{"ok":true,"data":{"evidence_id":"ev_37aa8e4b5d98c8cbde93766b97ec348ad59e2f570f53c1a74a75730c2bb15f7f","subject":{"name":"Tabbit.dll","digest":{"sha256":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c"},"local_path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","format":"unknown","architecture":null},"provider":{"id":"rizin","name":"Rizin","version":null},"analysis_profile":null,"predicate_type":"rea.reverse-engineering.command-observation","operation":"execute_rizin_command","parameters":{"path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","command":"e scr.color=0;af @ 0x18367f730;pdgo @ 0x18367f730;afij @ 0x18367f730","provider_executable":"C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe","command_arguments":["-N","-q","-c","e scr.color=0;af @ 0x18367f730;pdgo @ 0x18367f730;afij @ 0x18367f730","C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"]},"raw_result":{"stdout":"                   |\r\n    0x18367f730    |void fcn.18367f730(int64_t arg1, int64_t arg2)\r\n                   |{\r\n                   |    int32_t iVar1;\r\n                   |    int32_t *piVar2;\r\n                   |    int64_t iVar3;\r\n                   |    code *pcVar4;\r\n                   |    int64_t iVar5;\r\n                   |    int32_t *piVar6;\r\n                   |    int64_t unaff_GS_OFFSET;\r\n                   |    undefined auStack_88 [32];\r\n                   |    int64_t var_68h;\r\n                   |    int64_t var_48h;\r\n                   |    int64_t var_40h;\r\n                   |    int64_t var_38h;\r\n                   |    \r\n    0x18367f749    |    var_38h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_88;\r\n    0x18367f751    |    *(undefined *)(arg1 + 0xf9) = 1;\r\n    0x18367f758    |    piVar6 = *(int32_t **)(arg1 + 0xf0);\r\n    0x18367f75f    |    *(undefined8 *)(arg1 + 0xf0) = 0;\r\n    0x18367f76d    |    if (piVar6 != (int32_t *)0x0) {\r\n    0x18367f76f    |        LOCK();\r\n    0x18367f76f    |        *piVar6 = *piVar6 + -1;\r\n    0x18367f76f    |        UNLOCK();\r\n    0x18367f772    |        if (*piVar6 == 0) {\r\n    0x18367f782    |            if (*(int64_t *)(piVar6 + 4) == 0x185b0f870) {\r\n    0x18367f784    |                piVar2 = *(int32_t **)(piVar6 + 10);\r\n    0x18367f78b    |                if (piVar2 != (int32_t *)0x0) {\r\n    0x18367f79c    |                    LOCK();\r\n    0x18367f79c    |                    *piVar2 = *piVar2 + -1;\r\n    0x18367f79c    |                    UNLOCK();\r\n    0x18367f79f    |                    if (*piVar2 == 0) {\r\n    0x18367f7a5    |                        (*(code *)0x185f59da0)();\r\n                   |                    }\r\n                   |                }\r\n    0x18367f795    |                func_0x0001841dcbe0(piVar6, 0x30);\r\n                   |            } else {\r\n    0x18367f7bf    |                (*(code *)0x185f59da0)(piVar6);\r\n                   |            }\r\n                   |        }\r\n                   |    }\r\n    0x18367f7c5    |    func_0x000184cb7790(arg1 + 0x100);\r\n    0x18367f7d1    |    func_0x000184cb7790(arg1 + 0x160);\r\n    0x18367f7e1    |    if (*(int64_t *)arg2 != 0) {\r\n    0x18367f7e3    |        func_0x00018591ca70(arg1 + 0xd0, arg2);\r\n                   |    }\r\n    0x18367f7f9    |    if (*(char *)(arg1 + 200) != '\\0') goto code_r0x00018367f9d4;\r\n    0x18367f806    |    if (*(char *)(arg1 + 0xc9) != '\\0') goto code_r0x00018367f9d4;\r\n    0x18367f813    |    *(undefined *)(*(int64_t *)(arg1 + 0x1c0) + 4) = 1;\r\n    0x18367f81c    |    piVar6 = (int32_t *)func_0x000185f006b8(8);\r\n    0x18367f821    |    *piVar6 = 0;\r\n    0x18367f827    |    *(undefined *)(piVar6 + 1) = 0;\r\n    0x18367f82e    |    if (piVar6 != (int32_t *)0x0) {\r\n    0x18367f835    |        LOCK();\r\n    0x18367f835    |        iVar1 = *piVar6;\r\n    0x18367f835    |        *piVar6 = *piVar6 + 1;\r\n    0x18367f835    |        UNLOCK();\r\n    0x18367f83f    |        if (iVar1 == 0x7fffffff) {\r\n    0x18367fa6a    |            pcVar4 = (code *)swi(3);\r\n    0x18367fa6a    |            (*pcVar4)();\r\n    0x18367fa6a    |            return;\r\n                   |        }\r\n                   |    }\r\n    0x18367f845    |    piVar2 = *(int32_t **)(arg1 + 0x1c0);\r\n    0x18367f84c    |    *(int32_t **)(arg1 + 0x1c0) = piVar6;\r\n    0x18367f856    |    if (piVar2 != (int32_t *)0x0) {\r\n    0x18367f858    |        LOCK();\r\n    0x18367f858    |        *piVar2 = *piVar2 + -1;\r\n    0x18367f858    |        UNLOCK();\r\n    0x18367f85b    |        if (*piVar2 == 0) {\r\n    0x18367f7b2    |            func_0x0001841dcbe0(piVar2, 8);\r\n                   |        }\r\n                   |    }\r\n    0x18367f861    |    *(undefined *)(arg1 + 0xfa) = 0;\r\n    0x18367f86d    |    if (*(int64_t *)(arg1 + 0x18) != 0) {\r\n    0x18367f873    |        *(undefined *)(arg1 + 0xc9) = 1;\r\n    0x18367f899    |        if (*(int32_t *)\r\n    0x18367f88f    |             (*(int64_t *)(*(int64_t *)(unaff_GS_OFFSET + 0x58) + (uint64_t)*(uint32_t *)0x191d832e0 * 8) + 4) <\r\n    0x18367f899    |            *(int32_t *)0x191dd7a50) goto code_r0x00018367fa1b;\r\n    0x18367f9ee    |        while( true ) {\r\n    0x18367f89f    |            iVar5 = *(int64_t *)0x191dd7a48;\r\n    0x18367f8a9    |            if (*(int64_t *)0x191dd7a48 != 0) {\r\n    0x18367f8b0    |                LOCK();\r\n    0x18367f8b0    |                piVar6 = (int32_t *)(*(int64_t *)0x191dd7a48 + 8);\r\n    0x18367f8b0    |                iVar1 = *piVar6;\r\n    0x18367f8b0    |                *piVar6 = *piVar6 + 1;\r\n    0x18367f8b0    |                UNLOCK();\r\n    0x18367f8ba    |                if (iVar1 == 0x7fffffff) {\r\n    0x18367fa70    |                    pcVar4 = (code *)swi(3);\r\n    0x18367fa70    |                    (*pcVar4)();\r\n    0x18367fa70    |                    return;\r\n                   |                }\r\n                   |            }\r\n    0x18367f8c0    |            piVar6 = *(int32_t **)(arg1 + 0x1c0);\r\n    0x18367f8c7    |            iVar3 = *(int64_t *)(arg1 + 0x1c8);\r\n    0x18367f8d1    |            if (piVar6 != (int32_t *)0x0) {\r\n    0x18367f8d8    |                LOCK();\r\n    0x18367f8d8    |                iVar1 = *piVar6;\r\n    0x18367f8d8    |                *piVar6 = *piVar6 + 1;\r\n    0x18367f8d8    |                UNLOCK();\r\n    0x18367f8e2    |                if (iVar1 == 0x7fffffff) {\r\n    0x18367fa6d    |                    pcVar4 = (code *)swi(3);\r\n    0x18367fa6d    |                    (*pcVar4)();\r\n    0x18367fa6d    |                    return;\r\n                   |                }\r\n                   |            }\r\n    0x18367f8ed    |            var_40h = func_0x000185f006b8(0x38);\r\n    0x18367f8f7    |            *(undefined4 *)var_40h = 1;\r\n    0x18367f900    |            *(undefined8 *)(var_40h + 8) = 0x18339d600;\r\n    0x18367f90b    |            *(undefined8 *)(var_40h + 0x10) = 0x182beced0;\r\n    