{"ok":true,"data":{"evidence_id":"ev_3ba5a2166f3ddab17eb6a36167b8c6d1ff1ee2e57b34efc63186a75a894584d1","subject":{"name":"Tabbit.dll","digest":{"sha256":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c"},"local_path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","format":"unknown","architecture":null},"provider":{"id":"rizin","name":"Rizin","version":null},"analysis_profile":null,"predicate_type":"rea.reverse-engineering.command-observation","operation":"execute_rizin_command","parameters":{"path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","command":"e scr.color=0;af @ 0x1837a9340;pdgo @ 0x1837a9340;afij @ 0x1837a9340","provider_executable":"C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe","command_arguments":["-N","-q","-c","e scr.color=0;af @ 0x1837a9340;pdgo @ 0x1837a9340;afij @ 0x1837a9340","C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"]},"raw_result":{"stdout":"                   |\r\n    0x1837a9340    |void fcn.1837a9340(int64_t arg1, int64_t arg2)\r\n                   |{\r\n                   |    int64_t iVar1;\r\n                   |    int32_t *piVar2;\r\n                   |    int32_t *piVar3;\r\n                   |    code *pcVar4;\r\n                   |    undefined4 uVar5;\r\n                   |    undefined4 uVar6;\r\n                   |    undefined4 uVar7;\r\n                   |    int32_t iVar8;\r\n                   |    undefined4 *puVar9;\r\n                   |    undefined auStack_78 [40];\r\n                   |    int64_t var_50h;\r\n                   |    undefined4 uStack_48;\r\n                   |    undefined4 uStack_44;\r\n                   |    int64_t var_40h;\r\n                   |    int64_t var_38h;\r\n                   |    int64_t var_30h;\r\n                   |    \r\n    0x1837a9358    |    var_30h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_78;\r\n    0x1837a9360    |    iVar1 = *(int64_t *)(arg1 + 0xa8);\r\n    0x1837a9367    |    *(undefined8 *)(arg1 + 0xa8) = 0;\r\n    0x1837a9375    |    if (iVar1 != 0) {\r\n    0x1837a937c    |        func_0x000181516210(iVar1, 1);\r\n                   |    }\r\n    0x1837a9388    |    if (*(char *)(arg1 + 0x127) < '\\0') {\r\n    0x1837a9552    |        *(undefined8 *)(arg1 + 0x118) = 6;\r\n    0x1837a955d    |        puVar9 = *(undefined4 **)(arg1 + 0x110);\r\n                   |    } else {\r\n    0x1837a938e    |        puVar9 = (undefined4 *)(arg1 + 0x110);\r\n    0x1837a9395    |        *(undefined *)(arg1 + 0x127) = 6;\r\n                   |    }\r\n    0x1837a93a3    |    *(undefined2 *)(puVar9 + 1) = 0x6465;\r\n    0x1837a93ad    |    *puVar9 = 0x6c696166;\r\n    0x1837a93af    |    *(undefined *)((int64_t)puVar9 + 6) = 0;\r\n    0x1837a93c1    |    if (*(char *)(arg1 + 0x13f) < '\\0') {\r\n    0x1837a957a    |        func_0x0001841dcbe0(*(undefined8 *)(arg1 + 0x128), *(uint64_t *)(arg1 + 0x138) & 0x7fffffffffffffff);\r\n    0x1837a9589    |        *(undefined8 *)(arg1 + 0x128) = 0;\r\n    0x1837a9589    |        *(undefined8 *)(arg1 + 0x130) = 0;\r\n    0x1837a958c    |        *(undefined8 *)(arg1 + 0x138) = 0;\r\n                   |    }\r\n    0x1837a93cb    |    *(undefined8 *)(arg1 + 0x138) = *(undefined8 *)(arg2 + 0x10);\r\n    0x1837a93cf    |    uVar5 = *(undefined4 *)(arg2 + 4);\r\n    0x1837a93cf    |    uVar6 = *(undefined4 *)(arg2 + 8);\r\n    0x1837a93cf    |    uVar7 = *(undefined4 *)(arg2 + 0xc);\r\n    0x1837a93d2    |    *(undefined4 *)(arg1 + 0x128) = *(undefined4 *)arg2;\r\n    0x1837a93d2    |    *(undefined4 *)(arg1 + 