{"ok":true,"data":{"evidence_id":"ev_cf5bf52d78bc3631354ddc7d53db7c2a259b4bc59519a3c78fe1fe30fb6573e6","subject":{"name":"Tabbit.dll","digest":{"sha256":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c"},"local_path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","format":"unknown","architecture":null},"provider":{"id":"rizin","name":"Rizin","version":null},"analysis_profile":null,"predicate_type":"rea.reverse-engineering.command-observation","operation":"execute_rizin_command","parameters":{"path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","command":"e scr.color=0;af @ 0x18a89a160;pdgo @ 0x18a89a160;afij @ 0x18a89a160","provider_executable":"C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe","command_arguments":["-N","-q","-c","e scr.color=0;af @ 0x18a89a160;pdgo @ 0x18a89a160;afij @ 0x18a89a160","C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"]},"raw_result":{"stdout":"                   |\r\n    0x18a89a160    |int64_t fcn.18a89a160(int64_t arg1, int64_t arg2, int64_t arg3, int64_t arg4)\r\n                   |{\r\n                   |    code *pcVar1;\r\n                   |    undefined8 *puVar2;\r\n                   |    undefined auStack_188 [40];\r\n                   |    int64_t var_160h;\r\n                   |    undefined8 uStack_158;\r\n                   |    int64_t var_150h;\r\n                   |    undefined8 uStack_148;\r\n                   |    int64_t var_140h;\r\n                   |    undefined8 uStack_138;\r\n                   |    int64_t var_130h;\r\n                   |    undefined8 uStack_128;\r\n                   |    int64_t var_120h;\r\n                   |    undefined8 uStack_118;\r\n                   |    int64_t var_110h;\r\n                   |    undefined8 uStack_108;\r\n                   |    int64_t var_100h;\r\n                   |    int64_t var_88h;\r\n                   |    int64_t iStack_80;\r\n                   |    int64_t var_78h;\r\n                   |    undefined8 uStack_70;\r\n                   |    int64_t var_68h;\r\n                   |    undefined8 uStack_60;\r\n                   |    int64_t var_58h;\r\n                   |    int64_t var_48h;\r\n                   |    int64_t var_40h;\r\n                   |    int64_t var_38h;\r\n                   |    \r\n    0x18a89a187    |    var_40h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_188;\r\n    0x18a89a195    |    *(undefined8 *)(arg1 + 0x40) = 0;\r\n    0x18a89a195    |    *(undefined8 *)(arg1 + 0x48) = 0;\r\n    0x18a89a199    |    *(undefined8 *)(arg1 + 0x30) = 0;\r\n    0x18a89a199    |    *(undefined8 *)(arg1 + 0x38) = 0;\r\n    0x18a89a19d    |    *(undefined8 *)(arg1 + 0x20) = 0;\r\n    0x18a89a19d    |    *(undefined8 *)(arg1 + 0x28) = 0;\r\n    0x18a89a1a1    |    *(undefined8 *)(arg1 + 0x10) = 0;\r\n    0x18a89a1a1    |    *(undefined8 *)(arg1 + 0x18) = 0;\r\n    0x18a89a1a5    |    *(undefined8 *)arg1 = 0;\r\n    0x18a89a1a5    |    *(undefined8 *)(arg1 + 8) = 0;\r\n    0x18a89a1ad    |    puVar2 = (undefined8 *)func_0x000185f006b8(0x18);\r\n    0x18a89a1b2    |    *(undefined8 **)(arg1 + 0x18) = puVar2;\r\n    0x18a89a1b6    |    *(undefined8 *)(arg1 + 0x28) = 1;\r\n    0x18a89a1c1    |    if (puVar2 != (undefined8 *)0x0) {\r\n    0x18a89a1c7    |        *puVar2 = 0;\r\n    0x18a89a1c7    |        puVar2[1] = 0;\r\n    0x18a89a1ca    |        puVar2[2] = 0;\r\n    0x18a89a1d7    |        *(undefined8 *)(arg1 + 0x20) = 1;\r\n    0x18a89a1df    |        *(undefined8 *)(arg1 + 0x38) = 0;\r\n    0x18a89a1df    |        *(undefined8 *)(arg1 + 0x40) = 0;\r\n    0x18a89a1e3    |        *(int64_t *)(arg1 + 0x30) = arg1 + 0x38;\r\n    0x18a89a1e7    |        *(undefined8 *)(arg1 + 0x50) = 1;\r\n    0x18a89a1f1    |        func_0x0001807bbec0(arg1, arg2);\r\n    0x18a89a205    |        var_78h = 0x190c0a280;\r\n    0x18a89a208    |        