{"ok":true,"data":{"evidence_id":"ev_f3bcaa68a32c01fc8934fdad20ee1c35b741b416af17d9d7a1a65a8882464b9e","subject":{"name":"Tabbit.dll","digest":{"sha256":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c"},"local_path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","format":"unknown","architecture":null},"provider":{"id":"rizin","name":"Rizin","version":null},"analysis_profile":null,"predicate_type":"rea.reverse-engineering.command-observation","operation":"execute_rizin_command","parameters":{"path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","command":"e scr.color=0;af @ 0x183683060;pdgo @ 0x183683060;afij @ 0x183683060","provider_executable":"C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe","command_arguments":["-N","-q","-c","e scr.color=0;af @ 0x183683060;pdgo @ 0x183683060;afij @ 0x183683060","C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"]},"raw_result":{"stdout":" |\r\n 0x183683060 |int64_t fcn.183683060(int64_t arg1, int64_t arg2)\r\n |{\r\n | int32_t iVar1;\r\n | undefined8 uVar2;\r\n | code *pcVar3;\r\n | undefined4 uVar4;\r\n | undefined4 uVar5;\r\n | undefined4 uVar6;\r\n | int32_t *piVar7;\r\n | undefined4 *puVar8;\r\n | int64_t iVar9;\r\n | int64_t unaff_GS_OFFSET;\r\n | undefined auStack_88 [32];\r\n | int64_t var_68h;\r\n | int64_t var_48h;\r\n | int64_t var_40h;\r\n | int64_t var_38h;\r\n | \r\n 0x183683079 | var_38h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_88;\r\n 0x183683083 | *(undefined4 *)arg1 = 0;\r\n 0x183683089 | *(undefined8 *)(arg1 + 0x18) = *(undefined8 *)(arg2 + 0x10);\r\n 0x18368308d | uVar2 = *(undefined8 *)(arg2 + 8);\r\n 0x183683090 | *(undefined8 *)(arg1 + 8) = *(undefined8 *)arg2;\r\n 0x183683090 | *(undefined8 *)(arg1 + 0x10) = uVar2;\r\n 0x183683097 | *(undefined8 *)arg2 = 0;\r\n 0x183683097 | *(undefined8 *)(arg2 + 8) = 0;\r\n 0x18368309a | *(undefined8 *)(arg2 + 0x10) = 0;\r\n 0x18368309e | *(undefined4 *)(arg1 + 0x20) = 0;\r\n 0x1836830a1 | *(undefined *)(arg1 + 0x28) = 0;\r\n 0x1836830a4 | *(undefined *)(arg1 + 0xa0) = 0;\r\n 0x1836830aa | *(undefined *)(arg1 + 0xa8) = 0;\r\n 0x1836830b0 | *(undefined *)(arg1 + 0x110) = 0;\r\n 0x1836830b6 | *(undefined8 *)(arg1 + 0x118) = 0;\r\n 0x1836830b6 | *(undefined8 *)(arg1 + 0x120) = 0;\r\n 0x1836830bd | *(undefined8 *)(arg1 + 0x128) = 0;\r\n 0x1836830bd | *(undefined8 *)(arg1 + 0x130) = 0;\r\n 0x1836830c4 | *(undefined8 *)(arg1 + 0x138) = 0;\r\n 0x1836830c4 | *(undefined8 *)(arg1 + 0x140) = 0;\r\n 0x1836830cb | *(undefined8 *)(arg1 + 0x148) = 0;\r\n 0x1836830cb | *(undefined8 *)(arg1 + 0x150) = 0;\r\n 0x1836830d2 | *(undefined8 *)(arg1 + 0x158) = 0;\r\n 0x1836830d2 | *(undefined8 *)(arg1 + 0x160) = 0;\r\n 0x1836830d9 | *(undefined8 *)(arg1 + 0x168) = 0;\r\n 0x1836830d9 | *(undefined8 *)(arg1 + 0x170) = 0;\r\n 0x1836830e0 | *(undefined8 *)(arg1 + 0x178) = 0;\r\n 0x1836830e0 | *(undefined8 *)(arg1 + 0x180) = 0;\r\n 0x1836830e7 | *(undefined8 *)(arg1 + 0x185) = 0;\r\n 0x1836830e7 | *(undefined8 *)(arg1 + 0x18d) = 0;\r\n 0x1836830ee | *(undefined8 *)(arg1 + 0x198) = 0;\r\n 0x1836830ee | *(undefined8 *)(arg1 + 0x1a0) = 0;\r\n 0x1836830f5 | *(undefined8 *)(arg1 + 0x1a8) = 0;\r\n 0x1836830f5 | *(undefined8 *)(arg1 + 0x1b0) = 0;\r\n 0x1836830fc | *(undefined8 *)(arg1 + 0x1b8) = 0;\r\n 0x1836830fc | *(undefined8 *)(arg1 + 0x1c0) = 0;\r\n 0x183683103 | *(undefined8 *)(arg1 + 0x1c8) = 0;\r\n 0x183683103 | *(undefined8 *)(arg1 + 0x1d0) = 0;\r\n 0x18368310a | *(undefined8 *)(arg1 + 0x1d8) = 0;\r\n 0x18368310a | *(undefined8 *)(arg1 + 0x1e0) = 0;\r\n 0x183683111 | *(undefined8 *)(arg1 + 0x200) = 0;\r\n 0x183683118 | *(undefined8 *)(arg1 + 0x1f0) = 0;\r\n 0x183683118 | *(undefined8 *)(arg1 + 0x1f8) = 0;\r\n 0x18368311f | *(undefined4 *)(arg1 + 0x208) = 0xffffffff;\r\n 0x183683129 | *(undefined8 *)(arg1 + 0x210) = 0;\r\n 0x183683129 | *(undefined8 *)(arg1 + 0x218) = 0;\r\n 0x183683130 | *(undefined8 *)(arg1 + 0x220) = 0;\r\n 0x183683130 | *(undefined8 *)(arg1 + 0x228) = 0;\r\n 0x183683137 | *(undefined8 *)(arg1 + 0x230) = 0;\r\n 0x183683137 | *(undefined8 *)(arg1 + 0x238) = 0;\r\n 0x183683145 | *(undefined8 *)(arg1 + 0x1e8) = 0x18feffbd8;\r\n 0x183683153 | *(undefined8 *)(arg1 + 0x240) = 0;\r\n 0x183683153 | *(undefined8 *)(arg1 + 0x248) = 0;\r\n 0x18368315a | *(undefined8 *)(arg1 + 0x250) = 0;\r\n 0x18368315a | *(undefined8 *)(arg1 + 600) = 0;\r\n 0x183683161 | *(int64_t *)(arg1 + 0x260) = arg1 + 0x260;\r\n 0x183683168 | *(int64_t *)(arg1 + 0x268) = arg1 + 0x260;\r\n 0x18368316f | *(undefined8 *)(arg1 + 0x270) = 0;\r\n 0x183683176 | *(undefined4 *)(arg1 + 0x278) = 0;\r\n 0x183683181 | piVar7 = (int32_t *)fcn.185f006b8(8);\r\n 0x183683186 | *piVar7 = 0;\r\n 0x183683188 | *(undefined *)(piVar7 + 1) = 0;\r\n 0x18368318b | *(int32_t **)(arg1 + 0x280) = piVar7;\r\n 0x183683195 | if (piVar7 != (int32_t *)0x0) {\r\n 0x18368319c | LOCK();\r\n 0x18368319c | iVar1 = *piVar7;\r\n 0x18368319c | *piVar7 = *piVar7 + 1;\r\n 0x18368319c | UNLOCK();\r\n 0x1836831a6 | if (iVar1 == 0x7fffffff) {\r\n 0x1836833bf | pcVar3 = (code *)swi(3);\r\n 0x1836833bf | iVar9 = (*pcVar3)();\r\n 0x1836833bf | return iVar9;\r\n | }\r\n | }\r\n 0x1836831ac | *(int64_t *)(arg1 + 0x288) = arg1;\r\n 0x1836831d2 | if (*(int32_t *)(*(int64_t *)(*(int64_t *)(unaff_GS_OFFSET + 0x58) + (uint64_t)*(uint32_t *)0x191d832e0 * 8) + 4) <\r\n 0x1836831d2 | *(int32_t *)0x191dd7a50) goto code_r0x000183683370;\r\n 0x18368333a | while( true ) {\r\n 0x1836831d8 | iVar9 = *(int64_t *)0x191dd7a48;\r\n 0x1836831e2 | if (*(int64_t *)0x191dd7a48 != 0) {\r\n 0x1836831e9 | LOCK();\r\n 0x1836831e9 | piVar7 = (int32_t *)(*(int64_t *)0x191dd7a48 + 8);\r\n 0x1836831e9 | iVar1 = *piVar7;\r\n 0x1836831e9 | *piVar7 = *piVar7 + 1;\r\n 0x1836831e9 | UNLOCK();\r\n 0x1836831f3 | if (iVar1 == 0x7fffffff) {\r\n 0x1836833c5 | pcVar3 = (code *)swi(3);\r\n 0x1836833c5 | iVar9 = (*pcVar3)();\r\n 0x1836833c5 | return iVar9;\r\n | }\r\n | }\r\n 0x1836831f9 | piVar7 = *(int32_t **)(arg1 + 0x280);\r\n 