{"ok":true,"data":{"evidence_id":"ev_5ffb0782ca91c4ad727c4a87a49faa89d9a27bd4e382ec72869933f60868bee8","subject":{"name":"Tabbit.dll","digest":{"sha256":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c"},"local_path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","format":"unknown","architecture":null},"provider":{"id":"rizin","name":"Rizin","version":null},"analysis_profile":null,"predicate_type":"rea.reverse-engineering.command-observation","operation":"execute_rizin_command","parameters":{"path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","command":"e scr.color=0;af @ 0x1837f9d30;pdgo @ 0x1837f9d30;afij @ 0x1837f9d30","provider_executable":"C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe","command_arguments":["-N","-q","-c","e scr.color=0;af @ 0x1837f9d30;pdgo @ 0x1837f9d30;afij @ 0x1837f9d30","C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"]},"raw_result":{"stdout":"    0x1837f9d30    |\r\n    0x1837f9d30    |// WARNING: [rz-ghidra] Detected overlap for variable var_61h\r\n    0x1837f9d30    |// WARNING: [rz-ghidra] Detected overlap for variable var_e0h\r\n    0x1837f9d30    |// WARNING: [rz-ghidra] Detected overlap for variable var_1b1h\r\n    0x1837f9d30    |// WARNING: [rz-ghidra] Detected overlap for variable var_251h\r\n    0x1837f9d30    |// WARNING: [rz-ghidra] Detected overlap for variable var_d8h\r\n    0x1837f9d30    |// WARNING: [rz-ghidra] Detected overlap for variable var_211h\r\n    0x1837f9d30    |// WARNING: [rz-ghidra] Detected overlap for variable var_e4h\r\n    0x1837f9d30    |// WARNING: [rz-ghidra] Detected overlap for variable var_264h\r\n    0x1837f9d30    |// WARNING: [rz-ghidra] Detected overlap for variable var_25ch\r\n    0x1837f9d30    |// WARNING: [rz-ghidra] Detected overlap for variable var_254h\r\n    0x1837f9d30    |// WARNING: [rz-ghidra] Detected overlap for variable var_250h\r\n    0x1837f9d30    |// WARNING: [rz-ghidra] Detected overlap for variable var_109h\r\n    0x1837f9d30    |// WARNING: [rz-ghidra] Detected overlap for variable var_238h\r\n    0x1837f9d30    |// WARNING: [rz-ghidra] Detected overlap for variable var_191h\r\n    0x1837f9d30    |// WARNING: [rz-ghidra] Detected overlap for variable var_1f1h\r\n    0x1837f9d30    |// WARNING: [rz-ghidra] Detected overlap for variable var_f1h\r\n    0x1837f9d30    |// WARNING: [rz-ghidra] Detected overlap for variable var_1d1h\r\n    0x1837f9d30    |// WARNING: [rz-ghidra] Detected overlap for variable var_121h\r\n    0x1837f9d30    |// WARNING: [rz-ghidra] Detected overlap for variable var_c1h\r\n    0x1837f9d30    |// WARNING: [rz-ghidra] Detected overlap for variable var_f8h\r\n    0x1837f9d30    |// WARNING: [rz-ghidra] Detected overlap for variable var_110h\r\n                   |\r\n    0x1837f9d30    |int64_t fcn.1837f9d30(int64_t arg1, int64_t arg2, int64_t arg3)\r\n                   |{\r\n                   |    uint64_t uVar1;\r\n                   |    int32_t iVar2;\r\n                   |    code *pcVar3;\r\n                   |    int32_t *piVar4;\r\n                   |    undefined8 uVar5;\r\n                   |    int64_t iVar6;\r\n                   |    int64_t unaff_RSI;\r\n                   |    int64_t var_168h;\r\n                   |    int64_t in_stack_fffffffffffffea0;\r\n                   |    int64_t var_158h;\r\n                   |    int64_t var_148h;\r\n                   |    int64_t var_140h;\r\n                   |    int64_t iStack_138;\r\n                   |    int64_t var_100h;\r\n                   |    int64_t var_f0h;\r\n                   |    int64_t var_d8h;\r\n                   |    \r\n    0x1837f9d4e    |    *(undefined8 *)arg1 = 0x18fd56f48;\r\n    0x1837f9d56    |    piVar4 = (int32_t *)fcn.185f006b8(8);\r\n    0x1837f9d5b    |    *piVar4 = 0;\r\n    0x1837f9d61    |    *(undefined *)(piVar4 + 1) = 0;\r\n    0x1837f9d65    |    *(int32_t **)(arg1 + 8) = piVar4;\r\n    0x1837f9d6c    |    if (piVar4 != (int32_t *)0x0) {\r\n    0x1837f9d73    |        LOCK();\r\n    0x1837f9d73    |        iVar2 = *piVar4;\r\n    0x1837f9d73    |        *piVar4 = *piVar4 + 1;\r\n    0x1837f9d73    |        UNLOCK();\r\n    0x1837f9d7d    |        if (iVar2 == 0x7fffffff) {\r\n    0x1837f9fc6    |            pcVar3 = (code *)swi(3);\r\n    0x1837f9fc6    |            iVar6 = (*pcVar3)();\r\n    0x1837f9fc6    |            return iVar6;\r\n                   |        }\r\n                   |    }\r\n    0x1837f9d83    |    *(int64_t *)(arg1 + 0x10) = arg1;\r\n    0x1837f9d8e    |    *(undefined8 *)(arg1 + 0x28) = 0;\r\n    0x1837f9d8e    |    *(undefined8 *)(arg1 + 0x30) = 0;\r\n    0x1837f9d92    |    *(int64_t *)(arg1 + 0x20) = arg1 + 0x28;\r\n    0x1837f9d9d    |    *(undefined8 *)arg1 = 0x18fd2a6a0;\r\n    0x1837f9da7    |    *(undefined8 *)(arg1 + 0x18) = 0x18fd2a6d0;\r\n    0x1837f9dc2    |    if ((arg3 & 0xfffffffc00000000U) == *(uint64_t *)0x191cd6d08) {\r\n    0x1837f9dc7    |        fcn.1841c7180(arg3);\r\n                   |    }\r\n    0x1837f9dcc    |    *(int64_t *)(arg1 + 0x38) = arg3;\r\n    0x1837f9ddd    |    if ((arg1 & 0xfffffffc00000000U) == *(uint64_t *)0x191cd6d08) {\r\n    0x1837f9de2    |        fcn.1841c7180(arg1);\r\n                   |    }\r\n    0x1837f9de7    |    *(int64_t *)(arg1 + 0x40) = arg1;\r\n    0x1837f9dee    |    *(undefined8 *)(arg1 + 0x48) = 0;\r\n    0x1837f9dee    |    *(undefined8 *)(arg1 + 0x50) = 0;\r\n    0x1837f9df2    |    *(undefined8 *)(arg1 + 0x58) = 0;\r\n    0x1837f9df2    |    *(undefined8 *)(arg1 + 0x60) = 0;\r\n    0x1837f9df6    |    *(undefined8 *)(arg1 + 0x68) = 0;\r\n    0x1837f9df6    |    *(undefined8 *)(arg1 + 0x70) = 0;\r\n    0x1837f9dfa    |    *(undefined8 *)(arg1 + 0x78) = 0;\r\n    0x1837f9e07    |    piVar4 = (int32_t *)fcn.185f006b8(8);\r\n    0x1837f9e0c    |    *piVar4 = 0;\r\n    0x1837f9e12    |    *(undefined *)(piVar4 + 1) = 0;\r\n    0x1837f9e16    |    *(int32_t **)(arg1 + 0x80) = piVar4;\r\n    0x1837f9e20    |    if (piVar4 != (int32_t *)0x0) {\r\n    0x1837f9e27    |        LOCK();\r\n    0x1837f9e27    |        iVar2 = *piVar4;\r\n    0x1837f9e27    |        *piVar4 = *piVar4 + 1;\r\n    0x1837f9e27    |        UNLOCK();\r\n    0x1837f9e31    |        if (iVar2 == 0x7fffffff) {\r\n    0x1837f9fc9    |            pcVar3 = (code *)swi(3);\r\n    