{"ok":true,"data":{"evidence_id":"ev_16709c4cbeaf80911fe46e59080187ff717ae99af00301f924e39073f7e2f030","subject":{"name":"Tabbit.dll","digest":{"sha256":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c"},"local_path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","format":"unknown","architecture":null},"provider":{"id":"rizin","name":"Rizin","version":null},"analysis_profile":null,"predicate_type":"rea.reverse-engineering.command-observation","operation":"execute_rizin_command","parameters":{"path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","command":"e scr.color=0;af @ 0x1837fb540;pdgo @ 0x1837fb540;afij @ 0x1837fb540","provider_executable":"C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe","command_arguments":["-N","-q","-c","e scr.color=0;af @ 0x1837fb540;pdgo @ 0x1837fb540;afij @ 0x1837fb540","C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"]},"raw_result":{"stdout":"                   |\r\n    0x1837fb540    |void fcn.1837fb540(int64_t arg1, undefined8 placeholder_1, undefined8 placeholder_2, int64_t arg4, int64_t arg_28h)\r\n                   |{\r\n                   |    int32_t iVar1;\r\n                   |    undefined auVar2 [16];\r\n                   |    int64_t *piVar3;\r\n                   |    int32_t *piVar4;\r\n                   |    code *pcVar5;\r\n                   |    int64_t iVar6;\r\n                   |    undefined8 uVar7;\r\n                   |    int64_t iVar8;\r\n                   |    undefined4 *puVar9;\r\n                   |    int64_t unaff_GS_OFFSET;\r\n                   |    undefined auVar10 [16];\r\n                   |    undefined auStack_88 [32];\r\n                   |    int64_t var_68h;\r\n                   |    int64_t var_48h;\r\n                   |    undefined8 uStack_40;\r\n                   |    int64_t var_30h;\r\n                   |    int64_t var_28h;\r\n                   |    \r\n    0x1837fb55e    |    var_28h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_88;\r\n    0x1837fb569    |    if (arg_28h == 0) {\r\n    0x1837fb6f1    |        uVar7 = 0;\r\n                   |    } else {\r\n    0x1837fb576    |        uVar7 = (*(code *)0x185f59da0)();\r\n                   |    }\r\n    0x1837fb586    |    iVar8 = func_0x0001837e5a30(*(undefined8 *)(arg1 + 0x20), uVar7);\r\n    0x1837fb59b    |    if ((iVar8 != 0) && (*(char *)(iVar8 + 0x80) == '\\x01')) {\r\n    0x1837fb5a5    |        if (*(char *)(arg4 + 0x10) != '\\0') {\r\n    0x1837fb5a7    |            auVar2 = *(undefined (*) [16])arg4;\r\n    0x1837fb5b0    |            auVar10[0] = -(*(char *)(iVar8 + 0x70) == auVar2[0]);\r\n    0x1837fb5b0    |            auVar10[1] = -(*(char *)(iVar8 + 0x71) == auVar2[1]);\r\n    0x1837fb5b0    |            auVar10[2] = -(*(char *)(iVar8 + 0x72) == auVar2[2]);\r\n    0x1837fb5b0    |            auVar10[3] = -(*(char *)(iVar8 + 0x73) == auVar2[3]);\r\n    0x1837fb5b0    |            auVar10[4] = -(*(char *)(iVar8 + 0x74) == auVar2[4]);\r\n    0x1837fb5b0    |            auVar10[5] = -(*(char *)(iVar8 + 0x75) == auVar2[5]);\r\n    0x1837fb5b0    |            auVar10[6] = -(*(char *)(iVar8 + 0x76) == auVar2[6]);\r\n    0x1837fb5b0    |            auVar10[7] = -(*(char *)(iVar8 + 0x77) == auVar2[7]);\r\n    0x1837fb5b0    |            auVar10[8] = -(*(char *)(iVar8 + 0x78) == auVar2[8]);\r\n    0x1837fb5b0    |            auVar10[9] = -(*(char *)(iVar8 + 0x79) == auVar2[9]);\r\n    0x1837fb5b0    |            auVar10[10] = -(*(char *)(iVar8 + 