                   |    }\r\n    0x1837c8e0a    |    var_208h = 0;\r\n    0x1837c8e0a    |    var_200h = 0;\r\n    0x1837c8e0d    |    _var_1f8h = 0;\r\n    0x1837c8e21    |    var_140h._0_1_ = 6;\r\n    0x1837c8e30    |    piStack_148 = &var_228h;\r\n    0x1837c8e30    |    cVar5 = func_0x000181b4a620(&var_150h, 0, &var_208h, 200);\r\n    0x1837c8e5b    |    if (((cVar5 != '\\0') && (*(int32_t *)0x191de85c0 < 2)) &&\r\n    0x1837c8e4a    |       ((*(int32_t *)0x191cd6be0 != 0 || (*(int64_t *)0x191de85c8 != 0)))) {\r\n    0x1837c8e68    |        func_0x00018030d390(&var_150h, 0x190c20e78, 0x22, 1);\r\n    0x1837c8e8d    |        piVar6 = &var_208h;\r\n    0x1837c8e8d    |        iVar4 = (int64_t)(char)var_1f1h;\r\n    0x1837c8e8d    |        if ((int64_t)(char)var_1f1h < 0) {\r\n    0x1837c8e9b    |            piVar6 = (int64_t *)var_208h;\r\n    0x1837c8e9b    |            iVar4 = var_200h;\r\n                   |        }\r\n    0x1837c8e93    |        func_0x000184dcd0d0(&var_140h, piVar6, iVar4);\r\n    0x1837c8eb3    |        var_150h = 0x18ff81648;\r\n    0x1837c8e68    |        func_0x00018030e9d0(&var_150h);\r\n    0x1837c8ecd    |        *(undefined8 *)((int64_t)&var_140h + (int64_t)*(int32_t *)(CONCAT71(var_140h._1_7_, (undefined)var_140h) + 4)) =\r\n    0x1837c8ecd    |             0x18fe1b290;\r\n    0x1837c8edc    |        var_138h = 0x18fe20d40;\r\n    0x1837c8ee4    |        if (var_e8h._7_1_ < '\\0') {\r\n    0x1837c8f00    |            func_0x0001841dcbe0(var_f8h, CONCAT17(var_e8h._7_1_, (unkbyte7)var_e8h) & 0x7fffffffffffffff);\r\n                   |        }\r\n    0x1837c8f14    |        var_138h = 0x18fe20db0;\r\n    0x1837c8f25    |        if (iStack_130 != 0x191de1450) {\r\n    0x1837c8fc1    |            LOCK();\r\n    0x1837c8fc1    |            piVar2 = (int32_t *)(iStack_130 + 8);\r\n    0x1837c8fc1    |            iVar3 = *piVar2;\r\n    0x1837c8fc1    |            *piVar2 = *piVar2 + -1;\r\n    0x1837c8fc1    |            UNLOCK();\r\n    0x1837c8fc8    |            if (iVar3 == 0) {\r\n    0x1837c8fd5    |                (*(code *)0x185f59da0)();\r\n                   |            }\r\n                   |        }\r\n    0x1837c8f05    |        func_0x00018424db70(&var_138h);\r\n    0x1837c8f2b    |        func_0x0001848f8b80(&var_d0h);\r\n                   |    }\r\n    0x1837c8f48    |    if ((int64_t)_var_1f8h < 0) {\r\n    0x1837c8f5e    |        func_0x0001841dcbe0(var_208h, _var_1f8h & 0x7fffffffffffffff);\r\n                   |    }\r\n    0x1837c8f63    |    iVar4 = var_228h;\r\n    0x1837c8f6b    |    if (var_228h != 0) {\r\n    0x1837c8f7f    |        iVar7 = var_220h << 5;\r\n    0x1837c8f86    |        if (iVar7 != 0) {\r\n    0x1837c8f88    |            iVar1 = var_228h + -0x20;\r\n                   |            do {\r\n    0x1837c8f8c    |                func_0x000184e58cd0(iVar1 + iVar7);\r\n    0x1837c8f95    |                iVar7 = iVar7 + -0x20;\r\n    0x1837c8f99    |            } while (iVar7 != 0);\r\n                   |        }\r\n    0x1837c8fa3    |        var_220h = iVar4 - var_228h >> 5;\r\n    0x1837c8fb5    |        func_0x0001841dcbe0(var_228h, var_218h << 5);\r\n                   |    }\r\n    0x1837c8f79    |    return;\r\n                   |}\r\n[{\"offset\":6500945120,\"name\":\"fcn.1837c8ce0\",\"size\":768,\"is-pure\":false,\"realsz\":768,\"noreturn\":false,\"stackframe\":584,\"calltype\":\"ms\",\"cost\":211,\"cc\":14,\"loops\":3,\"bits\":64,\"type\":\"fcn\",\"nbbs\":23,\"edges\":35,\"ebbs\":1,\"signature\":\"fcn.1837c8ce0(int64_t