0x1837f9fc9    |            iVar6 = (*pcVar3)();\r\n    0x1837f9fc9    |            return iVar6;\r\n                   |        }\r\n                   |    }\r\n    0x1837f9e37    |    *(int64_t *)(arg1 + 0x88) = arg1;\r\n    0x1837f9e3e    |    uVar5 = fcn.180dc4ff0();\r\n    0x1837f9e4c    |    iVar6 = fcn.184300b20(uVar5, arg2, 1);\r\n    0x1837f9e54    |    if (iVar6 != 0) {\r\n    0x1837f9e61    |        uVar1 = iVar6 + 8;\r\n    0x1837f9e72    |        if ((uVar1 & 0xfffffffc00000000) == *(uint64_t *)0x191cd6d08) {\r\n    0x1837f9e77    |            fcn.1841c7180(uVar1);\r\n                   |        }\r\n    0x1837f9e89    |        if ((*(uint64_t *)(arg1 + 0x48) & 0xfffffffc00000000) == *(uint64_t *)0x191cd6d08) {\r\n    0x1837f9fcc    |            fcn.18005f390(in_stack_fffffffffffffea0);\r\n                   |        }\r\n    0x1837f9e8f    |        *(uint64_t *)(arg1 + 0x48) = uVar1;\r\n    0x1837f9e97    |        fcn.184948ed0(iVar6 + 0x10, *(undefined8 *)(arg1 + 0x40));\r\n    0x1837f9ea3    |        var_168h = (int64_t)&var_158h;\r\n    0x1837f9ec7    |        var_158h = arg1;\r\n    0x1837f9ec7    |        fcn.1812baa60(uVar1, &var_168h, 0, 0);\r\n    0x1837f9eea    |        if ((*(int32_t *)0x191de85c0 < 1) && ((*(int32_t *)0x191cd6be0 != 0 || (*(int64_t *)0x191de85c8 != 0)))) {\r\n    0x1837f9ef7    |            fcn.18030d390(&var_158h, 0x190c22c20, 0x25, 0);\r\n    0x1837f9f0d    |            fcn.184dcd0d0(&var_148h, 0x190c22c60, 0x31);\r\n    0x1837f9f2e    |            var_158h = 0x18ff81648;\r\n    0x1837f9f35    |            fcn.18030e9d0(unaff_RSI);\r\n    0x1837f9f48    |            *(undefined8 *)((int64_t)&var_148h + (int64_t)*(int32_t *)(var_148h + 4)) = 0x18fe1b290;\r\n    0x1837f9f54    |            var_140h = 0x18fe20d40;\r\n    0x1837f9f5c    |            if (var_f0h._7_1_ < '\\0') {\r\n    0x1837f9f78    |                fcn.1841dcbe0(var_100h, CONCAT17(var_f0h._7_1_, (unkbyte7)var_f0h) & 0x7fffffffffffffff);\r\n                   |            }\r\n    0x1837f9f89    |            var_140h = 0x18fe20db0;\r\n    0x1837f9f9a    |            if (iStack_138 != 0x191de1450) {\r\n    0x1837f9fdb    |                LOCK();\r\n    0x1837f9fdb    |                piVar4 = (int32_t *)(iStack_138 + 8);\r\n    0x1837f9fdb    |                iVar2 = *piVar4;\r\n    0x1837f9fdb    |                *piVar4 = *piVar4 + -1;\r\n    0x1837f9fdb    |                UNLOCK();\r\n    0x1837f9fe2    |                if (iVar2 == 0) {\r\n    0x1837f9feb    |                    (*case.0x1841dcc6f.0)();\r\n                   |                }\r\n                   |            }\r\n    0x1837f9f7d    |            fcn.18424db70(&var_140h);\r\n    0x1837f9f9c    |            fcn.1848f8b80(&var_d8h);\r\n                   |        }\r\n                   |    }\r\n    0x1837f9fc5    |    return arg1;\r\n                   |}\r\n[{\"offset\":6501145904,\"name\":\"fcn.1837f9d30\",\"size\":707,\"is-pure\":false,\"realsz\":703,\"noreturn\":false,\"stackframe\":392,\"calltype\":\"ms\",\"cost\":217,\"cc\":18,\"loops\":3,\"bits\":64,\"type\":\"fcn\",\"nbbs\":25,\"edges\":37,\"ebbs\":3,\"signature\":\"fcn.1837f9d30(int64_t