300) = uVar5;\r\n    0x1837a93d2    |    *(undefined4 *)(arg1 + 0x130) = uVar6;\r\n    0x1837a93d2    |    *(undefined4 *)(arg1 + 0x134) = uVar7;\r\n    0x1837a93d7    |    *(undefined *)(arg2 + 0x17) = 0;\r\n    0x1837a93da    |    *(undefined *)arg2 = 0;\r\n    0x1837a93dc    |    piVar2 = *(int32_t **)(arg1 + 0xa0);\r\n    0x1837a93e6    |    if (piVar2 != (int32_t *)0x0) {\r\n    0x1837a93ed    |        LOCK();\r\n    0x1837a93ed    |        iVar8 = *piVar2;\r\n    0x1837a93ed    |        *piVar2 = *piVar2 + 1;\r\n    0x1837a93ed    |        UNLOCK();\r\n    0x1837a93f3    |        if (iVar8 < 1) goto code_r0x0001837a9661;\r\n    0x1837a93fe    |        if (iVar8 == 0x7fffffff) {\r\n    0x1837a9664    |            pcVar4 = (code *)swi(3);\r\n    0x1837a9664    |            (*pcVar4)();\r\n    0x1837a9664    |            return;\r\n                   |        }\r\n    0x1837a9412    |        (*(code *)0x185f59da0)(piVar2);\r\n    0x1837a9418    |        LOCK();\r\n    0x1837a9418    |        *piVar2 = *piVar2 + -1;\r\n    0x1837a9418    |        UNLOCK();\r\n    0x1837a941b    |        if (*piVar2 == 0) {\r\n    0x1837a95c1    |            iVar1 = *(int64_t *)(piVar2 + 4);\r\n    0x1837a9618    |            if (((iVar1 == 0x185b0fa30) || (iVar1 == 0x182bf3920)) || (iVar1 == 0x182bf3920)) {\r\n    0x1837a95e9    |                if ((*(uint64_t *)(piVar2 + 0xc) & 0xfffffffc00000000) == *(uint64_t *)0x191cd6d08) {\r\n    0x1837a95eb    |                    func_0x00018005f390();\r\n                   |                }\r\n    0x1837a95f8    |                func_0x0001841dcbe0(piVar2, 0x38);\r\n                   |            } else {\r\n    0x1837a961d    |                (*(code *)0x185f59da0)(piVar2);\r\n                   |            }\r\n                   |        }\r\n                   |    }\r\n    0x1837a9427    |    iVar8 = *(int32_t *)(arg1 + 400) + 1;\r\n    0x1837a9429    |    *(int32_t *)(arg1 + 400) = iVar8;\r\n    0x1837a9432    |    if (iVar8 < 4) {\r\n    0x1837a944e    |        func_0x000184339cd0(&var_50h, 0x1905419fc, 0x190c1ebd0, 0x14f);\r\n    0x1837a9472    |        if ((arg1 & 0xfffffffc00000000U) == *(uint64_t *)0x191cd6d08) {\r\n    0x1837a9477    |            func_0x0001841c7180(arg1);\r\n                   |        }\r\n    0x1837a948f    |        puVar9 = (undefined4 *)func_0x000185f006b8(0x30);\r\n    0x1837a9494    |        *puVar9 = 1;\r\n    0x1837a94a1    |        *(undefined8 *)(puVar9 + 2) = 0x1803915b0;\r\n    0x1837a94ac    |        *(undefined8 *)(puVar9 + 4) = 0x182bee630;\r\n    0x1837a94b7    |        *(undefined8 *)(puVar9 + 6) = 0x1841d75d0;\r\n    0x1837a94c2    |        *(undefined8 *)(puVar9 + 8) = 0x1837a8e60;\r\n    0x1837a94c6    |        *(int64_t *)(puVar9 + 10) = arg1;\r\n    0x1837a94ca    |        piVar2 = *(int32_t **)(arg1 + 0x108);\r\n    0x1837a94d1    |        *(undefined4 **)(arg1 + 0x108) = puVar9;\r\n    0x1837a94db    |        if (piVar2 != (int32_t *)0x0) {\r\n    0x1837a9599    |            LOCK();\r\n    0x1837a9599    |            *piVar2 = *piVar2 + -1;\r\n    0x1837a9599    |            UNLOCK();\r\n    0x1837a959d    |            if (*piVar2 == 0) {\r\n    0x1837a95b1    |                if (*(int64_t *)(piVar2 + 4) == 0x182bf38a0) {\r\n    0x1837a9628    |                    piVar3 = *(int32_t **)(piVar2 + 0xc);\r\n    0x1837a962f    |                    if (piVar3 != (int32_t *)0x0) {\r\n    0x1837a9643    |                        LOCK();\r\n    0x1837a9643    |                        *piVar3 = *piVar3 + -1;\r\n    0x1837a9643    |                        UNLOCK();\r\n    0x1837a9646    |                        if (*piVar3 == 0) {\r\n    0x1837a964d    |                            func_0x0001841dcbe0(piVar3, 8);\r\n                   |                        }\r\n                   |                    }\r\n    0x1837a9639    |                    func_0x0001841dcbe0(piVar2, 0x48);\r\n                   |                } else {\r\n    0x1837a95b6    |                    (*(code *)0x185f59da0)(piVar2);\r\n                   |                }\r\n                   |            }\r\n                   |        }\r\n    0x1837a94e5    |        *(undefined4 *)(arg1 + 0xd0) = (undefined4)var_40h;\r\n    0x1837a94f0    |        *(undefined4 *)(arg1 + 0xc0) = (undefined4)var_50h;\r\n    0x1837a94f0    |        *(undefined4 *)(arg1 + 0xc4) = var_50h._4_4_;\r\n    0x1837a94f0    |        *(undefined4 *)(arg1 + 200) = uStack_48;\r\n    0x1837a94f0    |        *(undefined4 *)(arg1 + 0xcc) = uStack_44;\r\n    0x1837a94fc    |        *(int64_t *)(arg1 + 0xd8) = var_38h;\r\n    0x1837a9503    |        *(int64_t *)(arg1 + 0xf0) = (int64_t)(iVar8 * 10) * 1000000;\r\n    0x1837a947c    |        func_0x00018477a0a0(arg1 + 0xb0);\r\n                   |    }\r\n    0x1837a9516    |    if (*(char *)(arg2 + 0x17) < '\\0') {\r\n    0x1837a9526    |        func_0x0001841dcbe0(*(undefined8 *)arg2, *(uint64_t *)(arg2 + 0x10) & 0x7fffffffffffffff);\r\n                   |    }\r\n    0x1837a9540    |    if (*(uint64_t *)0x191c71040 == (var_30h ^ (uint64_t)auStack_78)) {\r\n    0x1837a9551    |        return;\r\n                   |    }\r\n    0x1837a9659    |    func_0x000185f05b40(var_30h ^ (uint64_t)auStack_78);\r\n                   |code_r0x0001837a9661:\r\n    0x1837a9661    |    pcVar4 = (code *)swi(3);\r\n    0x1837a9661    |    (*pcVar4)();\r\n    0x1837a9661    |    return;\r\n                   |}\r\n[{\"offset\":6500815680,\"name\":\"fcn.1837a9340\",\"size\":805,\"is-pure\":false,\"realsz\":803,\"noreturn\":false,\"stackframe\":120,\"calltype\":\"ms\",\"cost\":237,\"cc\":23,\"loops\":11,\"bits\":64,\"type\":\"fcn\",\"nbbs\":37,\"edges\":54,\"ebbs\":3,\"signature\":\"fcn.1837a9340(int64_t arg1, int64_t arg2);\",\"minbound\":6500815680,\"maxbound\":6500816485,\"callrefs\":[{\"from\":6500815740,\"to\":6464561680,\"type\":\"CALL\"},{\"from\":6500815890,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6500815961,\"to\":6512942288,\"type\":\"CALL\"},{\"from\":6500815991,\"to\":6511423872,\"type\":\"CALL\"},{\"from\":6500816015,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6500816141,\"to\":6517399712,\"type\":\"CALL\"},{\"from\":6500816169,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6500816228,\"to\":6500815772,\"type\":\"CODE\"},{\"from\":6500816257,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6500816276,\"to\":6500815815,\"type\":\"CODE\"},{\"from\":6500816310,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6500816316,\"to\":6500816097,\"type\":\"CODE\"},{\"from\":6500816363,\"to\":6442840976,\"type\":\"CALL\"},{\"from\":6500816376,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6500816381,\"to\":6500815905,\"type\":\"CODE\"},{\"from\":6500816413,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6500816419,\"to\":6500815905,\"type\":\"CODE\"},{\"from\":6500816441,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6500816446,\"to\":6500816097,\"type\":\"CODE\"},{\"from\":6500816461,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6500816466,\"to\":6500816433,\"type\":\"CODE\"},{\"from\":6500