0x7a) == auVar2[10]);\r\n    0x1837fb5b0    |            auVar10[0xb] = -(*(char *)(iVar8 + 0x7b) == auVar2[0xb]);\r\n    0x1837fb5b0    |            auVar10[0xc] = -(*(char *)(iVar8 + 0x7c) == auVar2[0xc]);\r\n    0x1837fb5b0    |            auVar10[0xd] = -(*(char *)(iVar8 + 0x7d) == auVar2[0xd]);\r\n    0x1837fb5b0    |            auVar10[0xe] = -(*(char *)(iVar8 + 0x7e) == auVar2[0xe]);\r\n    0x1837fb5b0    |            auVar10[0xf] = -(*(char *)(iVar8 + 0x7f) == auVar2[0xf]);\r\n    0x1837fb5bd    |            if ((uint16_t)\r\n    0x1837fb5b4    |                ((uint16_t)(SUB161(auVar10 >> 7, 0) & 1) | (uint16_t)(SUB161(auVar10 >> 0xf, 0) & 1) << 1 |\r\n    0x1837fb5b4    |                 (uint16_t)(SUB161(auVar10 >> 0x17, 0) & 1) << 2 | (uint16_t)(SUB161(auVar10 >> 0x1f, 0) & 1) << 3 |\r\n    0x1837fb5b4    |                 (uint16_t)(SUB161(auVar10 >> 0x27, 0) & 1) << 4 | (uint16_t)(SUB161(auVar10 >> 0x2f, 0) & 1) << 5 |\r\n    0x1837fb5b4    |                 (uint16_t)(SUB161(auVar10 >> 0x37, 0) & 1) << 6 | (uint16_t)(SUB161(auVar10 >> 0x3f, 0) & 1) << 7 |\r\n    0x1837fb5b4    |                 (uint16_t)(SUB161(auVar10 >> 0x47, 0) & 1) << 8 | (uint16_t)(SUB161(auVar10 >> 0x4f, 0) & 1) << 9 |\r\n    0x1837fb5b4    |                 (uint16_t)(SUB161(auVar10 >> 0x57, 0) & 1) << 10 | (uint16_t)(SUB161(auVar10 >> 0x5f, 0) & 1) << 0xb |\r\n    0x1837fb5b4    |                 (uint16_t)(SUB161(auVar10 >> 0x67, 0) & 1) << 0xc | (uint16_t)(SUB161(auVar10 >> 0x6f, 0) & 1) << 0xd |\r\n    0x1837fb5b4    |                 (uint16_t)(SUB161(auVar10 >> 0x77, 0) & 1) << 0xe | (uint16_t)(auVar10[0xf] >> 7) << 0xf) == 0xffff)\r\n    0x1837fb5bd    |            goto code_r0x0001837fb6d3;\r\n                   |        }\r\n    0x1837fb5d6    |        piVar3 = *(int64_t **)\r\n    0x1837fb5d2    |                  (*(int64_t *)(*(int64_t *)(unaff_GS_OFFSET + 0x58) + (uint64_t)*(uint32_t *)0x191d832e0 * 8) + 0x3d8);\r\n    0x1837fb5ec    |        if ((piVar3 == (int64_t *)0x0) || (iVar8 = *piVar3, iVar8 == 0)) goto code_r0x0001837fb716;\r\n    0x1837fb601    |        (*(code *)0x185f59da0)(uVar7, &var_48h);\r\n    0x1837fb607    |        piVar4 = *(int32_t **)(arg1 + 0x68);\r\n    0x1837fb60b    |        uVar7 = *(undefined8 *)(arg1 + 0x70);\r\n    0x1837fb612    |        if (piVar4 != (int32_t *)0x0) {\r\n    0x1837fb619    |            LOCK();\r\n    0x1837fb619    |            iVar1 = *piVar4;\r\n    0x1837fb619    |            *piVar4 = *piVar4 + 1;\r\n    0x1837fb619    |            UNLOCK();\r\n    0x1837fb623    |            if (iVar1 == 0x7fffffff) {\r\n    0x1837fb719    |                pcVar5 = (code *)swi(3);\r\n    0x1837fb719    |                (*pcVar5)();\r\n    0x1837fb719    |                return;\r\n                   |            }\r\n                   |        }\r\n    0x1837fb62e    |        puVar9 = (undefined4 *)func_0x000185f006b8(0x50);\r\n    0x1837fb62e    |        iVar6 = var_48h;\r\n    0x1837fb636    |        *puVar9 = 1;\r\n    0x1837fb643    |        *(undefined8 *)(puVar9 + 2) = 0x1837fbd40;\r\n    0x1837fb64e    |        *(undefined8 *)(puVar9 + 4) = 0x182c9ce90;\r\n    0x1837fb659    |        *(undefined8 *)(puVar9 + 6) = 0x1832818a0;\r\n    0x1837fb664    |        *(undefined8 *)(puVar9 + 8) = 0x1837fb720;\r\n    0x1837fb668    |        puVar9[10] = 0;\r\n    0x1837fb66f    |        *(int32_t **)(puVar9 + 0xc) = piVar4;\r\n    0x1837fb673    |        *(undefined8 *)(puVar9 + 0xe) = uVar7;\r\n    0x1837fb67d    |        var_48h = 0;\r\n    0x1837fb686    |        *(int64_t *)(puVar9 + 0x10) = iVar6;\r\n    0x1837fb686    |        *(undefined8 *)(puVar9 + 0x12) = uStack_40;\r\n    0x1837fb699    |        func_0x000184339cd0(&var_68h, 0x190c22cd8, 0x190c22c20, 0xa1);\r\n    0x1837fb6c3    |        var_30h = (int64_t)puVar9;\r\n    0x1837fb6c3    |        (*(code *)0x185f59da0)(iVar8, &var_68h, &var_30h, 0);\r\n    0x1837fb6d1    |        if (var_48h != 0) {\r\n    0x1837fb6f8    |            LOCK();\r\n    0x1837fb6f8    |            *(int32_t *)var_48h = *(int32_t *)var_48h + -1;\r\n    0x1837fb6f8    |            UNLOCK();\r\n    0x1837fb6fb    |            if (*(int32_t *)var_48h == 0) {\r\n    0x1837fb702    |                func_0x0001841dcbe0(var_48h, 8);\r\n                   |            }\r\n                   |        }\r\n                   |    }\r\n                   |code_r0x0001837fb6d3:\r\n    0x1837fb6e5    |    if (*(uint64_t *)0x191c71040 == (var_28h ^ (uint64_t)auStack_88)) {\r\n    0x1837fb6f0    |        return;\r\n                   |    }\r\n    0x1837fb70e    |    func_0x000185f05b40(var_28h ^ (uint64_t)auStack_88);\r\n                   |code_r0x0001837fb716:\r\n    0x1837fb716    |    pcVar5 = (code *)swi(3);\r\n    0x1837fb716    |    (*pcVar5)();\r\n    0x1837fb716    |    return;\r\n                   |}\r\n[{\"offset\":6501152064,\"name\":\"fcn.1837fb540\",\"size\":474,\"is-pure\":false,\"realsz\":472,\"noreturn\":false,\"stackframe\":136,\"calltype\":\"ms\",\"cost\":147,\"cc\":15,\"loops\":3,\"bits\":64,\"type\":\"fcn\",\"nbbs\":19,\"edges\":28,\"ebbs\":3,\"signature\":\"fcn.1837fb540(int64_t arg1, int64_t arg4, int64_t arg_28h);\",\"minbound\":6501152064,\"maxbound\":6501152538,\"callrefs\":[{\"from\":6501152118,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6501152134,\"to\":6501063216,\"type\":\"CALL\"},{\"from\":6501152257,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6501152302,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6501152423,\"to\":6512942288,\"type\":\"CALL\"},{\"from\":6501152451,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6501152499,\"to\":6501152127,\"type\":\"CODE\"},{\"from\":6501152514,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6501152519,\"to\":6501152467,\"type\":\"CODE\"},{\"from\":6501152529,\"to\":6542089024,\"type\":\"CALL\"}],\"datarefs\":[{\"from\":6501152087,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6501152195,\"to\":6741832416,\"type\":\"DATA\"},{\"from\":6501152316,\"to\":6501154112,\"type\":\"DATA\"},{\"from\":6501152327,\"to\":6489230992,\"type\":\"DATA\"},{\"from\":6501152338,\"to\":6495410336,\"type\":\"DATA\"},{\"from\":6501152349,\"to\":6501152544,\"type\":\"DATA\"},{\"from\":6501152395,\"to\":6723611864,\"type\":\"DATA\"},{\"from\":6501152402,\"to\":6723611680,\"type\":\"DATA\"},{\"from\":6501152475,\"to\":6740709440,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6501152499,\"to\":6501152127,\"type\":\"CODE\"},{\"from\":6501152519,\"to\":6501152467,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":2,\"outdegree\":8,\"nlocals\":4,\"nargs\":3,\"stackvars\":[{\"name\":\"var_68h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-104}},{\"name\":\"var_48h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-72}},{\"name\":\"var_30h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-48}},{\"name\":\"var_28h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-40}},{\"name\":\"arg_28h\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":40}}],\"regvars\":[{\"name\":\"arg4\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"r9\"}},{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"normalized_result":{"stdout":"                   |\r\n    0x1837fb540    |void fcn.1837fb540(int64_t arg1, undefined8 placeholder_1, undefined8 placeholder_2, int64_t arg4, int64_t arg_28h)\r\n                   |{\r\n                   |    int32_t iVar1;\r\n                   |    undefined auVar2 [16];\r\n                   |    int64_t *piVar3;\r\n                   |    int32_t *piVar4;\r\n                   |    code *pcVar5;\r\n                   |    int64_t iVar6;\r\n                   |    undefined8 uVar7;\r\n                   |    int64_t iVar8;\r\n                   |    undefined4 *puVar9;\r\n                   |    int64_t unaff_GS_OFFSET;\r\n                   |    undefined auVar10 [16];\r\n                   |    undefined auStack_88 [32];\r\n                   |    int64_t var_68h;\r\n                   |    int64_t var_48h;\r\n                   |    undefined8 uStack_40;\r\n                   |    int64_t var_30h;\r\n                   |    int64_t var_28h;\r\n                   |    \r\n    0x1837fb55e    |    var_28h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_88;\r\n    0x1837fb569    |    if (arg_28h == 0) {\r\n    0x1837fb6f1    |        uVar7 = 0;\r\n                   |    } else {\r\n    0x1837fb576    |        uVar7 = (*(code *)0x185f59da0)();\r\n                   |    }\r\n    0x1837fb586    |    iVar8 = func_0x0001837e5a30(*(undefined8 *)(arg1 + 0x20), uVar7);\r\n    0x1837fb59b    |    if ((iVar8 != 0) && (*(char *)(iVar8 + 0x80) == '\\x01')) {\r\n    0x1837fb5a5    |        if (*(char *)(arg4 + 0x10) != '\\0') {\r\n    0x1837fb5a7    |            auVar2 = *(undefined (*) [16])arg4;\r\n    0x1837fb5b0    |            auVar10[0] = -(*(char *)(iVar8 + 0x70) == auVar2[0]);\r\n    0x1837fb5b0    |            auVar10[1] = -(*(char *)(iVar8 + 0x71) == auVar2[1]);\r\n    0x1837fb5b0    |            auVar10[2] = -(*(char *)(iVar8 + 0x72) == auVar2[2]);\r\n    0x1837fb5b0    |            auVar10[3] = -(*(char *)(iVar8 + 0x73) == auVar2[3]);\r\n    0x1837fb5b0    |            auVar10[4] = -(*(char *)(iVar8 + 0x74) == auVar2[4]);\r\n    0x1837fb5b0    |            auVar10[5] = -(*(char *)(iVar8 + 0x75) == auVar2[5]);\r\n    0x1837fb5b0    |            auVar10[6] = -(*(char *)(iVar8 + 0x76) == auVar2[6]);\r\n    0x1837fb5b0    |            auVar10[7] = -(*(char *)(iVar8 + 0x77) == auVar2[7]);\r\n    0x1837fb5b0    |            auVar10[8] = -(*(char *)(iVar8 + 0x78) == auVar2[8]);\r\n    0x1837fb5b0    |            auVar10[9] = -(*(char *)(iVar8 + 0x79) == auVar2[9]);\r\n    0x1837fb5b0    |            auVar10[10] = -(*(char *)(iVar8 + 0x7a) == auVar2[10]);\r\n    0x1837fb5b0    |            auVar10[0xb] = -(*(char *)(iVar8 + 0x7b) == auVar2[0xb]);\r\n    0x1837fb5b0    |            auVar10[0xc] = -(*(char *)(iVar8 + 0x7c) == auVar2[0xc]);\r\n    0x1837fb5b0    |            auVar10[0xd] = -(*(char *)(iVar8 + 0x7d) == auVar2[0xd]);\r\n    0x1837fb5b0    |            auVar10[0xe] = -(*(char *)(iVar8 + 0x7e) == auVar2[0xe]);\r\n    0x1837fb5b0    |            auVar10[0xf] = -(*(char *)(iVar8 + 0x7f) == auVar2[0xf]);\r\n    0x1837fb5bd    |            if ((uint16_t)\r\n    0x1837fb5b4    |                ((uint16_t)(SUB161(auVar10 >> 7, 0) & 1) | (uint16_t)(SUB161(auVar10 >> 0xf, 0) & 1) << 1 |\r\n    0x1837fb5b4    |                 (uint16_t)(SUB161(auVar10 >> 0x17, 0) & 1) << 2 | (uint16_t)(SUB161(auVar10 >> 0x1f, 0) & 1) << 3 |\r\n    0x1837fb5b4    |                 (uint16_t)(SUB161(auVar10 >> 0x27, 0) & 1) << 4 | (uint16_t)(SUB161(auVar10 >> 0x2f, 0) & 1) << 5 |\r\n    0x1837fb5b4    |                 (uint16_t)(SUB161(auVar10 >> 0x37, 0) & 1) << 6 | (uint16_t)(SUB161(auVar10 >> 0x3f, 0) & 1) << 7 |\r\n    0x1837fb5b4    |                 (uint16_t)(SUB161(auVar10 >> 0x47, 0) & 1) << 8 | (uint16_t)(SUB161(auVar10 >> 0x4f, 0) & 1) << 9 |\r\n    0x1837fb5b4    |                 (uint16_t)(SUB161(auVar10 >> 0x57, 0) & 1) << 10 | (uint16_t)(SUB161(auVar10 >> 0x5f, 0) & 1) << 0xb |\r\n    0x1837fb5b4    |                 (uint16_t)(SUB161(auVar10 >> 0x67, 0) & 1) << 0xc | (uint16_t)(SUB161(auVar10 >> 0x6f, 0) & 1) << 0xd |\r\n    0x1837fb5b4    |                 (uint16_t)(SUB161(auVar10 >> 0x77, 0) & 1) << 0xe | (uint16_t)(auVar10[0xf] >> 7) << 0xf) == 0xffff)\r\n    0x1837fb5bd    |            goto code_r0x0001837fb6d3;\r\n                   |        }\r\n    0x1837fb5d6    |        piVar3 = *(int64_t **)\r\n    0x1837fb5d2    |                  (*(int64_t *)(*(int64_t *)(unaff_GS_OFFSET + 0x58) + (uint64_t)*(uint32_t *)0x191d832e0 * 8) + 0x3d8);\r\n    0x1837fb5ec    |        if ((piVar3 == (int64_t *)0x0) || (iVar8 = *piVar3, iVar8 == 0)) goto code_r0x0001837fb716;\r\n    0x1837fb601    |        (*(code *)0x185f59da0)(uVar7, &var_48h);\r\n    0x1837fb607    |        piVar4 = *(int32_t **)(arg1 + 0x68);\r\n    0x1837fb60b    |        uVar7 = *(undefined8 *)(arg1 + 0x70);\r\n    0x1837fb612    |        if (piVar4 != (int32_t *)0x0) {\r\n    0x1837fb619    |            LOCK();\r\n    0x1837fb619    |            iVar1 = *piVar4;\r\n    0x1837fb619    |            *piVar4 = *piVar4 + 1;\r\n    0x1837fb619    |            UNLOCK();\r\n    0x1837fb623    |            if (iVar1 == 0x7fffffff) {\r\n    0x1837fb719    |                pcVar5 = (code *)swi(3);\r\n    0x1837fb719    |                (*pcVar5)();\r\n    0x1837fb719    |                return;\r\n                   |            }\r\n                   |        }\r\n    0x1837fb62e    |        puVar9 = (undefined4 *)func_0x000185f006b8(0x50);\r\n    0x1837fb62e    |        iVar6 = var_48h;\r\n    0x1837fb636    |        *puVar9 = 1;\r\n    0x1837fb643    |        *(undefined8 *)(puVar9 + 2) = 0x1837fbd40;\r\n    0x1837fb64e    |        *(undefined8 *)(puVar9 + 4) = 0x182c9ce90;\r\n    0x1837fb659    |        *(undefined8 *)(puVar9 + 6) = 0x1832818a0;\r\n    0x1837fb664    |        *(undefined8 *)(puVar9 + 8) = 0x1837fb720;\r\n    0x1837fb668    |        puVar9[10] = 0;\r\n    0x1837fb66f    |        *(int32_t **)(puVar9 + 0xc) = piVar4;\r\n    0x1837fb673    |        *(undefined8 *)(puVar9 + 0xe) = uVar7;\r\n    0x1837fb67d    |        var_48h = 0;\r\n    0x1837fb686    |        *(int64_t *)(puVar9 + 0x10) = iVar6;\r\n    0x1837fb686    |        *(undefined8 *)(puVar9 + 0x12) = uStack_40;\r\n    0x1837fb699    |        func_0x000184339cd0(&var_68h, 0x190c22cd8, 0x190c22c20, 0xa1);\r\n    0x1837fb6c3    |        var_30h = (int64_t)puVar9;\r\n    0x1837fb6c3    |        (*(code *)0x185f59da0)(iVar8, &var_68h, &var_30h, 0);\r\n    0x1837fb6d1    |        if (var_48h != 0) {\r\n    0x1837fb6f8    |            LOCK();\r\n    0x1837fb6f8    |            *(int32_t *)var_48h = *(int32_t *)var_48h + -1;\r\n    0x1837fb6f8    |            UNLOCK();\r\n    0x1837fb6fb    |            if (*(int32_t *)var_48h == 0) {\r\n    0x1837fb702    |                func_0x0001841dcbe0(var_48h, 