arg1, int64_t arg2, int64_t arg3);\",\"minbound\":6501145904,\"maxbound\":6501146611,\"callrefs\":[{\"from\":6501145942,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6501146055,\"to\":6511423872,\"type\":\"CALL\"},{\"from\":6501146082,\"to\":6511423872,\"type\":\"CALL\"},{\"from\":6501146119,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6501146174,\"to\":6456889328,\"type\":\"CALL\"},{\"from\":6501146188,\"to\":6512708384,\"type\":\"CALL\"},{\"from\":6501146231,\"to\":6511423872,\"type\":\"CALL\"},{\"from\":6501146270,\"to\":6519295696,\"type\":\"CALL\"},{\"from\":6501146311,\"to\":6462089824,\"type\":\"CALL\"},{\"from\":6501146376,\"to\":6445650832,\"type\":\"CALL\"},{\"from\":6501146402,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6501146421,\"to\":6445656528,\"type\":\"CALL\"},{\"from\":6501146488,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6501146535,\"to\":6511975280,\"type\":\"CALL\"},{\"from\":6501146543,\"to\":6518967168,\"type\":\"CALL\"},{\"from\":6501146572,\"to\":6442840976,\"type\":\"CALL\"},{\"from\":6501146577,\"to\":6501146255,\"type\":\"CODE\"},{\"from\":6501146603,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6501146609,\"to\":6501146524,\"type\":\"CODE\"}],\"datarefs\":[{\"from\":6501145927,\"to\":6708096840,\"type\":\"DATA\"},{\"from\":6501146006,\"to\":6707914400,\"type\":\"DATA\"},{\"from\":6501146016,\"to\":6707914448,\"type\":\"DATA\"},{\"from\":6501146043,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6501146070,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6501146219,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6501146242,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6501146283,\"to\":6501154272,\"type\":\"DATA\"},{\"from\":6501146316,\"to\":6742246848,\"type\":\"DATA\"},{\"from\":6501146329,\"to\":6741126112,\"type\":\"DATA\"},{\"from\":6501146338,\"to\":6742246856,\"type\":\"DATA\"},{\"from\":6501146352,\"to\":6723611680,\"type\":\"DATA\"},{\"from\":6501146386,\"to\":6723611744,\"type\":\"DATA\"},{\"from\":6501146407,\"to\":6710367816,\"type\":\"DATA\"},{\"from\":6501146433,\"to\":6708900496,\"type\":\"DATA\"},{\"from\":6501146445,\"to\":6708923712,\"type\":\"DATA\"},{\"from\":6501146498,\"to\":6708923824,\"type\":\"DATA\"},{\"from\":6501146512,\"to\":6742217808,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6501146577,\"to\":6501146255,\"type\":\"CODE\"},{\"from\":6501146609,\"to\":6501146524,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":2,\"outdegree\":17,\"nlocals\":7,\"nargs\":3,\"stackvars\":[{\"name\":\"var_168h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-360}},{\"name\":\"var_158h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-344}},{\"name\":\"var_148h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-328}},{\"name\":\"var_140h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-320}},{\"name\":\"var_100h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-256}},{\"name\":\"var_f0h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-240}},{\"name\":\"var_d8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-216}}],\"regvars\":[{\"name\":\"arg3\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"r8\"}},{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"normalized_result":{"stdout":"    