816476,\"to\":6542089024,\"type\":\"CALL\"}],\"datarefs\":[{\"from\":6500815697,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6500815772,\"to\":6717291816,\"type\":\"DATA\"},{\"from\":6500815783,\"to\":6717291812,\"type\":\"DATA\"},{\"from\":6500815936,\"to\":6716398076,\"type\":\"DATA\"},{\"from\":6500815943,\"to\":6723595216,\"type\":\"DATA\"},{\"from\":6500815979,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6500816026,\"to\":6446192048,\"type\":\"DATA\"},{\"from\":6500816037,\"to\":6488516144,\"type\":\"DATA\"},{\"from\":6500816048,\"to\":6511490512,\"type\":\"DATA\"},{\"from\":6500816059,\"to\":6500814432,\"type\":\"DATA\"},{\"from\":6500816182,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6500816295,\"to\":6488537248,\"type\":\"DATA\"},{\"from\":6500816325,\"to\":6537935408,\"type\":\"DATA\"},{\"from\":6500816354,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6500816386,\"to\":6488537376,\"type\":\"DATA\"},{\"from\":6500816398,\"to\":6488537376,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6500816228,\"to\":6500815772,\"type\":\"CODE\"},{\"from\":6500816276,\"to\":6500815815,\"type\":\"CODE\"},{\"from\":6500816316,\"to\":6500816097,\"type\":\"CODE\"},{\"from\":6500816381,\"to\":6500815905,\"type\":\"CODE\"},{\"from\":6500816419,\"to\":6500815905,\"type\":\"CODE\"},{\"from\":6500816446,\"to\":6500816097,\"type\":\"CODE\"},{\"from\":6500816466,\"to\":6500816433,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":7,\"outdegree\":15,\"nlocals\":4,\"nargs\":2,\"stackvars\":[{\"name\":\"var_50h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-80}},{\"name\":\"var_40h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-64}},{\"name\":\"var_38h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-56}},{\"name\":\"var_30h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-48}}],\"regvars\":[{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"normalized_result":{"stdout":"                   |\r\n    0x1837a9340    |void fcn.1837a9340(int64_t arg1, int64_t arg2)\r\n                   |{\r\n                   |    int64_t iVar1;\r\n                   |    int32_t *piVar2;\r\n                   |    int32_t *piVar3;\r\n                   |    code *pcVar4;\r\n                   |    undefined4 uVar5;\r\n                   |    undefined4 uVar6;\r\n                   |    undefined4 uVar7;\r\n                   |    int32_t iVar8;\r\n                   |    undefined4 *puVar9;\r\n                   |    undefined auStack_78 [40];\r\n                   |    int64_t var_50h;\r\n                   |    undefined4 uStack_48;\r\n                   |    undefined4 uStack_44;\r\n                   |    int64_t var_40h;\r\n                   |    int64_t var_38h;\r\n                   |    int64_t var_30h;\r\n                   |    \r\n    0x1837a9358    |    var_30h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_78;\r\n    0x1837a9360    |    iVar1 = *(int64_t *)(arg1 + 0xa8);\r\n    0x1837a9367    |    *(undefined8 *)(arg1 + 0xa8) = 0;\r\n    0x1837a9375    |    if (iVar1 != 0) {\r\n    0x1837a937c    |        func_0x000181516210(iVar1, 1);\r\n                   |    }\r\n    0x1837a9388    |    if (*(char *)(arg1 + 0x127) < '\\0') {\r\n    0x1837a9552    |        *(undefined8 *)(arg1 + 0x118) = 6;\r\n    0x1837a955d    |        puVar9 = *(undefined4 **)(arg1 + 0x110);\r\n                   |    } else {\r\n    0x1837a938e    |        puVar9 = (undefined4 *)(arg1 + 0x110);\r\n    0x1837a9395    |        *(undefined *)(arg1 + 0x127) = 6;\r\n                   |    }\r\n    0x1837a93a3    |    *(undefined2 *)(puVar9 + 1) = 0x6465;\r\n    0x1837a93ad    |    *puVar9 = 0x6c696166;\r\n    0x1837a93af    |    *(undefined *)((int64_t)puVar9 + 6) = 0;\r\n    0x1837a93c1    |    if (*(char *)(arg1 + 0x13f) < '\\0') {\r\n    0x1837a957a    |        func_0x0001841dcbe0(*(undefined8 *)(arg1 + 0x128), *(uint64_t *)(arg1 + 0x138) & 0x7fffffffffffffff);\r\n    0x1837a9589    |        *(undefined8 *)(arg1 + 0x128) = 0;\r\n    0x1837a9589    |        *(undefined8 *)(arg1 + 0x130) = 0;\r\n    0x1837a958c    |        *(undefined8 *)(arg1 + 0x138) = 0;\r\n                   |    }\r\n    0x1837a93cb    |    *(undefined8 *)(arg1 + 0x138) = *(undefined8 *)(arg2 + 0x10);\r\n    0x1837a93cf    |    uVar5 = *(undefined4 *)(arg2 + 4);\r\n    0x1837a93cf    |    uVar6 = *(undefined4 *)(arg2 + 8);\r\n    0x1837a93cf    |    uVar7 = *(undefined4 *)(arg2 + 0xc);\r\n    0x1837a93d2    |    *(undefined4 *)(arg1 + 0x128) = *(undefined4 *)arg2;\r\n    0x1837a93d2    |    *(undefined4 *)(arg1 + 300) = uVar5;\r\n    0x1837a93d2    |    *(undefined4 *)(arg1 + 0x130) = uVar6;\r\n    0x1837a93d2    |    *(undefined4 *)(arg1 + 0x134) = uVar7;\r\n    0x1837a93d7    |    *(undefined *)(arg2 + 0x17) = 0;\r\n    0x1837a93da    |    *(undefined *)arg2 = 0;\r\n    0x1837a93dc    |    piVar2 = *(int32_t **)(arg1 + 0xa0);\r\n    0x1837a93e6    |    if (piVar2 != (int32_t *)0x0) {\r\n    0x1837a93ed    |        LOCK();\r\n    0x1837a93ed    |        iVar8 = *piVar2;\r\n    0x1837a93ed    |        *piVar2 = *piVar2 + 1;\r\n    0x1837a93ed    |        UNLOCK();\r\n    0x1837a93f3    |        if (iVar8 < 1) goto code_r0x0001837a9661;\r\n    0x1837a93fe    |        if (iVar8 == 0x7fffffff) {\r\n    0x1837a9664    |            pcVar4 = (code *)swi(3);\r\n    0x1837a9664    |            (*pcVar4)();\r\n    0x1837a9664    |            return;\r\n                   |        }\r\n    0x1837a9412    |        (*(code *)0x185f59da0)(piVar2);\r\n    0x1837a9418    |        LOCK();\r\n    0x1837a9418    |        *piVar2 = *piVar2 + -1;\r\n    0x1837a9418    |        UNLOCK();\r\n    0x1837a941b    |        if (*piVar2 == 0) {\r\n    0x1837a95c1    |            iVar1 = *(int64_t *)(piVar2 + 4);\r\n    0x1837a9618    |            if (((iVar1 == 0x185b0fa30) || (iVar1 == 0x182bf3920)) || (iVar1 == 0x182bf3920)) {\r\n    0x1837a95e9    |                if ((*(uint64_t *)(piVar2 + 0xc) & 0xfffffffc00000000) == *(uint64_t *)0x191cd6d08) {\r\n    0x1837a95eb    |                    func_0x00018005f390();\r\n                   |                }\r\n    0x1837a95f8    |                func_0x0001841dcbe0(piVar2, 0x38);\r\n                   |            } else {\r\n    0x1837a961d    |                (*(code *)0x185f59da0)(piVar2);\r\n                   |            }\r\n                   |        }\r\n                   |    }\r\n    0x1837a9427    |    iVar8 = *(int32_t *)(arg1 + 400) + 1;\r\n    0x1837a9429    |    *(int32_t *)(arg1 + 400) = iVar8;\r\n    0x1837a9432    |    if (iVar8 < 4) {\r\n    0x1837a944e    |        func_0x000184339cd0(&var_50h, 0x1905419fc, 0x190c1ebd0, 0x14f);\r\n    0x1837a9472    |        if ((arg1 & 0xfffffffc00000000U) == *(uint64_t *)0x191cd6d08) {\r\n    0x1837a9477    |            func_0x0001841c7180(arg1);\r\n                   |        }\r\n    0x1837a948f    |        puVar9 = (undefined4 *)func_0x000185f006b8(0x30);\r\n    0x1837a9494    |        *puVar9 = 1;\r\n    0x1837a94a1    |        *(undefined8 *)(puVar9 + 2) = 0x1803915b0;\r\n    0x1837a94ac    |        *(undefined8 *)(puVar9 + 4) = 0x182bee630;\r\n    0x1837a94b7    |        *(undefined8 *)(puVar9 + 6) = 0x1841d75d0;\r\n    0x1837a94c2    |        *(undefined8 *)(puVar9 + 8) = 0x1837a8e60;\r\n    0x1837a94c6    |        *(int64_t *)(puVar9 + 10) = arg1;\r\n    0x1837a94ca    |        piVar2 = *(int32_t **)(arg1 + 0x108);\r\n    0x1837a94d1    |        *(undefined4 **)(arg1 + 0x108) = puVar9;\r\n    0x1837a94db    |        if (piVar2 != (int32_t *)0x0) {\r\n    0x1837a9599    |            LOCK();\r\n    0x1837a9599    |            *piVar2 = *piVar2 + -1;\r\n    0x1837a9599    |            UNLOCK();\r\n    0x1837a959d    |            if (*piVar2 == 0) {\r\n    0x1837a95b1    |                if (*(int64_t *)(piVar2 + 4) == 0x182bf38a0) {\r\n    0x1837a9628    |                    piVar3 = *(int32_t **)(piVar2 + 0xc);\r\n    0x1837a962f    |                    if (piVar3 != (int32_t *)0x0) {\r\n    0x1837a9643    |                        LOCK();\r\n    0x1837a9643    |                        *piVar3 = *piVar3 + -1;\r\n    0x1837a9643    |                        UNLOCK();\r\n    0x1837a9646    |                        if (*piVar3 == 0) {\r\n    0x1837a964d    |                            func_0x0001841dcbe0(piVar3, 8);\r\n                   |                        }\r\n                   |                    }\r\n    0x1837a9639    |                    func_0x0001841dcbe0(piVar2, 0x48);\r\n                   |                } else {\r\n    0x1837a95b6    |                    (*(code *)0x185f59da0)(piVar2);\r\n                   |                }\r\n                   |            }\r\n                   |        }\r\n    0x1837a94e5    |        *(undefined4 *)(arg1 + 0xd0) = (undefined4)var_40h;\r\n    0x1837a94f0    |        *(undefined4 *)(arg1 + 0xc0) = (undefined4)var_50h;\r\n    0x1837a94f0    |        *(undefined4 *)(arg1 + 0xc4) = var_50h._4_4_;\r\n    0x1837a94f0    |        *(undefined4 *)(arg1 + 200) = uStack_48;\r\n    0x1837a94f0    |        *(undefined4 *)(arg1 + 0xcc) = uStack_44;\r\n    0x1837a94fc    |        *(int64_t *)(arg1 + 0xd8) = var_38h;\r\n    0x1837a9503    |        *(int64_t *)(arg1 + 0xf0) = (int64_t)(iVar8 * 10) * 1000000;\r\n    0x1837a947c    |        func_0x00018477a0a0(arg1 + 0xb0);\r\n                   |    }\r\n    0x1837a9516    |    if (*(char *)(arg2 + 0x17) < '\\0') {\r\n    0x1837a9526    |        func_0x0001841dcbe0(*(undefined8 *)arg2, *(uint64_t *)(arg2 + 0x10) & 0x7fffffffffffffff);\r\n                   |    }\r\n    0x1837a9540    |    if (*(uint64_t *)0x191c71040 == (var_30h ^ (uint64_t)auStack_78)) {\r\n    0x1837a9551    |        return;\r\n                   |    }\r\n    0x1837a9659    |    func_0x000185f05b40(var_30h ^ (uint64_t)auStack_78);\r\n                   |code_r0x0001837a9661:\r\n    0x1837a9661    |    pcVar4 = (code *)swi(3);\r\n    0x1837a9661    |    (*pcVar4)();\r\n    0x1837a9661    |    return;\r\n                   |}\r\n[{\"offset\":6500815680,\"name\":\"fcn.1837a9340\",\"size\":805,\"is-pure\":false,\"realsz\":803,\"noreturn\":false,\"stackframe\":120,\"calltype\":\"ms\",\"cost\":237,\"cc\":23,\"loops\":11,\"bits\":64,\"type\":\"fcn\",\"nbbs\":37,\"edges\":54,\"ebbs\":3,\"signature\":\"fcn.1837a9340(int64_t arg1, int64_t