0x183683200 | uVar2 = *(undefined8 *)(arg1 + 0x288);\r\n 0x18368320a | if (piVar7 != (int32_t *)0x0) {\r\n 0x183683211 | LOCK();\r\n 0x183683211 | iVar1 = *piVar7;\r\n 0x183683211 | *piVar7 = *piVar7 + 1;\r\n 0x183683211 | UNLOCK();\r\n 0x18368321b | if (iVar1 == 0x7fffffff) {\r\n 0x1836833c2 | pcVar3 = (code *)swi(3);\r\n 0x1836833c2 | iVar9 = (*pcVar3)();\r\n 0x1836833c2 | return iVar9;\r\n | }\r\n | }\r\n 0x183683226 | var_40h = fcn.185f006b8(0x38);\r\n 0x183683230 | *(undefined4 *)var_40h = 1;\r\n 0x183683239 | *(undefined8 *)(var_40h + 8) = 0x183688510;\r\n 0x183683244 | *(undefined8 *)(var_40h + 0x10) = 0x182beced0;\r\n 0x18368324f | *(undefined8 *)(var_40h + 0x18) = 0x18339cdd0;\r\n 0x18368325a | *(undefined8 *)(var_40h + 0x20) = 0x1836833d0;\r\n 0x18368325e | *(int32_t **)(var_40h + 0x28) = piVar7;\r\n 0x183683262 | *(undefined8 *)(var_40h + 0x30) = uVar2;\r\n 0x183683270 | puVar8 = (undefined4 *)fcn.185f006b8(0x40);\r\n 0x183683278 | *puVar8 = 1;\r\n 0x183683281 | *(undefined8 *)(puVar8 + 2) = 0x1800c1440;\r\n 0x18368328c | *(undefined8 *)(puVar8 + 4) = 0x182c30930;\r\n 0x183683297 | *(undefined8 *)(puVar8 + 6) = 0x1841d75d0;\r\n 0x1836832a2 | *(undefined8 *)(puVar8 + 8) = 0x183694aa0;\r\n 0x1836832ae | if (*(char *)(arg1 + 0x1f) < '\\0') {\r\n 0x1836832a6 | fcn.184c2f840(puVar8 + 10, *(undefined8 *)(arg1 + 8), *(undefined8 *)(arg1 + 0x10));\r\n | } else {\r\n 0x183683354 | *(undefined8 *)(puVar8 + 0xe) = *(undefined8 *)(arg1 + 0x18);\r\n 0x183683358 | uVar4 = *(undefined4 *)(arg1 + 0xc);\r\n 0x183683358 | uVar5 = *(undefined4 *)(arg1 + 0x10);\r\n 0x183683358 | uVar6 = *(undefined4 *)(arg1 + 0x14);\r\n 0x18368335b | puVar8[10] = *(undefined4 *)(arg1 + 8);\r\n 0x18368335b | puVar8[0xb] = uVar4;\r\n 0x18368335b | puVar8[0xc] = uVar5;\r\n 0x18368335b | puVar8[0xd] = uVar6;\r\n | }\r\n 0x1836832e8 | var_48h = (int64_t)puVar8;\r\n 0x1836832da | fcn.184339cd0(&var_68h, 0x190c0a390, 0x190c0a368, 100);\r\n 0x1836832fb | fcn.181f5e730(iVar9, &var_68h, &var_48h, &var_40h);\r\n 0x183683303 | if (iVar9 != 0) {\r\n 0x183683305 | LOCK();\r\n 0x183683305 | piVar7 = (int32_t *)(iVar9 + 8);\r\n 0x183683305 | *piVar7 = *piVar7 + -1;\r\n 0x183683305 | UNLOCK();\r\n 0x183683309 | if (*piVar7 == 0) {\r\n 0x18368330e | fcn.185578b40(iVar9);\r\n | }\r\n | }\r\n 0x183683317 | if (*(char *)(arg2 + 0x17) < '\\0') {\r\n 0x183683319 | fcn.1841dcbe0(*(undefined8 *)arg2, *(int64_t *)(arg2 + 0x10) * 2);\r\n | }\r\n 0x18368333a | if (*(uint64_t *)0x191c71040 == (var_38h ^ (uint64_t)auStack_88)) break;\r\n 0x183683368 | fcn.185f05b40(var_38h ^ (uint64_t)auStack_88);\r\n |code_r0x000183683370:\r\n 0x183683377 | fcn.185f00fe8(0x191dd7a50);\r\n 0x183683383 | if (*(int32_t *)0x191dd7a50 == -1) {\r\n 0x18368339f | fcn.180a1dea0(*(undefined8 *)0x191de73d0, &var_68h, 0x190c0a899);\r\n 0x1836833a7 | *(int64_t *)0x191dd7a48 = var_68h;\r\n 0x1836833b5 | fcn.185f00f7c(0x191dd7a50);\r\n | }\r\n | }\r\n 0x18368334b | return arg1;\r\n |}\r\n[{\"offset\":6499610720,\"name\":\"fcn.183683060\",\"size\":870,\"is-pure\":false,\"realsz\":866,\"noreturn\":false,\"stackframe\":136,\"calltype\":\"ms\",\"cost\":227,\"cc\":17,\"loops\":3,\"bits\":64,\"type\":\"fcn\",\"nbbs\":23,\"edges\":32,\"ebbs\":4,\"signature\":\"fcn.183683060(int64_t arg1, int64_t arg2);\",\"minbound\":6499610720,\"maxbound\":6499611590,\"callrefs\":[{\"from\":6499611009,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6499611174,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6499611248,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6499611327,\"to\":6522337344,\"type\":\"CALL\"},{\"from\":6499611368,\"to\":6512942288,\"type\":\"CALL\"},{\"from\":6499611387,\"to\":6475343664,\"type\":\"CALL\"},{\"from\":6499611406,\"to\":6532074304,\"type\":\"CALL\"},{\"from\":6499611427,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6499611486,\"to\":6499611332,\"type\":\"CODE\"},{\"from\":6499611499,\"to\":6542089024,\"type\":\"CALL\"},{\"from\":6499611511,\"to\":6542069736,\"type\":\"CALL\"},{\"from\":6499611551,\"to\":6453059232,\"type\":\"CALL\"},{\"from\":6499611573,\"to\":6542069628,\"type\":\"CALL\"},{\"from\":6499611578,\"to\":6499611096,\"type\":\"CODE\"}],\"datarefs\":[{\"from\":6499610738,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6499610942,\"to\":6709836760,\"type\":\"DATA\"},{\"from\":6499611059,\"to\":6742178384,\"type\":\"DATA\"},{\"from\":6499611065,\"to\":6741832416,\"type\":\"DATA\"},{\"from\":6499611096,\"to\":6742178376,\"type\":\"DATA\"},{\"from\":6499611186,\"to\":6499632400,\"type\":\"DATA\"},{\"from\":6499611197,\"to\":6488510160,\"type\":\"DATA\"},{\"from\":6499611208,\"to\":6496570832,\"type\":\"DATA\"},{\"from\":6499611219,\"to\":6499611600,\"type\":\"DATA\"},{\"from\":6499611258,\"to\":6443242560,\"type\":\"DATA\"},{\"from\":6499611269,\"to\":6488787248,\"type\":\"DATA\"},{\"from\":6499611280,\"to\":6511490512,\"type\":\"DATA\"},{\"from\":6499611291,\"to\":6499682976,\"type\":\"DATA\"},{\"from\":6499611340,\"to\":6723511184,\"type\":\"DATA\"},{\"from\":6499611347,\"to\":6723511144,\"type\":\"DATA\"},{\"from\":6499611440,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6499611504,\"to\":6742178384,\"type\":\"DATA\"},{\"from\":6499611516,\"to\":6742178384,\"type\":\"DATA\"},{\"from\":6499611529,\"to\":6742242256,\"type\":\"DATA\"},{\"from\":6499611536,\"to\":6723512473,\"type\":\"DATA\"},{\"from\":6499611559,\"to\":6742178376,\"type\":\"DATA\"},{\"from\":6499611566,\"to\":6742178384,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6499611486,\"to\":6499611332,\"type\":\"CODE\"},{\"from\":6499611578,\"to\":6499611096,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":2,\"outdegree\":12,\"nlocals\":4,\"nargs\":2,\"stackvars\":[{\"name\":\"var_68h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-104}},{\"name\":\"var_48h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-72}},{\"name\":\"var_40h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-64}},{\"name\":\"var_38h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-56}}],\"regvars\":[{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"normalized_result":{"stdout":" |\r\n 