arg1, int64_t arg2, int64_t arg3);\",\"minbound\":6500945120,\"maxbound\":6500945888,\"callrefs\":[{\"from\":6500945196,\"to\":6457891536,\"type\":\"CALL\"},{\"from\":6500945248,\"to\":6456090784,\"type\":\"CALL\"},{\"from\":6500945293,\"to\":6456090784,\"type\":\"CALL\"},{\"from\":6500945349,\"to\":6456090784,\"type\":\"CALL\"},{\"from\":6500945405,\"to\":6456090784,\"type\":\"CALL\"},{\"from\":6500945456,\"to\":6471067168,\"type\":\"CALL\"},{\"from\":6500945535,\"to\":6445650832,\"type\":\"CALL\"},{\"from\":6500945575,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6500945594,\"to\":6445656528,\"type\":\"CALL\"},{\"from\":6500945664,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6500945718,\"to\":6511975280,\"type\":\"CALL\"},{\"from\":6500945726,\"to\":6518967168,\"type\":\"CALL\"},{\"from\":6500945758,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6500945808,\"to\":6524603600,\"type\":\"CALL\"},{\"from\":6500945845,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6500945850,\"to\":6500945773,\"type\":\"CODE\"},{\"from\":6500945877,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6500945883,\"to\":6500945707,\"type\":\"CODE\"}],\"datarefs\":[{\"from\":6500945160,\"to\":6715269024,\"type\":\"DATA\"},{\"from\":6500945186,\"to\":6723604048,\"type\":\"DATA\"},{\"from\":6500945217,\"to\":6715118800,\"type\":\"DATA\"},{\"from\":6500945268,\"to\":6715090344,\"type\":\"DATA\"},{\"from\":6500945318,\"to\":6720317508,\"type\":\"DATA\"},{\"from\":6500945374,\"to\":6717270928,\"type\":\"DATA\"},{\"from\":6500945469,\"to\":6742246848,\"type\":\"DATA\"},{\"from\":6500945482,\"to\":6741126112,\"type\":\"DATA\"},{\"from\":6500945491,\"to\":6742246856,\"type\":\"DATA\"},{\"from\":6500945505,\"to\":6723604088,\"type\":\"DATA\"},{\"from\":6500945580,\"to\":6710367816,\"type\":\"DATA\"},{\"from\":6500945606,\"to\":6708900496,\"type\":\"DATA\"},{\"from\":6500945621,\"to\":6708923712,\"type\":\"DATA\"},{\"from\":6500945677,\"to\":6708923824,\"type\":\"DATA\"},{\"from\":6500945691,\"to\":6742217808,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6500945850,\"to\":6500945773,\"type\":\"CODE\"},{\"from\":6500945883,\"to\":6500945707,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":2,\"outdegree\":16,\"nlocals\":22,\"nargs\":3,\"stackvars\":[{\"name\":\"var_228h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-552}},{\"name\":\"var_220h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-544}},{\"name\":\"var_218h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-536}},{\"name\":\"var_208h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-520}},{\"name\":\"var_200h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-512}},{\"name\":\"var_1f8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-504}},{\"name\":\"var_1f1h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-497}},{\"name\":\"var_1e8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-488}},{\"name\":\"var_1d8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-472}},{\"name\":\"var_1c8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-456}},{\"name\":\"var_1b8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-440}},{\"name\":\"var_1a0h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-416}},{\"name\":\"var_190h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-400}},{\"name