0x1837f9d30    |\r\n    0x1837f9d30    |// WARNING: [rz-ghidra] Detected overlap for variable var_61h\r\n    0x1837f9d30    |// WARNING: [rz-ghidra] Detected overlap for variable var_e0h\r\n    0x1837f9d30    |// WARNING: [rz-ghidra] Detected overlap for variable var_1b1h\r\n    0x1837f9d30    |// WARNING: [rz-ghidra] Detected overlap for variable var_251h\r\n    0x1837f9d30    |// WARNING: [rz-ghidra] Detected overlap for variable var_d8h\r\n    0x1837f9d30    |// WARNING: [rz-ghidra] Detected overlap for variable var_211h\r\n    0x1837f9d30    |// WARNING: [rz-ghidra] Detected overlap for variable var_e4h\r\n    0x1837f9d30    |// WARNING: [rz-ghidra] Detected overlap for variable var_264h\r\n    0x1837f9d30    |// WARNING: [rz-ghidra] Detected overlap for variable var_25ch\r\n    0x1837f9d30    |// WARNING: [rz-ghidra] Detected overlap for variable var_254h\r\n    0x1837f9d30    |// WARNING: [rz-ghidra] Detected overlap for variable var_250h\r\n    0x1837f9d30    |// WARNING: [rz-ghidra] Detected overlap for variable var_109h\r\n    0x1837f9d30    |// WARNING: [rz-ghidra] Detected overlap for variable var_238h\r\n    0x1837f9d30    |// WARNING: [rz-ghidra] Detected overlap for variable var_191h\r\n    0x1837f9d30    |// WARNING: [rz-ghidra] Detected overlap for variable var_1f1h\r\n    0x1837f9d30    |// WARNING: [rz-ghidra] Detected overlap for variable var_f1h\r\n    0x1837f9d30    |// WARNING: [rz-ghidra] Detected overlap for variable var_1d1h\r\n    0x1837f9d30    |// WARNING: [rz-ghidra] Detected overlap for variable var_121h\r\n    0x1837f9d30    |// WARNING: [rz-ghidra] Detected overlap for variable var_c1h\r\n    0x1837f9d30    |// WARNING: [rz-ghidra] Detected overlap for variable var_f8h\r\n    0x1837f9d30    |// WARNING: [rz-ghidra] Detected overlap for variable var_110h\r\n                   |\r\n    0x1837f9d30    |int64_t fcn.1837f9d30(int64_t arg1, int64_t arg2, int64_t arg3)\r\n                   |{\r\n                   |    uint64_t uVar1;\r\n                   |    int32_t iVar2;\r\n                   |    code *pcVar3;\r\n                   |    int32_t *piVar4;\r\n                   |    undefined8 uVar5;\r\n                   |    int64_t iVar6;\r\n                   |    int64_t unaff_RSI;\r\n                   |    int64_t var_168h;\r\n                   |    int64_t in_stack_fffffffffffffea0;\r\n                   |    int64_t var_158h;\r\n                   |    int64_t var_148h;\r\n                   |    int64_t var_140h;\r\n                   |    int64_t iStack_138;\r\n                   |    int64_t var_100h;\r\n                   |    int64_t var_f0h;\r\n                   |    int64_t var_d8h;\r\n                   |    \r\n    0x1837f9d4e    |    *(undefined8 *)arg1 = 0x18fd56f48;\r\n    0x1837f9d56    |    piVar4 = (int32_t *)fcn.185f006b8(8);\r\n    0x1837f9d5b    |    *piVar4 = 0;\r\n    0x1837f9d61    |    *(undefined *)(piVar4 + 1) = 0;\r\n    0x1837f9d65    |    *(int32_t **)(arg1 + 