0x183683060 |int64_t fcn.183683060(int64_t arg1, int64_t arg2)\r\n |{\r\n | int32_t iVar1;\r\n | undefined8 uVar2;\r\n | code *pcVar3;\r\n | undefined4 uVar4;\r\n | undefined4 uVar5;\r\n | undefined4 uVar6;\r\n | int32_t *piVar7;\r\n | undefined4 *puVar8;\r\n | int64_t iVar9;\r\n | int64_t unaff_GS_OFFSET;\r\n | undefined auStack_88 [32];\r\n | int64_t var_68h;\r\n | int64_t var_48h;\r\n | int64_t var_40h;\r\n | int64_t var_38h;\r\n | \r\n 0x183683079 | var_38h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_88;\r\n 0x183683083 | *(undefined4 *)arg1 = 0;\r\n 0x183683089 | *(undefined8 *)(arg1 + 0x18) = *(undefined8 *)(arg2 + 0x10);\r\n 0x18368308d | uVar2 = *(undefined8 *)(arg2 + 8);\r\n 0x183683090 | *(undefined8 *)(arg1 + 8) = *(undefined8 *)arg2;\r\n 0x183683090 | *(undefined8 *)(arg1 + 0x10) = uVar2;\r\n 0x183683097 | *(undefined8 *)arg2 = 0;\r\n 0x183683097 | *(undefined8 *)(arg2 + 8) = 0;\r\n 0x18368309a | *(undefined8 *)(arg2 + 0x10) = 0;\r\n 0x18368309e | *(undefined4 *)(arg1 + 0x20) = 0;\r\n 0x1836830a1 | *(undefined *)(arg1 + 0x28) = 0;\r\n 0x1836830a4 | *(undefined *)(arg1 + 0xa0) = 0;\r\n 0x1836830aa | *(undefined *)(arg1 + 0xa8) = 0;\r\n 0x1836830b0 | *(undefined *)(arg1 + 0x110) = 0;\r\n 0x1836830b6 | *(undefined8 *)(arg1 + 0x118) = 0;\r\n 0x1836830b6 | *(undefined8 *)(arg1 + 0x120) = 0;\r\n 0x1836830bd | *(undefined8 *)(arg1 + 0x128) = 0;\r\n 0x1836830bd | *(undefined8 *)(arg1 + 0x130) = 0;\r\n 0x1836830c4 | *(undefined8 *)(arg1 + 0x138) = 0;\r\n 0x1836830c4 | *(undefined8 *)(arg1 + 0x140) = 0;\r\n 0x1836830cb | *(undefined8 *)(arg1 + 0x148) = 0;\r\n 0x1836830cb | *(undefined8 *)(arg1 + 0x150) = 0;\r\n 0x1836830d2 | *(undefined8 *)(arg1 + 0x158) = 0;\r\n 0x1836830d2 | *(undefined8 *)(arg1 + 0x160) = 0;\r\n 0x1836830d9 | *(undefined8 *)(arg1 + 0x168) = 0;\r\n 0x1836830d9 | *(undefined8 *)(arg1 + 0x170) = 0;\r\n 0x1836830e0 | *(undefined8 *)(arg1 + 0x178) = 0;\r\n 0x1836830e0 | *(undefined8 *)(arg1 + 0x180) = 0;\r\n 0x1836830e7 | *(undefined8 *)(arg1 + 0x185) = 0;\r\n 0x1836830e7 | *(undefined8 *)(arg1 + 0x18d) = 0;\r\n 0x1836830ee | *(undefined8 *)(arg1 + 0x198) = 0;\r\n 0x1836830ee | *(undefined8 *)(arg1 + 0x1a0) = 0;\r\n 0x1836830f5 | *(undefined8 *)(arg1 + 0x1a8) = 0;\r\n 0x1836830f5 | *(undefined8 *)(arg1 + 0x1b0) = 0;\r\n 0x1836830fc | *(undefined8 *)(arg1 + 0x1b8) = 0;\r\n 0x1836830fc | *(undefined8 *)(arg1 + 0x1c0) = 0;\r\n 0x183683103 | *(undefined8 *)(arg1 + 0x1c8) = 0;\r\n 0x183683103 | *(undefined8 *)(arg1 + 0x1d0) = 0;\r\n 0x18368310a | *(undefined8 *)(arg1 + 0x1d8) = 0;\r\n 0x18368310a | *(undefined8 *)(arg1 + 0x1e0) = 0;\r\n 0x183683111 | *(undefined8 *)(arg1 + 0x200) = 0;\r\n 0x183683118 | *(undefined8 *)(arg1 + 0x1f0) = 0;\r\n 0x183683118 | *(undefined8 *)(arg1 + 0x1f8) = 0;\r\n 0x18368311f | *(undefined4 *)(arg1 + 