0x18367f916    |            *(undefined8 *)(var_40h + 0x18) = 0x18339cdd0;\r\n    0x18367f921    |            *(undefined8 *)(var_40h + 0x20) = 0x183680c30;\r\n    0x18367f925    |            *(int32_t **)(var_40h + 0x28) = piVar6;\r\n    0x18367f929    |            *(int64_t *)(var_40h + 0x30) = iVar3;\r\n    0x18367f93a    |            var_48h = func_0x000185f006b8(0x30);\r\n    0x18367f93f    |            *(undefined4 *)var_48h = 1;\r\n    0x18367f948    |            *(undefined8 *)(var_48h + 8) = 0x18184f4f0;\r\n    0x18367f953    |            *(undefined8 *)(var_48h + 0x10) = 0x183682bb0;\r\n    0x18367f95e    |            *(undefined8 *)(var_48h + 0x18) = 0x1841d75d0;\r\n    0x18367f969    |            *(undefined8 *)(var_48h + 0x20) = 0x183680dc0;\r\n    0x18367f96d    |            iVar3 = *(int64_t *)(arg1 + 0x18);\r\n    0x18367f971    |            *(int64_t *)(arg1 + 0x18) = 0;\r\n    0x18367f979    |            *(int64_t *)(var_48h + 0x28) = iVar3;\r\n    0x18367f97d    |            arg1 = (int64_t)&var_48h;\r\n    0x18367f993    |            func_0x000184339cd0(&var_68h, 0x190285e58, 0x190c0a308, 0x13c);\r\n    0x18367f9b2    |            func_0x000185549590(iVar5, &var_68h, arg1, &var_40h);\r\n    0x18367f9ba    |            if (iVar5 != 0) {\r\n    0x18367f9bc    |                LOCK();\r\n    0x18367f9bc    |                piVar6 = (int32_t *)(iVar5 + 8);\r\n    0x18367f9bc    |                *piVar6 = *piVar6 + -1;\r\n    0x18367f9bc    |                UNLOCK();\r\n    0x18367f9c0    |                if (*piVar6 == 0) {\r\n    0x18367f9c5    |                    func_0x000185578b40(iVar5);\r\n                   |                }\r\n                   |            }\r\n                   |code_r0x00018367f9d4:\r\n    0x18367f9d4    |            piVar6 = *(int32_t **)arg2;\r\n    0x18367f9da    |            if (piVar6 != (int32_t *)0x0) {\r\n    0x18367f9fd    |                LOCK();\r\n    0x18367f9fd    |                *piVar6 = *piVar6 + -1;\r\n    0x18367f9fd    |                UNLOCK();\r\n    0x18367fa00    |                if (*piVar6 == 0) {\r\n    0x18367fa06    |                    (*(code *)0x185f59da0)();\r\n                   |                }\r\n                   |            }\r\n    0x18367f9ee    |            if (*(uint64_t *)0x191c71040 == (var_38h ^ (uint64_t)auStack_88)) break;\r\n    0x18367fa13    |            func_0x000185f05b40(var_38h ^ (uint64_t)auStack_88);\r\n                   |code_r0x00018367fa1b:\r\n    0x18367fa22    |            func_0x000185f00fe8(0x191dd7a50);\r\n    0x18367fa2e    |            if (*(int32_t *)0x191dd7a50 == -1) {\r\n    0x18367fa4a    |                func_0x000180a1dea0(*(undefined8 *)0x191de73d0, &var_68h, 0x190c0a899);\r\n    0x18367fa52    |                *(int64_t *)0x191dd7a48 = var_68h;\r\n    0x18367fa60    |                func_0x000185f00f7c(0x191dd7a50);\r\n                   |            }\r\n                   |        }\r\n    0x18367f9fc    |        return;\r\n                   |    }\r\n    0x18367f9cf    |    func_0x000183680c30(arg1);\r\n    0x18367f9cf    |    goto code_r0x00018367f9d4;\r\n                   |}\r\n[{\"offset\":6499596080,\"name\":\"fcn.18367f730\",\"size\":833,\"is-pure\":false,\"realsz\":829,\"noreturn\":false,\"stackframe\":136,\"calltype\":\"ms\",\"cost\":262,\"cc\":28,\"loops\":7,\"bits\":64,\"type\":\"fcn\",\"nbbs\":38,\"edges\":58,\"ebbs\":4,\"signature\":\"fcn.18367f730(int64_t arg1, int64_t