8) = piVar4;\r\n    0x1837f9d6c    |    if (piVar4 != (int32_t *)0x0) {\r\n    0x1837f9d73    |        LOCK();\r\n    0x1837f9d73    |        iVar2 = *piVar4;\r\n    0x1837f9d73    |        *piVar4 = *piVar4 + 1;\r\n    0x1837f9d73    |        UNLOCK();\r\n    0x1837f9d7d    |        if (iVar2 == 0x7fffffff) {\r\n    0x1837f9fc6    |            pcVar3 = (code *)swi(3);\r\n    0x1837f9fc6    |            iVar6 = (*pcVar3)();\r\n    0x1837f9fc6    |            return iVar6;\r\n                   |        }\r\n                   |    }\r\n    0x1837f9d83    |    *(int64_t *)(arg1 + 0x10) = arg1;\r\n    0x1837f9d8e    |    *(undefined8 *)(arg1 + 0x28) = 0;\r\n    0x1837f9d8e    |    *(undefined8 *)(arg1 + 0x30) = 0;\r\n    0x1837f9d92    |    *(int64_t *)(arg1 + 0x20) = arg1 + 0x28;\r\n    0x1837f9d9d    |    *(undefined8 *)arg1 = 0x18fd2a6a0;\r\n    0x1837f9da7    |    *(undefined8 *)(arg1 + 0x18) = 0x18fd2a6d0;\r\n    0x1837f9dc2    |    if ((arg3 & 0xfffffffc00000000U) == *(uint64_t *)0x191cd6d08) {\r\n    0x1837f9dc7    |        fcn.1841c7180(arg3);\r\n                   |    }\r\n    0x1837f9dcc    |    *(int64_t *)(arg1 + 0x38) = arg3;\r\n    0x1837f9ddd    |    if ((arg1 & 0xfffffffc00000000U) == *(uint64_t *)0x191cd6d08) {\r\n    0x1837f9de2    |        fcn.1841c7180(arg1);\r\n                   |    }\r\n    0x1837f9de7    |    *(int64_t *)(arg1 + 0x40) = arg1;\r\n    0x1837f9dee    |    *(undefined8 *)(arg1 + 0x48) = 0;\r\n    0x1837f9dee    |    *(undefined8 *)(arg1 + 0x50) = 0;\r\n    0x1837f9df2    |    *(undefined8 *)(arg1 + 0x58) = 0;\r\n    0x1837f9df2    |    *(undefined8 *)(arg1 + 0x60) = 0;\r\n    0x1837f9df6    |    *(undefined8 *)(arg1 + 0x68) = 0;\r\n    0x1837f9df6    |    *(undefined8 *)(arg1 + 0x70) = 0;\r\n    0x1837f9dfa    |    *(undefined8 *)(arg1 + 0x78) = 0;\r\n    0x1837f9e07    |    piVar4 = (int32_t *)fcn.185f006b8(8);\r\n    0x1837f9e0c    |    *piVar4 = 0;\r\n    0x1837f9e12    |    *(undefined *)(piVar4 + 1) = 0;\r\n    0x1837f9e16    |    *(int32_t **)(arg1 + 0x80) = piVar4;\r\n    0x1837f9e20    |    if (piVar4 != (int32_t *)0x0) {\r\n    0x1837f9e27    |        LOCK();\r\n    0x1837f9e27    |        iVar2 = *piVar4;\r\n    0x1837f9e27    |        *piVar4 = *piVar4 + 1;\r\n    0x1837f9e27    |        UNLOCK();\r\n    0x1837f9e31    |        if (iVar2 == 0x7fffffff) {\r\n    0x1837f9fc9    |            pcVar3 = (code *)swi(3);\r\n    0x1837f9fc9    |            iVar6 = (*pcVar3)();\r\n    0x1837f9fc9    |            return iVar6;\r\n                   |        }\r\n                   |    }\r\n    0x1837f9e37    |    *(int64_t *)(arg1 + 0x88) = arg1;\r\n    0x1837f9e3e    |    uVar5 = fcn.180dc4ff0();\r\n    0x1837f9e4c    |    iVar6 = fcn.184300b20(uVar5, arg2, 1);\r\n    0x1837f9e54    |    if (iVar6 != 0) {\r\n    0x1837f9e61    |        uVar1 = iVar6 + 8;\r\n    0x1837f9e72    |        if ((uVar1 & 0xfffffffc00000000) == *(uint64_t *)0x191cd6d08) {\r\n    0x1837f9e77    |            fcn.1841c7180(uVar1);\r\n                   |        }\r\n    0x1837f9e89    |        if ((*(uint64_t *)(arg1 + 0x48) & 0xfffffffc00000000) == *(uint64_t *)0x191cd6d08) {\r\n    