0x208) = 0xffffffff;\r\n 0x183683129 | *(undefined8 *)(arg1 + 0x210) = 0;\r\n 0x183683129 | *(undefined8 *)(arg1 + 0x218) = 0;\r\n 0x183683130 | *(undefined8 *)(arg1 + 0x220) = 0;\r\n 0x183683130 | *(undefined8 *)(arg1 + 0x228) = 0;\r\n 0x183683137 | *(undefined8 *)(arg1 + 0x230) = 0;\r\n 0x183683137 | *(undefined8 *)(arg1 + 0x238) = 0;\r\n 0x183683145 | *(undefined8 *)(arg1 + 0x1e8) = 0x18feffbd8;\r\n 0x183683153 | *(undefined8 *)(arg1 + 0x240) = 0;\r\n 0x183683153 | *(undefined8 *)(arg1 + 0x248) = 0;\r\n 0x18368315a | *(undefined8 *)(arg1 + 0x250) = 0;\r\n 0x18368315a | *(undefined8 *)(arg1 + 600) = 0;\r\n 0x183683161 | *(int64_t *)(arg1 + 0x260) = arg1 + 0x260;\r\n 0x183683168 | *(int64_t *)(arg1 + 0x268) = arg1 + 0x260;\r\n 0x18368316f | *(undefined8 *)(arg1 + 0x270) = 0;\r\n 0x183683176 | *(undefined4 *)(arg1 + 0x278) = 0;\r\n 0x183683181 | piVar7 = (int32_t *)fcn.185f006b8(8);\r\n 0x183683186 | *piVar7 = 0;\r\n 0x183683188 | *(undefined *)(piVar7 + 1) = 0;\r\n 0x18368318b | *(int32_t **)(arg1 + 0x280) = piVar7;\r\n 0x183683195 | if (piVar7 != (int32_t *)0x0) {\r\n 0x18368319c | LOCK();\r\n 0x18368319c | iVar1 = *piVar7;\r\n 0x18368319c | *piVar7 = *piVar7 + 1;\r\n 0x18368319c | UNLOCK();\r\n 0x1836831a6 | if (iVar1 == 0x7fffffff) {\r\n 0x1836833bf | pcVar3 = (code *)swi(3);\r\n 0x1836833bf | iVar9 = (*pcVar3)();\r\n 0x1836833bf | return iVar9;\r\n | }\r\n | }\r\n 0x1836831ac | *(int64_t *)(arg1 + 0x288) = arg1;\r\n 0x1836831d2 | if (*(int32_t *)(*(int64_t *)(*(int64_t *)(unaff_GS_OFFSET + 0x58) + (uint64_t)*(uint32_t *)0x191d832e0 * 8) + 4) <\r\n 0x1836831d2 | *(int32_t *)0x191dd7a50) goto code_r0x000183683370;\r\n 0x18368333a | while( true ) {\r\n 0x1836831d8 | iVar9 = *(int64_t *)0x191dd7a48;\r\n 0x1836831e2 | if (*(int64_t *)0x191dd7a48 != 0) {\r\n 0x1836831e9 | LOCK();\r\n 0x1836831e9 | piVar7 = (int32_t *)(*(int64_t *)0x191dd7a48 + 8);\r\n 0x1836831e9 | iVar1 = *piVar7;\r\n 0x1836831e9 | *piVar7 = *piVar7 + 1;\r\n 0x1836831e9 | UNLOCK();\r\n 0x1836831f3 | if (iVar1 == 0x7fffffff) {\r\n 0x1836833c5 | pcVar3 = (code *)swi(3);\r\n 0x1836833c5 | iVar9 = (*pcVar3)();\r\n 0x1836833c5 | return iVar9;\r\n | }\r\n | }\r\n 0x1836831f9 | piVar7 = *(int32_t **)(arg1 + 0x280);\r\n 0x183683200 | uVar2 = *(undefined8 *)(arg1 + 0x288);\r\n 0x18368320a | if (piVar7 != (int32_t *)0x0) {\r\n 0x183683211 | LOCK();\r\n 0x183683211 | iVar1 = *piVar7;\r\n 0x183683211 | *piVar7 = *piVar7 + 1;\r\n 0x183683211 | UNLOCK();\r\n 0x18368321b | if (iVar1 == 0x7fffffff) {\r\n 0x1836833c2 | pcVar3 = (code *)swi(3);\r\n 0x1836833c2 | iVar9 = (*pcVar3)();\r\n 0x1836833c2 | return iVar9;\r\n | }\r\n | }\r\n 0x183683226 | var_40h = fcn.185f006b8(0x38);\r\n 0x183683230 | *(undefined4 *)var_40h = 1;\r\n 0x183683239 | *(undefined8 *)(var_40h + 8) = 0x183688510;\r\n 0x183683244 | *(undefined8 *)(var_40h + 0x10) = 0x182beced0;\r\n 0x18368324f | *(undefined8 *)(var_40h + 0x18) = 0x18339cdd0;\r\n 0x18368325a | *(undefined8 *)(var_40h + 0x20) = 0x1836833d0;\r\n 