arg2);\",\"minbound\":6499596080,\"maxbound\":6499596913,\"callrefs\":[{\"from\":6499596181,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6499596186,\"to\":6499596229,\"type\":\"CODE\"},{\"from\":6499596197,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6499596203,\"to\":6499596173,\"type\":\"CODE\"},{\"from\":6499596210,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6499596215,\"to\":6499596385,\"type\":\"CODE\"},{\"from\":6499596223,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6499596236,\"to\":6522894224,\"type\":\"CALL\"},{\"from\":6499596248,\"to\":6522894224,\"type\":\"CALL\"},{\"from\":6499596269,\"to\":6535891568,\"type\":\"CALL\"},{\"from\":6499596316,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6499596525,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6499596602,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6499596705,\"to\":6512942288,\"type\":\"CALL\"},{\"from\":6499596722,\"to\":6531880336,\"type\":\"CALL\"},{\"from\":6499596741,\"to\":6532074304,\"type\":\"CALL\"},{\"from\":6499596746,\"to\":6499596756,\"type\":\"CODE\"},{\"from\":6499596751,\"to\":6499601456,\"type\":\"CALL\"},{\"from\":6499596806,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6499596812,\"to\":6499596764,\"type\":\"CODE\"},{\"from\":6499596822,\"to\":6542089024,\"type\":\"CALL\"},{\"from\":6499596834,\"to\":6542069736,\"type\":\"CALL\"},{\"from\":6499596874,\"to\":6453059232,\"type\":\"CALL\"},{\"from\":6499596896,\"to\":6542069628,\"type\":\"CALL\"},{\"from\":6499596901,\"to\":6499596447,\"type\":\"CODE\"}],\"datarefs\":[{\"from\":6499596098,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6499596152,\"to\":6537934960,\"type\":\"DATA\"},{\"from\":6499596410,\"to\":6742178384,\"type\":\"DATA\"},{\"from\":6499596416,\"to\":6741832416,\"type\":\"DATA\"},{\"from\":6499596447,\"to\":6742178376,\"type\":\"DATA\"},{\"from\":6499596537,\"to\":6496572928,\"type\":\"DATA\"},{\"from\":6499596548,\"to\":6488510160,\"type\":\"DATA\"},{\"from\":6499596559,\"to\":6496570832,\"type\":\"DATA\"},{\"from\":6499596570,\"to\":6499601456,\"type\":\"DATA\"},{\"from\":6499596609,\"to\":6467941616,\"type\":\"DATA\"},{\"from\":6499596620,\"to\":6499609520,\"type\":\"DATA\"},{\"from\":6499596631,\"to\":6511490512,\"type\":\"DATA\"},{\"from\":6499596642,\"to\":6499601856,\"type\":\"DATA\"},{\"from\":6499596677,\"to\":6713531992,\"type\":\"DATA\"},{\"from\":6499596684,\"to\":6723511048,\"type\":\"DATA\"},{\"from\":6499596772,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6499596827,\"to\":6742178384,\"type\":\"DATA\"},{\"from\":6499596839,\"to\":6742178384,\"type\":\"DATA\"},{\"from\":6499596852,\"to\":6742242256,\"type\":\"DATA\"},{\"from\":6499596859,\"to\":6723512473,\"type\":\"DATA\"},{\"from\":6499596882,\"to\":6742178376,\"type\":\"DATA\"},{\"from\":6499596889,\"to\":6742178384,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6499596186,\"to\":6499596229,\"type\":\"CODE\"},{\"from\":6499596203,\"to\":6499596173,\"type\":\"CODE\"},{\"from\":6499596215,\"to\":6499596385,\"type\":\"CODE\"},{\"from\":6499596746,\"to\":6499596756,\"type\":\"CODE\"},{\"from\":6499596812,\"to\":6499596764,\"type\":\"CODE\"},{\"from\":6499596901,\"to\":6499596447,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":6,\"outdegree\":19,\"nlocals\":4,\"nargs\":2,\"stackvars\":[{\"name\":\"var_68h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-104}},{\"name\":\"var_48h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-72}},{\"name\":\"var_40h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-64}},{\"name\":\"var_38h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-56}}],\"regvars\":[{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"normalized_result":{"stdout":"                   |\r\n    0x18367f730    |void fcn.18367f730(int64_t arg1, int64_t arg2)\r\n                   |{\r\n                   |    int32_t iVar1;\r\n                   |    int32_t *piVar2;\r\n                   |    int64_t iVar3;\r\n                   |    code *pcVar4;\r\n                   |    int64_t iVar5;\r\n                   |    int32_t *piVar6;\r\n                   |    int64_t unaff_GS_OFFSET;\r\n                   |    undefined auStack_88 [32];\r\n                   |    int64_t var_68h;\r\n                   |    int64_t var_48h;\r\n                   |    int64_t var_40h;\r\n                   |    int64_t var_38h;\r\n                   |    \r\n    0x18367f749    |    var_38h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_88;\r\n    0x18367f751    |    *(undefined *)(arg1 + 0xf9) = 1;\r\n    0x18367f758    |    piVar6 = *(int32_t **)(arg1 + 0xf0);\r\n    0x18367f75f    |    *(undefined8 *)(arg1 + 0xf0) = 0;\r\n    0x18367f76d    |    if (piVar6 != (int32_t *)0x0) {\r\n    0x18367f76f    |        LOCK();\r\n    0x18367f76f    |        *piVar6 = *piVar6 + -1;\r\n    0x18367f76f    |        UNLOCK();\r\n    0x18367f772    |        if (*piVar6 == 0) {\r\n    0x18367f782    |            if (*(int64_t *)(piVar6 + 4) == 0x185b0f870) {\r\n    0x18367f784    |                piVar2 = *(int32_t **)(piVar6 + 10);\r\n    0x18367f78b    |                if (piVar2 != (int32_t *)0x0) {\r\n    0x18367f79c    |                    LOCK();\r\n    0x18367f79c    |                    *piVar2 = *piVar2 + -1;\r\n    0x18367f79c    |                    UNLOCK();\r\n    0x18367f79f    |                    if (*piVar2 == 0) {\r\n    0x18367f7a5    |                        (*(code *)0x185f59da0)();\r\n                   |                    }\r\n                   |                }\r\n    0x18367f795    |                func_0x0001841dcbe0(piVar6, 0x30);\r\n                   |            } else {\r\n    0x18367f7bf    |                (*(code *)0x185f59da0)(piVar6);\r\n                   |            }\r\n                   |        }\r\n                   |    }\r\n    0x18367f7c5    |    func_0x000184cb7790(arg1 + 0x100);\r\n    0x18367f7d1    |    func_0x000184cb7790(arg1 + 0x160);\r\n    0x18367f7e1    |    if (*(int64_t *)arg2 != 0) {\r\n    0x18367f7e3    |        func_0x00018591ca70(arg1 + 0xd0, arg2);\r\n                   |    }\r\n    0x18367f7f9    |    if (*(char *)(arg1 + 200) != '\\0') goto code_r0x00018367f9d4;\r\n    0x18367f806    |    if (*(char *)(arg1 + 0xc9) != '\\0') goto code_r0x00018367f9d4;\r\n    0x18367f813    |    *(undefined *)(*(int64_t *)(arg1 + 0x1c0) + 4) = 1;\r\n    0x18367f81c    |    piVar6 = (int32_t *)func_0x000185f006b8(8);\r\n    0x18367f821    |    *piVar6 = 0;\r\n    0x18367f827    |    *(undefined *)(piVar6 + 1) = 0;\r\n    0x18367f82e    |    if (piVar6 != (int32_t *)0x0) {\r\n    0x18367f835    |        LOCK();\r\n    0x18367f835    |        iVar1 = *piVar6;\r\n    0x18367f835    |        *piVar6 = *piVar6 + 1;\r\n    0x18367f835    |        UNLOCK();\r\n    0x18367f83f    |        if (iVar1 == 0x7fffffff) {\r\n    0x18367fa6a    |            pcVar4 = (code *)swi(3);\r\n    0x18367fa6a    |            (*pcVar4)();\r\n    0x18367fa6a    |            return;\r\n                   |        }\r\n                   |    }\r\n    0x18367f845    |    