0x1837f9fcc    |            fcn.18005f390(in_stack_fffffffffffffea0);\r\n                   |        }\r\n    0x1837f9e8f    |        *(uint64_t *)(arg1 + 0x48) = uVar1;\r\n    0x1837f9e97    |        fcn.184948ed0(iVar6 + 0x10, *(undefined8 *)(arg1 + 0x40));\r\n    0x1837f9ea3    |        var_168h = (int64_t)&var_158h;\r\n    0x1837f9ec7    |        var_158h = arg1;\r\n    0x1837f9ec7    |        fcn.1812baa60(uVar1, &var_168h, 0, 0);\r\n    0x1837f9eea    |        if ((*(int32_t *)0x191de85c0 < 1) && ((*(int32_t *)0x191cd6be0 != 0 || (*(int64_t *)0x191de85c8 != 0)))) {\r\n    0x1837f9ef7    |            fcn.18030d390(&var_158h, 0x190c22c20, 0x25, 0);\r\n    0x1837f9f0d    |            fcn.184dcd0d0(&var_148h, 0x190c22c60, 0x31);\r\n    0x1837f9f2e    |            var_158h = 0x18ff81648;\r\n    0x1837f9f35    |            fcn.18030e9d0(unaff_RSI);\r\n    0x1837f9f48    |            *(undefined8 *)((int64_t)&var_148h + (int64_t)*(int32_t *)(var_148h + 4)) = 0x18fe1b290;\r\n    0x1837f9f54    |            var_140h = 0x18fe20d40;\r\n    0x1837f9f5c    |            if (var_f0h._7_1_ < '\\0') {\r\n    0x1837f9f78    |                fcn.1841dcbe0(var_100h, CONCAT17(var_f0h._7_1_, (unkbyte7)var_f0h) & 0x7fffffffffffffff);\r\n                   |            }\r\n    0x1837f9f89    |            var_140h = 0x18fe20db0;\r\n    0x1837f9f9a    |            if (iStack_138 != 0x191de1450) {\r\n    0x1837f9fdb    |                LOCK();\r\n    0x1837f9fdb    |                piVar4 = (int32_t *)(iStack_138 + 8);\r\n    0x1837f9fdb    |                iVar2 = *piVar4;\r\n    0x1837f9fdb    |                *piVar4 = *piVar4 + -1;\r\n    0x1837f9fdb    |                UNLOCK();\r\n    0x1837f9fe2    |                if (iVar2 == 0) {\r\n    0x1837f9feb    |                    (*case.0x1841dcc6f.0)();\r\n                   |                }\r\n                   |            }\r\n    0x1837f9f7d    |            fcn.18424db70(&var_140h);\r\n    0x1837f9f9c    |            fcn.1848f8b80(&var_d8h);\r\n                   |        }\r\n                   |    }\r\n    0x1837f9fc5    |    return arg1;\r\n                   |}\r\n[{\"offset\":6501145904,\"name\":\"fcn.1837f9d30\",\"size\":707,\"is-pure\":false,\"realsz\":703,\"noreturn\":false,\"stackframe\":392,\"calltype\":\"ms\",\"cost\":217,\"cc\":18,\"loops\":3,\"bits\":64,\"type\":\"fcn\",\"nbbs\":25,\"edges\":37,\"ebbs\":3,\"signature\":\"fcn.1837f9d30(int64_t arg1, int64_t arg2, int64_t arg3);\",\"minbound\":6501145904,\"maxbound\":6501146611,\"callrefs\":[{\"from\":6501145942,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6501146055,\"to\":6511423872,\"type\":\"CALL\"},{\"from\":6501146082,\"to\":6511423872,\"type\":\"CALL\"},{\"from\":6501146119,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6501146174,\"to\":6456889328,\"type\":\"CALL\"},{\"from\":6501146188,\"to\":6512708384,\"type\":\"CALL\"},{\"from\":6501146231,\"to\":6511423872,\"type\":\"CALL\"},{\"from\":6501146270,\"to\":6519295696,\"type\":\"CALL\"},{\"from\":6501146311,\"to\":6462089824,\"type\":\"CALL\"},{\"from\":6501146376,\"to\":6445650832,\"type\":\"CALL\"},{\"from\":6501146402,