0x18368325e | *(int32_t **)(var_40h + 0x28) = piVar7;\r\n 0x183683262 | *(undefined8 *)(var_40h + 0x30) = uVar2;\r\n 0x183683270 | puVar8 = (undefined4 *)fcn.185f006b8(0x40);\r\n 0x183683278 | *puVar8 = 1;\r\n 0x183683281 | *(undefined8 *)(puVar8 + 2) = 0x1800c1440;\r\n 0x18368328c | *(undefined8 *)(puVar8 + 4) = 0x182c30930;\r\n 0x183683297 | *(undefined8 *)(puVar8 + 6) = 0x1841d75d0;\r\n 0x1836832a2 | *(undefined8 *)(puVar8 + 8) = 0x183694aa0;\r\n 0x1836832ae | if (*(char *)(arg1 + 0x1f) < '\\0') {\r\n 0x1836832a6 | fcn.184c2f840(puVar8 + 10, *(undefined8 *)(arg1 + 8), *(undefined8 *)(arg1 + 0x10));\r\n | } else {\r\n 0x183683354 | *(undefined8 *)(puVar8 + 0xe) = *(undefined8 *)(arg1 + 0x18);\r\n 0x183683358 | uVar4 = *(undefined4 *)(arg1 + 0xc);\r\n 0x183683358 | uVar5 = *(undefined4 *)(arg1 + 0x10);\r\n 0x183683358 | uVar6 = *(undefined4 *)(arg1 + 0x14);\r\n 0x18368335b | puVar8[10] = *(undefined4 *)(arg1 + 8);\r\n 0x18368335b | puVar8[0xb] = uVar4;\r\n 0x18368335b | puVar8[0xc] = uVar5;\r\n 0x18368335b | puVar8[0xd] = uVar6;\r\n | }\r\n 0x1836832e8 | var_48h = (int64_t)puVar8;\r\n 0x1836832da | fcn.184339cd0(&var_68h, 0x190c0a390, 0x190c0a368, 100);\r\n 0x1836832fb | fcn.181f5e730(iVar9, &var_68h, &var_48h, &var_40h);\r\n 0x183683303 | if (iVar9 != 0) {\r\n 0x183683305 | LOCK();\r\n 0x183683305 | piVar7 = (int32_t *)(iVar9 + 8);\r\n 0x183683305 | *piVar7 = *piVar7 + -1;\r\n 0x183683305 | UNLOCK();\r\n 0x183683309 | if (*piVar7 == 0) {\r\n 0x18368330e | fcn.185578b40(iVar9);\r\n | }\r\n | }\r\n 0x183683317 | if (*(char *)(arg2 + 0x17) < '\\0') {\r\n 0x183683319 | fcn.1841dcbe0(*(undefined8 *)arg2, *(int64_t *)(arg2 + 0x10) * 2);\r\n | }\r\n 0x18368333a | if (*(uint64_t *)0x191c71040 == (var_38h ^ (uint64_t)auStack_88)) break;\r\n 0x183683368 | fcn.185f05b40(var_38h ^ (uint64_t)auStack_88);\r\n |code_r0x000183683370:\r\n 0x183683377 | fcn.185f00fe8(0x191dd7a50);\r\n 0x183683383 | if (*(int32_t *)0x191dd7a50 == -1) {\r\n 0x18368339f | fcn.180a1dea0(*(undefined8 *)0x191de73d0, &var_68h, 0x190c0a899);\r\n 0x1836833a7 | *(int64_t *)0x191dd7a48 = var_68h;\r\n 0x1836833b5 | fcn.185f00f7c(0x191dd7a50);\r\n | }\r\n | }\r\n 0x18368334b | return arg1;\r\n |}\r\n[{\"offset\":6499610720,\"name\":\"fcn.183683060\",\"size\":870,\"is-pure\":false,\"realsz\":866,\"noreturn\":false,\"stackframe\":136,\"calltype\":\"ms\",\"cost\":227,\"cc\":17,\"loops\":3,\"bits\":64,\"type\":\"fcn\",\"nbbs\":23,\"edges\":32,\"ebbs\":4,\"signature\":\"fcn.183683060(int64_t arg1, int64_t arg2);\",\"minbound\":6499610720,\"maxbound\":6499611590,\"callrefs\":[{\"from\":6499611009,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6499611174,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6499611248,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6499611327,\"to\":6522337344,\"type\":\"CALL\"},{\"from\":6499611368,\"to\":6512942288,\"type\":\"CALL\"},{\"from\":6499611387,\"to\":6475343664,\"type\":\"CALL\"},{\"from\":6499611406,\"to\":6