piVar2 = *(int32_t **)(arg1 + 0x1c0);\r\n    0x18367f84c    |    *(int32_t **)(arg1 + 0x1c0) = piVar6;\r\n    0x18367f856    |    if (piVar2 != (int32_t *)0x0) {\r\n    0x18367f858    |        LOCK();\r\n    0x18367f858    |        *piVar2 = *piVar2 + -1;\r\n    0x18367f858    |        UNLOCK();\r\n    0x18367f85b    |        if (*piVar2 == 0) {\r\n    0x18367f7b2    |            func_0x0001841dcbe0(piVar2, 8);\r\n                   |        }\r\n                   |    }\r\n    0x18367f861    |    *(undefined *)(arg1 + 0xfa) = 0;\r\n    0x18367f86d    |    if (*(int64_t *)(arg1 + 0x18) != 0) {\r\n    0x18367f873    |        *(undefined *)(arg1 + 0xc9) = 1;\r\n    0x18367f899    |        if (*(int32_t *)\r\n    0x18367f88f    |             (*(int64_t *)(*(int64_t *)(unaff_GS_OFFSET + 0x58) + (uint64_t)*(uint32_t *)0x191d832e0 * 8) + 4) <\r\n    0x18367f899    |            *(int32_t *)0x191dd7a50) goto code_r0x00018367fa1b;\r\n    0x18367f9ee    |        while( true ) {\r\n    0x18367f89f    |            iVar5 = *(int64_t *)0x191dd7a48;\r\n    0x18367f8a9    |            if (*(int64_t *)0x191dd7a48 != 0) {\r\n    0x18367f8b0    |                LOCK();\r\n    0x18367f8b0    |                piVar6 = (int32_t *)(*(int64_t *)0x191dd7a48 + 8);\r\n    0x18367f8b0    |                iVar1 = *piVar6;\r\n    0x18367f8b0    |                *piVar6 = *piVar6 + 1;\r\n    0x18367f8b0    |                UNLOCK();\r\n    0x18367f8ba    |                if (iVar1 == 0x7fffffff) {\r\n    0x18367fa70    |                    pcVar4 = (code *)swi(3);\r\n    0x18367fa70    |                    (*pcVar4)();\r\n    0x18367fa70    |                    return;\r\n                   |                }\r\n                   |            }\r\n    0x18367f8c0    |            piVar6 = *(int32_t **)(arg1 + 0x1c0);\r\n    0x18367f8c7    |            iVar3 = *(int64_t *)(arg1 + 0x1c8);\r\n    0x18367f8d1    |            if (piVar6 != (int32_t *)0x0) {\r\n    0x18367f8d8    |                LOCK();\r\n    0x18367f8d8    |                iVar1 = *piVar6;\r\n    0x18367f8d8    |                *piVar6 = *piVar6 + 1;\r\n    0x18367f8d8    |                UNLOCK();\r\n    0x18367f8e2    |                if (iVar1 == 0x7fffffff) {\r\n    0x18367fa6d    |                    pcVar4 = (code *)swi(3);\r\n    0x18367fa6d    |                    (*pcVar4)();\r\n    0x18367fa6d    |                    return;\r\n                   |                }\r\n                   |            }\r\n    0x18367f8ed    |            var_40h = func_0x000185f006b8(0x38);\r\n    0x18367f8f7    |            *(undefined4 *)var_40h = 1;\r\n    0x18367f900    |            *(undefined8 *)(var_40h + 8) = 0x18339d600;\r\n    0x18367f90b    |            *(undefined8 *)(var_40h + 0x10) = 0x182beced0;\r\n    0x18367f916    |            *(undefined8 *)(var_40h + 0x18) = 0x18339cdd0;\r\n    0x18367f921    |            *(undefined8 *)(var_40h + 0x20) = 0x183680c30;\r\n    0x18367f925    |            *(int32_t **)(var_40h + 0x28) = piVar6;\r\n    0x18367f929    |            *(int64_t *)(var_40h + 0x30) = iVar3;\r\n    0x18367f93a    |            var_48h = func_0x000185f006b8(0x30);\r\n    0x18367f93f    |            *(undefined4 *)var_48h = 1;\r\n    0x18367f948    |            *(undefined8 *)(var_48h + 8) = 0x18184f4f0;\r\n    0x18367f953    |            *(undefined8 *)(var_48h + 0x10) = 0x183682bb0;\r\n    0x18367f95e    |            *(undefined8 *)(var_48h + 0x18) = 0x1841d75d0;\r\n    0x18367f969    |            *(undefined8 *)(var_48h + 