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6501146421,\"to\":6445656528,\"type\":\"CALL\"},{\"from\":6501146488,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6501146535,\"to\":6511975280,\"type\":\"CALL\"},{\"from\":6501146543,\"to\":6518967168,\"type\":\"CALL\"},{\"from\":6501146572,\"to\":6442840976,\"type\":\"CALL\"},{\"from\":6501146577,\"to\":6501146255,\"type\":\"CODE\"},{\"from\":6501146603,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6501146609,\"to\":6501146524,\"type\":\"CODE\"}],\"datarefs\":[{\"from\":6501145927,\"to\":6708096840,\"type\":\"DATA\"},{\"from\":6501146006,\"to\":6707914400,\"type\":\"DATA\"},{\"from\":6501146016,\"to\":6707914448,\"type\":\"DATA\"},{\"from\":6501146043,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6501146070,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6501146219,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6501146242,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6501146283,\"to\":6501154272,\"type\":\"DATA\"},{\"from\":6501146316,\"to\":6742246848,\"type\":\"DATA\"},{\"from\":6501146329,\"to\":6741126112,\"type\":\"DATA\"},{\"from\":6501146338,\"to\":6742246856,\"type\":\"DATA\"},{\"from\":6501146352,\"to\":6723611680,\"type\":\"DATA\"},{\"from\":6501146386,\"to\":6723611744,\"type\":\"DATA\"},{\"from\":6501146407,\"to\":6710367816,\"type\":\"DATA\"},{\"from\":6501146433,\"to\":6708900496,\"type\":\"DATA\"},{\"from\":6501146445,\"to\":6708923712,\"type\":\"DATA\"},{\"from\":6501146498,\"to\":6708923824,\"type\":\"DATA\"},{\"from\":6501146512,\"to\":6742217808,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6501146577,\"to\":6501146255,\"type\":\"CODE\"},{\"from\":6501146609,\"to\":6501146524,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":2,\"outdegree\":17,\"nlocals\":7,\"nargs\":3,\"stackvars\":[{\"name\":\"var_168h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-360}},{\"name\":\"var_158h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-344}},{\"name\":\"var_148h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-328}},{\"name\":\"var_140h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-320}},{\"name\":\"var_100h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-256}},{\"name\":\"var_f0h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-240}},{\"name\":\"var_d8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-216}}],\"regvars\":[{\"name\":\"arg3\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"r8\"}},{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"confidence":"observed","authority":"shipped-artifact","environment":null,"limitations":["The executable version and supported formats are reported as unknown because no reliable version probe was performed.","A non-zero process exit is preserved as an observed command result.","Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.","When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call."],"relationship_coverage":null,"locations":[{"kind":"artifact-path","path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"}],"evidence_links":[]},"meta":{"command":"execute-rizin-command","duration":"5054ms"}}