8);\r\n                   |            }\r\n                   |        }\r\n                   |    }\r\n                   |code_r0x0001837fb6d3:\r\n    0x1837fb6e5    |    if (*(uint64_t *)0x191c71040 == (var_28h ^ (uint64_t)auStack_88)) {\r\n    0x1837fb6f0    |        return;\r\n                   |    }\r\n    0x1837fb70e    |    func_0x000185f05b40(var_28h ^ (uint64_t)auStack_88);\r\n                   |code_r0x0001837fb716:\r\n    0x1837fb716    |    pcVar5 = (code *)swi(3);\r\n    0x1837fb716    |    (*pcVar5)();\r\n    0x1837fb716    |    return;\r\n                   |}\r\n[{\"offset\":6501152064,\"name\":\"fcn.1837fb540\",\"size\":474,\"is-pure\":false,\"realsz\":472,\"noreturn\":false,\"stackframe\":136,\"calltype\":\"ms\",\"cost\":147,\"cc\":15,\"loops\":3,\"bits\":64,\"type\":\"fcn\",\"nbbs\":19,\"edges\":28,\"ebbs\":3,\"signature\":\"fcn.1837fb540(int64_t arg1, int64_t arg4, int64_t arg_28h);\",\"minbound\":6501152064,\"maxbound\":6501152538,\"callrefs\":[{\"from\":6501152118,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6501152134,\"to\":6501063216,\"type\":\"CALL\"},{\"from\":6501152257,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6501152302,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6501152423,\"to\":6512942288,\"type\":\"CALL\"},{\"from\":6501152451,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6501152499,\"to\":6501152127,\"type\":\"CODE\"},{\"from\":6501152514,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6501152519,\"to\":6501152467,\"type\":\"CODE\"},{\"from\":6501152529,\"to\":6542089024,\"type\":\"CALL\"}],\"datarefs\":[{\"from\":6501152087,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6501152195,\"to\":6741832416,\"type\":\"DATA\"},{\"from\":6501152316,\"to\":6501154112,\"type\":\"DATA\"},{\"from\":6501152327,\"to\":6489230992,\"type\":\"DATA\"},{\"from\":6501152338,\"to\":6495410336,\"type\":\"DATA\"},{\"from\":6501152349,\"to\":6501152544,\"type\":\"DATA\"},{\"from\":6501152395,\"to\":6723611864,\"type\":\"DATA\"},{\"from\":6501152402,\"to\":6723611680,\"type\":\"DATA\"},{\"from\":6501152475,\"to\":6740709440,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6501152499,\"to\":6501152127,\"type\":\"CODE\"},{\"from\":6501152519,\"to\":6501152467,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":2,\"outdegree\":8,\"nlocals\":4,\"nargs\":3,\"stackvars\":[{\"name\":\"var_68h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-104}},{\"name\":\"var_48h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-72}},{\"name\":\"var_30h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-48}},{\"name\":\"var_28h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-40}},{\"name\":\"arg_28h\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":40}}],\"regvars\":[{\"name\":\"arg4\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"r9\"}},{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"confidence":"observed","authority":"shipped-artifact","environment":null,"limitations":["The executable version and supported formats are reported as unknown because no reliable version probe was performed.","A non-zero process exit is preserved as an observed command result.","Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.","When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call."],"relationship_coverage":null,"locations":[{"kind":"artifact-path","path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"}],"evidence_links":[]},"meta":{"command":"execute-rizin-command","duration":"5006ms"}}