0x20) = 0x183680dc0;\r\n    0x18367f96d    |            iVar3 = *(int64_t *)(arg1 + 0x18);\r\n    0x18367f971    |            *(int64_t *)(arg1 + 0x18) = 0;\r\n    0x18367f979    |            *(int64_t *)(var_48h + 0x28) = iVar3;\r\n    0x18367f97d    |            arg1 = (int64_t)&var_48h;\r\n    0x18367f993    |            func_0x000184339cd0(&var_68h, 0x190285e58, 0x190c0a308, 0x13c);\r\n    0x18367f9b2    |            func_0x000185549590(iVar5, &var_68h, arg1, &var_40h);\r\n    0x18367f9ba    |            if (iVar5 != 0) {\r\n    0x18367f9bc    |                LOCK();\r\n    0x18367f9bc    |                piVar6 = (int32_t *)(iVar5 + 8);\r\n    0x18367f9bc    |                *piVar6 = *piVar6 + -1;\r\n    0x18367f9bc    |                UNLOCK();\r\n    0x18367f9c0    |                if (*piVar6 == 0) {\r\n    0x18367f9c5    |                    func_0x000185578b40(iVar5);\r\n                   |                }\r\n                   |            }\r\n                   |code_r0x00018367f9d4:\r\n    0x18367f9d4    |            piVar6 = *(int32_t **)arg2;\r\n    0x18367f9da    |            if (piVar6 != (int32_t *)0x0) {\r\n    0x18367f9fd    |                LOCK();\r\n    0x18367f9fd    |                *piVar6 = *piVar6 + -1;\r\n    0x18367f9fd    |                UNLOCK();\r\n    0x18367fa00    |                if (*piVar6 == 0) {\r\n    0x18367fa06    |                    (*(code *)0x185f59da0)();\r\n                   |                }\r\n                   |            }\r\n    0x18367f9ee    |            if (*(uint64_t *)0x191c71040 == (var_38h ^ (uint64_t)auStack_88)) break;\r\n    0x18367fa13    |            func_0x000185f05b40(var_38h ^ (uint64_t)auStack_88);\r\n                   |code_r0x00018367fa1b:\r\n    0x18367fa22    |            func_0x000185f00fe8(0x191dd7a50);\r\n    0x18367fa2e    |            if (*(int32_t *)0x191dd7a50 == -1) {\r\n    0x18367fa4a    |                func_0x000180a1dea0(*(undefined8 *)0x191de73d0, &var_68h, 0x190c0a899);\r\n    0x18367fa52    |                *(int64_t *)0x191dd7a48 = var_68h;\r\n    0x18367fa60    |                func_0x000185f00f7c(0x191dd7a50);\r\n                   |            }\r\n                   |        }\r\n    0x18367f9fc    |        return;\r\n                   |    }\r\n    0x18367f9cf    |    func_0x000183680c30(arg1);\r\n    0x18367f9cf    |    goto code_r0x00018367f9d4;\r\n                   |}\r\n[{\"offset\":6499596080,\"name\":\"fcn.18367f730\",\"size\":833,\"is-pure\":false,\"realsz\":829,\"noreturn\":false,\"stackframe\":136,\"calltype\":\"ms\",\"cost\":262,\"cc\":28,\"loops\":7,\"bits\":64,\"type\":\"fcn\",\"nbbs\":38,\"edges\":58,\"ebbs\":4,\"signature\":\"fcn.18367f730(int64_t arg1, int64_t arg2);\",\"minbound\":6499596080,\"maxbound\":6499596913,\"callrefs\":[{\"from\":6499596181,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6499596186,\"to\":6499596229,\"type\":\"CODE\"},{\"from\":6499596197,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6499596203,\"to\":6499596173,\"type\":\"CODE\"},{\"from\":6499596210,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6499596215,\"to\":6499596385,\"type\":\"CODE\"},{\"from\":6499596223,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6499596236,\"to\":6522894224,\"type\":\"CALL\"},{\"from\":6499596248,\"to\":6522894224,\"type\":\"CALL\"},{\"from\":6499596269,\"to\":6535891568,\"type\":\"CALL\"},{\"from\":6499596316,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6499596525,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