\":\"var_180h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-384}},{\"name\":\"var_170h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-368}},{\"name\":\"var_160h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-352}},{\"name\":\"var_150h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-336}},{\"name\":\"var_140h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-320}},{\"name\":\"var_138h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-312}},{\"name\":\"var_f8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-248}},{\"name\":\"var_e8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-232}},{\"name\":\"var_d0h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-208}}],\"regvars\":[{\"name\":\"arg3\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"r8\"}},{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"normalized_result":{"stdout":"    0x1837c8ce0    |\r\n    0x1837c8ce0    |// WARNING: [rz-ghidra] Detected overlap for variable var_1f8h\r\n                   |\r\n    0x1837c8ce0    |void fcn.1837c8ce0(int64_t arg1, int64_t arg2, int64_t arg3)\r\n                   |{\r\n                   |    int64_t iVar1;\r\n                   |    int32_t *piVar2;\r\n                   |    int32_t iVar3;\r\n                   |    int64_t iVar4;\r\n                   |    char cVar5;\r\n                   |    int64_t *piVar6;\r\n                   |    int64_t iVar7;\r\n                   |    int64_t var_228h;\r\n                   |    int64_t var_220h;\r\n                   |    int64_t var_218h;\r\n                   |    int64_t var_208h;\r\n                   |    int64_t var_200h;\r\n                   |    undefined var_1f8h [7];\r\n                   |    int64_t var_1f1h;\r\n                   |    int64_t var_1e8h;\r\n                   |    undefined4 uStack_1e0;\r\n                   |    undefined4 uStack_1dc;\r\n                   |    int64_t var_1d8h;\r\n                   |    undefined4 uStack_1d0;\r\n                   |    undefined4 uStack_1cc;\r\n                   |    int64_t var_1c8h;\r\n                   |    undefined4 uStack_1c0;\r\n                   |    undefined4 uStack_1bc;\r\n                   |    int64_t var_1b8h;\r\n                   |    undefined4 uStack_1b0;\r\n                   |    undefined4 uStack_1ac;\r\n                   |    int64_t var_1a0h;\r\n                   |    undefined8 uStack_198;\r\n                   |    int64_t var_190h;\r\n                   |    undefined8 uStack_188;\r\n                   |    int64_t var_180h;\r\n                   |    undefined8 uStack_178;\r\n                   |    int64_t var_170h;\r\n                   |    undefined8 uStack_168;\r\n                   |    int64_t var_160h;\r\n                   |    undefined8 uStack_158;\r\n                   |    int64_t var_150h;\r\n                   |    int64_t *piStack_148;\r\n                   |    int64_t var_140h;\r\n                   |    int64_t var_138h;\r\n                   |    int64_t iStack_130;\r\n                   |    int64_t var_f8h;\r\n                   |    int64_t var_e8h;\r\n                   |    int64_t var_d0h;\r\n                   |    \r\n    0x1837c8cfd    |    var_228h = 0;\r\n    0x1837c8cfd    |    var_220h = 0;\r\n    0x1837c8d00    |    var_218h = 0;\r\n    0x1837c8d17    |    var_160h = 0x19042dfa0;\r\n    0x1837c8d1a    |    uStack_158 = 5;\r\n    0x1837c8cf8    |    