532074304,\"type\":\"CALL\"},{\"from\":6499611427,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6499611486,\"to\":6499611332,\"type\":\"CODE\"},{\"from\":6499611499,\"to\":6542089024,\"type\":\"CALL\"},{\"from\":6499611511,\"to\":6542069736,\"type\":\"CALL\"},{\"from\":6499611551,\"to\":6453059232,\"type\":\"CALL\"},{\"from\":6499611573,\"to\":6542069628,\"type\":\"CALL\"},{\"from\":6499611578,\"to\":6499611096,\"type\":\"CODE\"}],\"datarefs\":[{\"from\":6499610738,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6499610942,\"to\":6709836760,\"type\":\"DATA\"},{\"from\":6499611059,\"to\":6742178384,\"type\":\"DATA\"},{\"from\":6499611065,\"to\":6741832416,\"type\":\"DATA\"},{\"from\":6499611096,\"to\":6742178376,\"type\":\"DATA\"},{\"from\":6499611186,\"to\":6499632400,\"type\":\"DATA\"},{\"from\":6499611197,\"to\":6488510160,\"type\":\"DATA\"},{\"from\":6499611208,\"to\":6496570832,\"type\":\"DATA\"},{\"from\":6499611219,\"to\":6499611600,\"type\":\"DATA\"},{\"from\":6499611258,\"to\":6443242560,\"type\":\"DATA\"},{\"from\":6499611269,\"to\":6488787248,\"type\":\"DATA\"},{\"from\":6499611280,\"to\":6511490512,\"type\":\"DATA\"},{\"from\":6499611291,\"to\":6499682976,\"type\":\"DATA\"},{\"from\":6499611340,\"to\":6723511184,\"type\":\"DATA\"},{\"from\":6499611347,\"to\":6723511144,\"type\":\"DATA\"},{\"from\":6499611440,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6499611504,\"to\":6742178384,\"type\":\"DATA\"},{\"from\":6499611516,\"to\":6742178384,\"type\":\"DATA\"},{\"from\":6499611529,\"to\":6742242256,\"type\":\"DATA\"},{\"from\":6499611536,\"to\":6723512473,\"type\":\"DATA\"},{\"from\":6499611559,\"to\":6742178376,\"type\":\"DATA\"},{\"from\":6499611566,\"to\":6742178384,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6499611486,\"to\":6499611332,\"type\":\"CODE\"},{\"from\":6499611578,\"to\":6499611096,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":2,\"outdegree\":12,\"nlocals\":4,\"nargs\":2,\"stackvars\":[{\"name\":\"var_68h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-104}},{\"name\":\"var_48h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-72}},{\"name\":\"var_40h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-64}},{\"name\":\"var_38h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-56}}],\"regvars\":[{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"confidence":"observed","authority":"shipped-artifact","environment":null,"limitations":["The executable version and supported formats are reported as unknown because no reliable version probe was performed.","A non-zero process exit is preserved as an observed command result.","Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.","When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call."],"relationship_coverage":null,"locations":[{"kind":"artifact-path","path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"}],"evidence_links":[]},"meta":{"command":"execute-rizin-command","duration":"5115ms"}}