arg2);\",\"minbound\":6500815680,\"maxbound\":6500816485,\"callrefs\":[{\"from\":6500815740,\"to\":6464561680,\"type\":\"CALL\"},{\"from\":6500815890,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6500815961,\"to\":6512942288,\"type\":\"CALL\"},{\"from\":6500815991,\"to\":6511423872,\"type\":\"CALL\"},{\"from\":6500816015,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6500816141,\"to\":6517399712,\"type\":\"CALL\"},{\"from\":6500816169,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6500816228,\"to\":6500815772,\"type\":\"CODE\"},{\"from\":6500816257,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6500816276,\"to\":6500815815,\"type\":\"CODE\"},{\"from\":6500816310,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6500816316,\"to\":6500816097,\"type\":\"CODE\"},{\"from\":6500816363,\"to\":6442840976,\"type\":\"CALL\"},{\"from\":6500816376,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6500816381,\"to\":6500815905,\"type\":\"CODE\"},{\"from\":6500816413,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6500816419,\"to\":6500815905,\"type\":\"CODE\"},{\"from\":6500816441,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6500816446,\"to\":6500816097,\"type\":\"CODE\"},{\"from\":6500816461,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6500816466,\"to\":6500816433,\"type\":\"CODE\"},{\"from\":6500816476,\"to\":6542089024,\"type\":\"CALL\"}],\"datarefs\":[{\"from\":6500815697,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6500815772,\"to\":6717291816,\"type\":\"DATA\"},{\"from\":6500815783,\"to\":6717291812,\"type\":\"DATA\"},{\"from\":6500815936,\"to\":6716398076,\"type\":\"DATA\"},{\"from\":6500815943,\"to\":6723595216,\"type\":\"DATA\"},{\"from\":6500815979,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6500816026,\"to\":6446192048,\"type\":\"DATA\"},{\"from\":6500816037,\"to\":6488516144,\"type\":\"DATA\"},{\"from\":6500816048,\"to\":6511490512,\"type\":\"DATA\"},{\"from\":6500816059,\"to\":6500814432,\"type\":\"DATA\"},{\"from\":6500816182,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6500816295,\"to\":6488537248,\"type\":\"DATA\"},{\"from\":6500816325,\"to\":6537935408,\"type\":\"DATA\"},{\"from\":6500816354,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6500816386,\"to\":6488537376,\"type\":\"DATA\"},{\"from\":6500816398,\"to\":6488537376,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6500816228,\"to\":6500815772,\"type\":\"CODE\"},{\"from\":6500816276,\"to\":6500815815,\"type\":\"CODE\"},{\"from\":6500816316,\"to\":6500816097,\"type\":\"CODE\"},{\"from\":6500816381,\"to\":6500815905,\"type\":\"CODE\"},{\"from\":6500816419,\"to\":6500815905,\"type\":\"CODE\"},{\"from\":6500816446,\"to\":6500816097,\"type\":\"CODE\"},{\"from\":6500816466,\"to\":6500816433,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":7,\"outdegree\":15,\"nlocals\":4,\"nargs\":2,\"stackvars\":[{\"name\":\"var_50h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-80}},{\"name\":\"var_40h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-64}},{\"name\":\"var_38h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-56}},{\"name\":\"var_30h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-48}}],\"regvars\":[{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"confidence":"observed","authority":"shipped-artifact","environment":null,"limitations":["The executable version and supported formats are reported as unknown because no reliable version probe was performed.","A non-zero process exit is preserved as an observed command result.","Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.","When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call."],"relationship_coverage":null,"locations":[{"kind":"artifact-path","path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"}],"evidence_links":[]},"meta":{"command":"execute-rizin-command","duration":"5016ms"}}