func_0x000180eb9ad0(&var_228h, &var_160h, 0x190c20e50);\r\n    0x1837c8d31    |    var_1b8h._0_4_ = *(undefined4 *)arg1;\r\n    0x1837c8d31    |    var_1b8h._4_4_ = *(undefined4 *)(arg1 + 4);\r\n    0x1837c8d31    |    uStack_1b0 = *(undefined4 *)(arg1 + 8);\r\n    0x1837c8d31    |    uStack_1ac = *(undefined4 *)(arg1 + 0xc);\r\n    0x1837c8d50    |    var_170h = 0x1904094d0;\r\n    0x1837c8d59    |    uStack_168 = 6;\r\n    0x1837c8cf8    |    func_0x000180d020a0(&var_228h);\r\n    0x1837c8d65    |    var_1c8h._0_4_ = *(undefined4 *)arg3;\r\n    0x1837c8d65    |    var_1c8h._4_4_ = *(undefined4 *)(arg3 + 4);\r\n    0x1837c8d65    |    uStack_1c0 = *(undefined4 *)(arg3 + 8);\r\n    0x1837c8d65    |    uStack_1bc = *(undefined4 *)(arg3 + 0xc);\r\n    0x1837c8d83    |    var_180h = 0x1904025a8;\r\n    0x1837c8d86    |    uStack_178 = 6;\r\n    0x1837c8cf8    |    func_0x000180d020a0(&var_228h);\r\n    0x1837c8d97    |    if (*(int64_t *)(arg2 + 0x10) != 0) {\r\n    0x1837c8d99    |        var_1d8h._0_4_ = *(undefined4 *)(arg2 + 8);\r\n    0x1837c8d99    |        var_1d8h._4_4_ = *(undefined4 *)(arg2 + 0xc);\r\n    0x1837c8d99    |        uStack_1d0 = *(undefined4 *)(arg2 + 0x10);\r\n    0x1837c8d99    |        uStack_1cc = *(undefined4 *)(arg2 + 0x14);\r\n    0x1837c8db5    |        var_190h = 0x1908fe844;\r\n    0x1837c8db8    |        uStack_188 = 6;\r\n    0x1837c8dc0    |        func_0x000180d020a0(&var_228h);\r\n                   |    }\r\n    0x1837c8dcf    |    if (*(int64_t *)(arg2 + 0x20) != 0) {\r\n    0x1837c8dd1    |        var_1e8h._0_4_ = *(undefined4 *)(arg2 + 0x18);\r\n    0x1837c8dd1    |        var_1e8h._4_4_ = *(undefined4 *)(arg2 + 0x1c);\r\n    0x1837c8dd1    |        uStack_1e0 = *(undefined4 *)(arg2 + 0x20);\r\n    0x1837c8dd1    |        uStack_1dc = *(undefined4 *)(arg2 + 0x24);\r\n    0x1837c8ded    |        var_1a0h = 0x190616b90;\r\n    0x1837c8df0    |        uStack_198 = 8;\r\n    0x1837c8df8    |        func_0x000180d020a0(&var_228h);\r\n                   |    }\r\n    0x1837c8e0a    |    var_208h = 0;\r\n    0x1837c8e0a    |    var_200h = 0;\r\n    0x1837c8e0d    |    _var_1f8h = 0;\r\n    0x1837c8e21    |    var_140h._0_1_ = 6;\r\n    0x1837c8e30    |    piStack_148 = &var_228h;\r\n    0x1837c8e30    |    cVar5 = func_0x000181b4a620(&var_150h, 0, &var_208h, 200);\r\n    0x1837c8e5b    |    if (((cVar5 != '\\0') && (*(int32_t *)0x191de85c0 < 2)) &&\r\n    0x1837c8e4a    |       ((*(int32_t *)0x191cd6be0 != 0 || (*(int64_t *)0x191de85c8 != 0)))) {\r\n    0x1837c8e68    |        func_0x00018030d390(&var_150h, 0x190c20e78, 0x22, 1);\r\n    0x1837c8e8d    |        piVar6 = &var_208h;\r\n    0x1837c8e8d    |        iVar4 = (int64_t)(char)var_1f1h;\r\n    0x1837c8e8d    |        if ((int64_t)(char)var_1f1h < 0) {\r\n    0x1837c8e9b    |            piVar6 = (int64_t *)var_208h;\r\n    0x1837c8e9b    |            iVar4 = var_200h;\r\n                   |        }\r\n    0x1837c8e93    |        func_0x000184dcd0d0(&var_140h, piVar6, iVar4);\r\n    0x1837c8eb3    |        var_150h = 0x18ff81648;\r\n    0x1837c8e68    |        func_0x00018030e9d0(&var_150h);\r\n    0x1837c8ecd    |        *(undefined8 *)((int64_t)&var_140h + (int64_t)*(int32_t *)(CONCAT71(var_140h._1_7_, (undefined)var_140h) + 4)) =\r\n    0x1837c8ecd    |             0x18fe1b290;\r\n    0x1837c8edc    |        var_138h = 0x18fe20d40;\r\n    0x1837c8ee4    |        if (var_e8h._7_1_ < '\\0') {\r\n    0x1837c8f00    |            func_0x0001841dcbe0(var_f8h, CONCAT17(var_e8h._7_1_, (unkbyte7)var_e8h) & 0x7fffffffffffffff);\r\n                   |        }\r\n    0x1837c8f14    |        var_138h = 0x18fe20db0;\r\n    0x1837c8f25    |        if (iStack_130 != 0x191de1450) {\r\n    0x1837c8fc1    |            LOCK();\r\n    0x1837c8fc1    |            piVar2 = (int32_t *)(iStack_130 + 8);\r\n    0x1837c8fc1    |            iVar3 = *piVar2;\r\n    0x1837c8fc1    |            *piVar2 = *piVar2 + -1;\r\n    0x1837c8fc1    |            UNLOCK();\r\n    0x1837c8fc8    |            if (iVar3 == 0) {\r\n    0x1837c8fd5    |                (*(code *)0x185f59da0)();\r\n                   |            }\r\n                   |        }\r\n    0x1837c8f05    |        func_0x00018424db70(&var_138h);\r\n    0x1837c8f2b    |        func_0x0001848f8b80(&var_d0h);\r\n                   |    }\r\n    0x1837c8f48    |    if ((int64_t)_var_1f8h < 0) {\r\n    0x1837c8f5e    |        func_0x0001841dcbe0(var_208h, _var_1f8h & 0x7fffffffffffffff);\r\n                   |    }\r\n    0x1837c8f63    |    iVar4 = var_228h;\r\n    0x1837c8f6b    |    if (var_228h != 0) {\r\n    0x1837c8f7f    |        iVar7 = var_220h << 5;\r\n    0x1837c8f86    |        if (iVar7 != 0) {\r\n    0x1837c8f88    |            iVar1 = var_228h + -0x20;\r\n                   |            do {\r\n    0x1837c8f8c    |                func_0x000184e58cd0(iVar1 + iVar7);\r\n    0x1837c8f95    |                iVar7 = iVar7 + -0x20;\r\n    0x1837c8f99    |            } while (iVar7 != 0);\r\n                   |        }\r\n    0x1837c8fa3    |        var_220h = iVar4 - var_228h >> 5;\r\n    0x1837c8fb5    |        func_0x0001841dcbe0(var_228h, var_218h << 5);\r\n                   |    }\r\n    0x1837c8f79    |    return;\r\n                   |}\r\n[{\"offset\":6500945120,\"name\":\"fcn.1837c8ce0\",\"size\":768,\"is-pure\":false,\"realsz\":768,\"noreturn\":false,\"stackframe\":584,\"calltype\":\"ms\",\"cost\":211,\"cc\":14,\"loops\":3,\"bits\":64,\"type\":\"fcn\",\"nbbs\":23,\"edges\":35,\"ebbs\":1,\"signature\":\"fcn.1837c8ce0(int64_t arg1, int64_t arg2, int64_t arg3);\",\"minbound\":6500945120,\"maxbound\":6500945888,\"callrefs\":[{\"from\":6500945196,\"to\":6457891536,\"type\":\"CALL\"},{\"from\":6500945248,\"to\":6456090784,\"type\":\"CALL\"},{\"from\":6500945293,\"to\":6456090784,\"type\":\"CALL\"},{\"from\":6500945349,\"to\":6456090784,\"type\":\"CALL\"},{\"from\":6500945405,\"to\":6456090784,\"type\":\"CALL\"},{\"from\":6500945456,\"to\":6471067168,\"type\":\"CALL\"},{\"from\":6500945535,\"to\":6445650832,\"type\":\"CALL\"},{\"from\":6500945575,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6500945594,\"to\":6445656528,\"type\":\"CALL\"},{\"from\":6500945664,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6500945718,\"to\":6511975280,\"type\":\"CALL\"},{\"from\":6500945726,\"to\":6518967168,\"type\":\"CALL\"},{\"from\":6500945758,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6500945808,\"to\":6524603600,\"type\":\"CALL\"},{\"from\":6500945845,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6500945850,\"to\":6500945773,\"type\":\"CODE\"},{\"from\":6500945877,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6500945883,\"to\":6500945707,\"type\":\"CODE\"}],\"datarefs\":[{\"from\":6500945160,\"to\":6715269024,\"type\":\"DATA\"},{\"from\":6500945186,\"to\":6723604048,\"type\":\"DATA\"},{\"from\":6500945217,\"to\":6715118800,\"type\":\