6499596602,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6499596705,\"to\":6512942288,\"type\":\"CALL\"},{\"from\":6499596722,\"to\":6531880336,\"type\":\"CALL\"},{\"from\":6499596741,\"to\":6532074304,\"type\":\"CALL\"},{\"from\":6499596746,\"to\":6499596756,\"type\":\"CODE\"},{\"from\":6499596751,\"to\":6499601456,\"type\":\"CALL\"},{\"from\":6499596806,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6499596812,\"to\":6499596764,\"type\":\"CODE\"},{\"from\":6499596822,\"to\":6542089024,\"type\":\"CALL\"},{\"from\":6499596834,\"to\":6542069736,\"type\":\"CALL\"},{\"from\":6499596874,\"to\":6453059232,\"type\":\"CALL\"},{\"from\":6499596896,\"to\":6542069628,\"type\":\"CALL\"},{\"from\":6499596901,\"to\":6499596447,\"type\":\"CODE\"}],\"datarefs\":[{\"from\":6499596098,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6499596152,\"to\":6537934960,\"type\":\"DATA\"},{\"from\":6499596410,\"to\":6742178384,\"type\":\"DATA\"},{\"from\":6499596416,\"to\":6741832416,\"type\":\"DATA\"},{\"from\":6499596447,\"to\":6742178376,\"type\":\"DATA\"},{\"from\":6499596537,\"to\":6496572928,\"type\":\"DATA\"},{\"from\":6499596548,\"to\":6488510160,\"type\":\"DATA\"},{\"from\":6499596559,\"to\":6496570832,\"type\":\"DATA\"},{\"from\":6499596570,\"to\":6499601456,\"type\":\"DATA\"},{\"from\":6499596609,\"to\":6467941616,\"type\":\"DATA\"},{\"from\":6499596620,\"to\":6499609520,\"type\":\"DATA\"},{\"from\":6499596631,\"to\":6511490512,\"type\":\"DATA\"},{\"from\":6499596642,\"to\":6499601856,\"type\":\"DATA\"},{\"from\":6499596677,\"to\":6713531992,\"type\":\"DATA\"},{\"from\":6499596684,\"to\":6723511048,\"type\":\"DATA\"},{\"from\":6499596772,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6499596827,\"to\":6742178384,\"type\":\"DATA\"},{\"from\":6499596839,\"to\":6742178384,\"type\":\"DATA\"},{\"from\":6499596852,\"to\":6742242256,\"type\":\"DATA\"},{\"from\":6499596859,\"to\":6723512473,\"type\":\"DATA\"},{\"from\":6499596882,\"to\":6742178376,\"type\":\"DATA\"},{\"from\":6499596889,\"to\":6742178384,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6499596186,\"to\":6499596229,\"type\":\"CODE\"},{\"from\":6499596203,\"to\":6499596173,\"type\":\"CODE\"},{\"from\":6499596215,\"to\":6499596385,\"type\":\"CODE\"},{\"from\":6499596746,\"to\":6499596756,\"type\":\"CODE\"},{\"from\":6499596812,\"to\":6499596764,\"type\":\"CODE\"},{\"from\":6499596901,\"to\":6499596447,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":6,\"outdegree\":19,\"nlocals\":4,\"nargs\":2,\"stackvars\":[{\"name\":\"var_68h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-104}},{\"name\":\"var_48h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-72}},{\"name\":\"var_40h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-64}},{\"name\":\"var_38h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-56}}],\"regvars\":[{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"confidence":"observed","authority":"shipped-artifact","environment":null,"limitations":["The executable version and supported formats are reported as unknown because no reliable version probe was performed.","A non-zero process exit is preserved as an observed command result.","Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.","When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call."],"relationship_coverage":null,"locations":[{"kind":"artifact-path","path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"}],"evidence_links":[]},"meta":{"command":"execute-rizin-command","duration":"5161ms"}}