uStack_70 = 8;\r\n    0x18a89a213    |        func_0x00018adbcc10(arg1);\r\n    0x18a89a227    |        var_68h = 0x190c0a260;\r\n    0x18a89a22a    |        uStack_60 = 0x18;\r\n    0x18a89a240    |        func_0x000180a8fe00(arg3, &var_58h);\r\n    0x18a89a245    |        func_0x00018afb3e30(&var_100h, &var_58h);\r\n    0x18a89a25a    |        if (var_48h._7_1_ < '\\0') {\r\n    0x18a89a26f    |            func_0x0001841dcbe0(var_58h, CONCAT17(var_48h._7_1_, (unkbyte7)var_48h) * 2);\r\n                   |        }\r\n    0x18a89a27f    |        var_88h = func_0x000184c155e0(&var_100h);\r\n    0x18a89a284    |        iStack_80 = (int64_t)*(char *)(var_88h + 0x17);\r\n    0x18a89a28c    |        if (iStack_80 < 0) {\r\n    0x18a89a28e    |            iStack_80 = *(int64_t *)(var_88h + 8);\r\n    0x18a89a292    |            var_88h = *(int64_t *)var_88h;\r\n                   |        }\r\n    0x18a89a2a7    |        func_0x00018adbcc10(arg1);\r\n    0x18a89a274    |        func_0x0001841c04a0(&var_100h);\r\n    0x18a89a2ba    |        func_0x00018adbccb0(arg1, arg4);\r\n    0x18a89a2cb    |        var_110h = 0x1907f4c50;\r\n    0x18a89a2ce    |        uStack_108 = 3;\r\n    0x18a89a2d9    |        func_0x00018adbcc10(arg1);\r\n    0x18a89a2ea    |        var_120h = 0x190c0a290;\r\n    0x18a89a2f2    |        uStack_118 = 9;\r\n    0x18a89a2f9    |        func_0x00018adbcc10(arg1);\r\n    0x18a89a30a    |        var_130h = 0x190c0a29c;\r\n    0x18a89a312    |        uStack_128 = 6;\r\n    0x18a89a319    |        func_0x00018adbcc10(arg1);\r\n    0x18a89a32a    |        var_140h = 0x19067b8a8;\r\n    0x18a89a32d    |        uStack_138 = 9;\r\n    0x18a89a334    |        func_0x00018adbcc10(arg1);\r\n    0x18a89a345    |        var_150h = 0x190c0a2a4;\r\n    0x18a89a348    |        uStack_148 = 6;\r\n    0x18a89a34f    |        func_0x00018adbcc10(arg1);\r\n    0x18a89a360    |        var_160h = 0x190129398;\r\n    0x18a89a363    |        uStack_158 = 1;\r\n    0x18a89a36e    |        func_0x00018adbcc10(arg1);\r\n    0x18a89a388    |        if (*(uint64_t *)0x191c71040 == (var_40h ^ (uint64_t)auStack_188)) {\r\n    0x18a89a3a1    |            return arg1;\r\n                   |        }\r\n    0x18a89a3aa    |        func_0x000185f05b40(var_40h ^ (uint64_t)auStack_188);\r\n                   |    }\r\n    0x18a89a3b2    |    // WARNING: Does not return\r\n    0x18a89a3b2    |    pcVar1 = (code *)invalidInstructionException();\r\n    0x18a89a3b2    |    (*pcVar1)();\r\n                   |}\r\n[{\"offset\":6619242848,\"name\":\"fcn.18a89a160\",\"size\":596,\"is-pure\":false,\"realsz\":596,\"noreturn\":false,\"stackframe\":392,\"calltype\":\"ms\",\"cost\":172,\"cc\":6,\"loops\":0,\"bits\":64,\"type\":\"fcn\",\"nbbs\":9,\"edges\":11,\"ebbs\":2,\"signature\":\"fcn.18a89a160(int64_t arg1, int64_t arg2, int64_t arg3, int64_t arg4);\",\"minbound\":6619242848,\"maxbound\":6619243444,\"callrefs\":[{\"from\":6619242925,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6619242993,\"to\":6450560704,\"type\":\"CALL\"},{\"from\":6619243027,\"to\":6624627728,\"type\":\"CALL\"},{\"from\":6619243072,\"to\":6453526016,\"type\":\"CALL\"},{\"from\":6619243088,\"to\":6626688560,\"type\":\"CALL\"},{\"from\":6619243119,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6619243135,\"to\":6522230240,\"type\":\"CALL\"},{\"from\":6619243175,\"to\":6624627728,\"type\":\"CALL\"},{\"from\":6619243183,\"to\":6511396000,\"type\":\"CALL\"},{\"from\":6619243194,\"to\":6624627888,\"type\":\"CALL\"},{\"from\":6619243225,\"to\":6624627728,\"type\":\"CALL\"},{\"from\":6619243257,\"to\":6624627728,\"type\":\"CALL\"},{\"from\":6619243289,\"to\":6624627728,\"type\":\"CALL\"},{\"from\":6619243316,\"to\":6624627728,\"type\":\"CALL\"},{\"from\":6619243343,\"to\":6624627728,\"type\":\"CALL\"},{\"from\":6619243374,\"to\":6624627728,\"type\":\