"DATA\"},{\"from\":6500945268,\"to\":6715090344,\"type\":\"DATA\"},{\"from\":6500945318,\"to\":6720317508,\"type\":\"DATA\"},{\"from\":6500945374,\"to\":6717270928,\"type\":\"DATA\"},{\"from\":6500945469,\"to\":6742246848,\"type\":\"DATA\"},{\"from\":6500945482,\"to\":6741126112,\"type\":\"DATA\"},{\"from\":6500945491,\"to\":6742246856,\"type\":\"DATA\"},{\"from\":6500945505,\"to\":6723604088,\"type\":\"DATA\"},{\"from\":6500945580,\"to\":6710367816,\"type\":\"DATA\"},{\"from\":6500945606,\"to\":6708900496,\"type\":\"DATA\"},{\"from\":6500945621,\"to\":6708923712,\"type\":\"DATA\"},{\"from\":6500945677,\"to\":6708923824,\"type\":\"DATA\"},{\"from\":6500945691,\"to\":6742217808,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6500945850,\"to\":6500945773,\"type\":\"CODE\"},{\"from\":6500945883,\"to\":6500945707,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":2,\"outdegree\":16,\"nlocals\":22,\"nargs\":3,\"stackvars\":[{\"name\":\"var_228h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-552}},{\"name\":\"var_220h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-544}},{\"name\":\"var_218h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-536}},{\"name\":\"var_208h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-520}},{\"name\":\"var_200h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-512}},{\"name\":\"var_1f8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-504}},{\"name\":\"var_1f1h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-497}},{\"name\":\"var_1e8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-488}},{\"name\":\"var_1d8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-472}},{\"name\":\"var_1c8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-456}},{\"name\":\"var_1b8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-440}},{\"name\":\"var_1a0h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-416}},{\"name\":\"var_190h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-400}},{\"name\":\"var_180h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-384}},{\"name\":\"var_170h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-368}},{\"name\":\"var_160h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-352}},{\"name\":\"var_150h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-336}},{\"name\":\"var_140h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-320}},{\"name\":\"var_138h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-312}},{\"name\":\"var_f8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-248}},{\"name\":\"var_e8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-232}},{\"name\":\"var_d0h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-208}}],\"regvars\":[{\"name\":\"arg3\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"r8\"}},{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"confidence":"observed","authority":"shipped-artifact","environment":null,"limitations":["The executable version and supported formats are reported as unknown because no reliable version probe was performed.","A non-zero process exit is preserved as an observed command result.","Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.","When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call."],"relationship_coverage":null,"locations":[{"kind":"artifact-path","path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"}],"evidence_links":[]},"meta":{"command":"execute-rizin-command","duration":"5047ms"}}