"CALL\"},{\"from\":6619243437,\"to\":6542089024,\"type\":\"CALL\"}],\"datarefs\":[{\"from\":6619242880,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6619242998,\"to\":6723510912,\"type\":\"DATA\"},{\"from\":6619243032,\"to\":6723510880,\"type\":\"DATA\"},{\"from\":6619243199,\"to\":6719229008,\"type\":\"DATA\"},{\"from\":6619243230,\"to\":6723510928,\"type\":\"DATA\"},{\"from\":6619243262,\"to\":6723510940,\"type\":\"DATA\"},{\"from\":6619243294,\"to\":6717683880,\"type\":\"DATA\"},{\"from\":6619243321,\"to\":6723510948,\"type\":\"DATA\"},{\"from\":6619243348,\"to\":6712103832,\"type\":\"DATA\"},{\"from\":6619243390,\"to\":6740709440,\"type\":\"DATA\"}],\"indegree\":0,\"outdegree\":17,\"nlocals\":14,\"nargs\":4,\"stackvars\":[{\"name\":\"var_160h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-352}},{\"name\":\"var_150h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-336}},{\"name\":\"var_140h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-320}},{\"name\":\"var_130h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-304}},{\"name\":\"var_120h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-288}},{\"name\":\"var_110h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-272}},{\"name\":\"var_100h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-256}},{\"name\":\"var_88h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-136}},{\"name\":\"var_78h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-120}},{\"name\":\"var_68h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-104}},{\"name\":\"var_58h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-88}},{\"name\":\"var_48h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-72}},{\"name\":\"var_40h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-64}},{\"name\":\"var_38h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-56}}],\"regvars\":[{\"name\":\"arg3\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"r8\"}},{\"name\":\"arg4\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"r9\"}},{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"normalized_result":{"stdout":"                   |\r\n    0x18a89a160    |int64_t fcn.18a89a160(int64_t arg1, int64_t arg2, int64_t arg3, int64_t arg4)\r\n                   |{\r\n                   |    code *pcVar1;\r\n                   |    undefined8 *puVar2;\r\n                   |    undefined auStack_188 [40];\r\n                   |    int64_t var_160h;\r\n                   |    undefined8 uStack_158;\r\n                   |    int64_t var_150h;\r\n                   |    undefined8 uStack_148;\r\n                   |    int64_t var_140h;\r\n                   |    undefined8 uStack_138;\r\n                   |    int64_t var_130h;\r\n                   |    undefined8 uStack_128;\r\n                   |    int64_t var_120h;\r\n                   |    undefined8 uStack_118;\r\n                   |    int64_t var_110h;\r\n                   |    undefined8 uStack_108;\r\n                   |    int64_t var_100h;\r\n                   |    int64_t var_88h;\r\n                   |    int64_t iStack_80;\r\n                   |    int64_t var_78h;\r\n                   |    undefined8 uStack_70;\r\n                   |    int64_t var_68h;\r\n                   |    undefined8 uStack_60;\r\n                   |    int64_t var_58h;\r\n                   |    int64_t var_48h;\r\n                   |    int64_t var_40h;\r\n                   |    int64_t var_38h;\r\n                   |    \r\n    0x18a89a187    |    var_40h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_188;\r\n    0x18a89a195    |    *(undefined8 *)(arg1 + 0x40) = 0;\r\n    0x18a89a195    |    *(undefined8 *)(arg1 + 0x48) = 0;\r\n    0x18a89a199    |    *(undefined8 *)(arg1 + 0x30) = 0;\r\n    0x18a89a199    |    *(undefined8 *)(arg1 + 0x38) = 0;\r\n    0x18a89a19d    |    *(undefined8 *)(arg1 + 0x20) = 0;\r\n    0x18a89a19d    |    *(undefined8 *)(arg1 + 0x28) = 0;\r\n    0x18a89a1a1    |    *(undefined8 *)(arg1 + 0x10) = 0;\r\n    0x18a89a1a1    |    *(undefined8 *)(arg1 + 0x18) = 0;\r\n    0x18a89a1a5    |    *(undefined8 *)arg1 = 0;\r\n    0x18a89a1a5    |    *(undefined8 *)(arg1 + 8) = 0;\r\n    0x18a89a1ad    |    puVar2 = (undefined8 *)func_0x000185f006b8(0x18);\r\n    0x18a89a1b2    |    *(undefined8 **)(arg1 + 0x18) = puVar2;\r\n    0x18a89a1b6    |    *(undefined8 *)(arg1 + 0x28) = 1;\r\n    0x18a89a1c1    |    if (puVar2 != (undefined8 *)0x0) {\r\n    0x18a89a1c7    |        *puVar2 = 0;\r\n    0x18a89a1c7    |        puVar2[1] = 0;\r\n    0x18a89a1ca    |        puVar2[2] = 0;\r\n    0x18a89a1d7    |        *(undefined8 *)(arg1 + 0x20) = 1;\r\n    0x18a89a1df    |        *(undefined8 *)(arg1 + 0x38) = 0;\r\n    0x18a89a1df    |        *(undefined8 *)(arg1 + 0x40) = 0;\r\n    0x18a89a1e3    |        *(int64_t *)(arg1 + 0x30) = arg1 + 0x38;\r\n    0x18a89a1e7    |        *(undefined8 *)(arg1 + 0x50) = 1;\r\n    0x18a89a1f1    |        func_0x0001807bbec0(arg1, arg2);\r\n    0x18a89a205    |        var_78h = 0x190c0a280;\r\n    0x18a89a208    |        uStack_70 = 8;\r\n    0x18a89a213    |        func_0x00018adbcc10(arg1);\r\n    0x18a89a227    |        var_68h = 0x190c0a260;\r\n    0x18a89a22a    |        uStack_60 = 0x18;\r\n    0x18a89a240    |        func_0x000180a8fe00(arg3, &var_58h);\r\n    0x18a89a245    |        func_0x00018afb3e30(&var_100h, &var_58h);\r\n    0x18a89a25a    |        if (var_48h._7_1_ < '\\0') {\r\n    0x18a89a26f    |            func_0x0001841dcbe0(var_58h, CONCAT17(var_48h._7_1_, (unkbyte7)var_48h) * 2);\r\n                   |        }\r\n    0x18a89a27f    |        var_88h = func_0x000184c155e0(&var_100h);\r\n    0x18a89a284    |        iStack_80 = (int64_t)*(char *)(var_88h + 0x17);\r\n    0x18a89a28c    |        if (iStack_80 < 0) {\r\n    0x18a89a28e    |            iStack_80 = *(int64_t *)(var_88h + 8);\r\n    0x18a89a292    |            var_88h = *(int64_t *)var_88h;\r\n                   |        }\r\n    0x18a89a2a7    |        func_0x00018adbcc10(arg1);\r\n    0x18a89a274    |        func_0x0001841c04a0(&var_100h);\r\n    0x18a89a2ba    |        func_0x00018adbccb0(arg1, arg4);\r\n    0x18a89a2cb    |        var_110h = 0x1907f4c50;\r\n    0x18a89a2ce    |        uStack_108 = 3;\r\n    0x18a89a2d9    |        func_0x00018adbcc10(arg1);\r\n    0x18a89a2ea    |        var_120h = 0x190c0a290;\r\n    0x18a89a2f2    |        uStack_118 = 9;\r\n    0x18a89a2f9    |        func_0x00018adbcc10(arg1);\r\n    0x18a89a30a    |        var_130h = 0x190c0a29c;\r\n    0x18a89a312    |        uStack_128 = 6;\r\n    0x18a89a319    |        func_0x00018adbcc10(arg1);\r\n    0x18a89a32a    |        var_140h = 0x19067b8a8;\r\n    0x18a89a32d    |        uStack_138 = 9;\r\n    0x18a89a334    |        func_0x00018adbcc10(arg1);\r\n    0x18a89a345    |        var_150h = 0x190c0a2a4;\r\n    0x18a89a348    |        uStack_148 = 6;\r\n    0x18a89a34f    |        func_0x00018adbcc10(arg1);\r\n    0x18a89a360    |        var_160h = 0x190129398;\r\n    0x18a89a363    |        uStack_158 = 1;\r\n    0x18a89a36e    |        func_0x00018adbcc10(arg1);\r\n    0x18a89a388    |        if (*(uint64_t *)0x191c71040 == (var_40h ^ (uint64_t)auStack_188)) {\r\n    0x18a89a3a1    |            return arg1;\r\n                   |        }\r\n    0x18a89a3aa    |        func_0x000185f05b40(var_40h ^ (uint64_t)auStack_188);\r\n                   |    }\r\n    0x18a89a3b2    |    // WARNING: Does not return\r\n    0x18a89a3b2    |    pcVar1 = (code *)invalidInstructionException();\r\n    0x18a89a3b2    |    (*pcVar1)();\r\n                   |}\r\n[{\"offset\":6619242848,\"name\":\"fcn.18a89a160\",\"size\":596,\"is-pure\":false,\"realsz\":596,\"noreturn\":false,\"stackframe\":392,\"calltype\":\"ms\",\"cost\":172,\"cc\":6,\"loops\":0,\"bits\":64,\"type\":\"fcn\",\"nbbs\":9,\"edges\":11,\"ebbs\":2,\"signature\":\"fcn.18a89a160(int64_t arg1, int64_t arg2, int64_t arg3, int64_t arg4);\",\"minbound\":6619242848,\"maxbound\":6619243444,\"callrefs\":[{\"from\":6619242925,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6619242993,\"to\":6450560704,\"type\":\"CALL\"},{\"from\":6619243027,\"to\":6624627728,\"type\":\"CALL\"},{\"from\":6619243072,\"to\":6453526016,\"type\":\"CALL\"},{\"from\":6619243088,\"to\":6626688560,\"type\":\"CALL\"},{\"from\":6619243119,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6619243135,\"to\":6522230240,\"type\":\"CALL\"},{\"from\":6619243175,\"to\":6624627728,\"type\":\"CALL\"},{\"from\":6619243183,\"to\":6511396000,\"type\":\"CALL\"},{\"from\":6619243194,\"to\":6624627888,\"type\":\"CALL\"},{\"from\":6619243225,\"to\":6624627728,\"type\":\"CALL\"},{\"from\":6619243257,\"to\":6624627728,\"type\":\"CALL\"},{\"from\":6619243289,\"to\":6624627728,\"type\":\"CALL\"},{\"from\":6619243316,\"to\":6624627728,\"type\":\"CALL\"},{\"from\":6619243343,\"to\":6624627728,\"type\":\"CALL\"},{\"from\":6619243374,\"to\":6624627728,\"type\":\"CALL\"},{\"from\":6619243437,\"to\":6542089024,\"type\":\"CALL\"}],\"datarefs\":[{\"from\":6619242880,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6619242998,\"to\":6723510912,\"type\":\"DATA\"},{\"from\":6619243032,\"to\":6723510880,\"type\":\"DATA\"},{\"from\":6619243199,\"to\":6719229008,\"type\":\"DATA\"},{\"from\":6619243230,\"to\":6723510928,\"type\":\"DATA\"},{\"from\":6619243262,\"to\":6723510940,\"type\":\"DATA\"},{\"from\":6619243294,\"to\":6717683880,\"type\":\"DATA\"},{\"from\":6619243321,\"to\":6723510948,\"type\":\"DATA\"},{\"from\":6619243348,\"to\":6712103832,\"type\":\"DATA\"},{\"from\":6619243390,\"to\":6740709440,\"type\":\"DATA\"}],\"indegree\":0,\"outdegree\":17,\"nlocals\":14,\"nargs\":4,\"stackvars\":[{\"name\":\"var_160h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-352}},{\"name\":\"var_150h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-336}},{\"name\":\"var_140h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-320}},{\"name\":\"var_130h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-304}},{\"name\":\"var_120h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-288}},{\"name\":\"var_110h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-272}},{\"name\":\"var_100h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-256}},{\"name\":\"var_88h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-136}},{\"name\":\"var_78h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-120}},{\"name\":\"var_68h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-104}},{\"name\":\"var_58h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-88}},{\"name\":\"var_48h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-72}},{\"name\":\"var_40h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-64}},{\"name\":\"var_38h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-56}}],\"regvars\":[{\"name\":\"arg3\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"r8\"}},{\"name\":\"arg4\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"r9\"}},{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"confidence":"observed","authority":"shipped-artifact","environment":null,"limitations":["The executable version and supported formats are reported as unknown because no reliable version probe was performed.","A non-zero process exit is preserved as an observed command result.","Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.","When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call."],"relationship_coverage":null,"locations":[{"kind":"artifact-path","path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"}],"evidence_links":[]},"meta":{"command":"execute-rizin-command","duration":"5418ms"}}