{"ok":true,"data":{"evidence_id":"ev_dada837f0ec915ec1a6b8f61c7472a60c0fbfc448a5ae61e956a8c1e6abe0d02","subject":{"name":"Tabbit.dll","digest":{"sha256":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c"},"local_path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","format":"unknown","architecture":null},"provider":{"id":"rizin","name":"Rizin","version":null},"analysis_profile":null,"predicate_type":"rea.reverse-engineering.command-observation","operation":"execute_rizin_command","parameters":{"path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","command":"e scr.color=0;af @ 0x183686240;pdgo @ 0x183686240;afij @ 0x183686240","provider_executable":"C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe","command_arguments":["-N","-q","-c","e scr.color=0;af @ 0x183686240;pdgo @ 0x183686240;afij @ 0x183686240","C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"]},"raw_result":{"stdout":" |\r\n 0x183686240 |void fcn.183686240(int64_t arg1)\r\n |{\r\n | int32_t iVar1;\r\n | int64_t iVar2;\r\n | int32_t *piVar3;\r\n | code *pcVar4;\r\n | undefined8 *puVar5;\r\n | int64_t *piVar6;\r\n | int64_t iVar7;\r\n | undefined8 *puVar8;\r\n | int64_t iVar9;\r\n | int64_t *piVar10;\r\n | int64_t unaff_GS_OFFSET;\r\n | undefined auStack_88 [40];\r\n | int64_t var_60h;\r\n | int64_t var_40h;\r\n | int64_t var_38h;\r\n | int64_t var_30h;\r\n | int64_t var_28h;\r\n | \r\n 0x183686253 | var_28h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_88;\r\n 0x18368625b | *(undefined4 *)(arg1 + 0x20) = 5;\r\n 0x183686262 | iVar2 = *(int64_t *)(arg1 + 0x1b0);\r\n 0x183686270 | iVar7 = *(int64_t *)(arg1 + 0x1b8) * 0x98;\r\n 0x18368627d | iVar9 = iVar2;\r\n 0x18368627d | if (iVar7 != 0) {\r\n 0x18368628c | iVar9 = *(int64_t *)(arg1 + 0x1b8) * -0x98;\r\n 0x183686293 | puVar5 = (undefined8 *)(iVar7 + iVar2);\r\n | do {\r\n 0x183686289 | puVar8 = puVar5 + -0x13;\r\n 0x1836862cb | if (puVar8 == (undefined8 *)0x0) {\r\n 0x183686496 | // WARNING: Does not return\r\n 0x183686496 | pcVar4 = (code *)invalidInstructionException();\r\n 0x183686496 | (*pcVar4)();\r\n | }\r\n 0x1836862d1 | func_0x0001841c04a0(puVar5 + -0xf);\r\n 0x1836862da | piVar3 = (int32_t *)puVar5[-0x11];\r\n 0x1836862e1 | if (piVar3 != (int32_t *)0x0) {\r\n 0x1836862e3 | LOCK();\r\n 0x1836862e3 | *piVar3 = *piVar3 + -1;\r\n 0x1836862e3 | UNLOCK();\r\n 0x1836862e6 | if (*piVar3 == 0) {\r\n 0x1836862ab | func_0x0001841dcbe0(piVar3, 8);\r\n | }\r\n | }\r\n 0x1836862b0 | piVar3 = (int32_t *)*puVar8;\r\n 0x1836862b6 | if (piVar3 != (int32_t *)0x0) {\r\n 0x183686295 | LOCK();\r\n 0x183686295 | *piVar3 = *piVar3 + -1;\r\n 0x183686295 | UNLOCK();\r\n 0x183686298 | if (*piVar3 == 0) {\r\n 0x18368629f | func_0x0001841dcbe0(piVar3, 8);\r\n | }\r\n | }\r\n 0x1836862bf | iVar9 = iVar9 + 0x98;\r\n 0x1836862c6 | puVar5 = puVar8;\r\n 0x1836862c6 | } while (iVar9 != 0);\r\n 0x1836862ea | iVar9 = *(int64_t *)(arg1 + 0x1b0);\r\n | }\r\n 0x183686306 | *(int64_t *)(arg1 + 0x1b8) = (iVar2 - iVar9 >> 3) * -0x79435e50d79435e5;\r\n 0x18368630d | func_0x000184cb7790(arg1 + 0x1e8);\r\n 0x183686319 | *(undefined *)(arg1 + 400) = 0;\r\n 0x183686327 | if (*(char *)(arg1 + 0xa0) == '\\x01') {\r\n 0x183686329 | func_0x0001841c04a0(arg1 + 0x28);\r\n 0x183686332 | *(undefined *)(arg1 + 0xa0) = 0;\r\n | }\r\n 0x183686340 | if ((arg1 != 0) && (*(int32_t *)arg1 = *(int32_t *)arg1 + 1, *(int32_t *)arg1 == 0)) {\r\n 0x1836864f4 | pcVar4 = (code *)swi(3);\r\n 0x1836864f4 | (*pcVar4)();\r\n 0x1836864f4 | return;\r\n | }\r\n 0x18368634b | piVar6 = (int64_t *)func_0x000185f006b8(0x30);\r\n 0x183686353 | *(undefined4 *)piVar6 = 1;\r\n 0x183686360 | piVar6[1] = 0x180cde720;\r\n 0x18368636b | piVar6[2] = 0x183688cf0;\r\n 0x18368636f | piVar10 = (int64_t *)0x1841d75d0;\r\n 0x183686376 | piVar6[3] = 0x1841d75d0;\r\n 0x183686381 | piVar6[4] = 0x1836861c0;\r\n 0x183686385 | piVar6[5] = arg1;\r\n 0x183686393 | if (*(int64_t *)(arg1 + 0x1e0) == 0) {\r\n 0x1836863e3 | if (*(int32_t *)\r\n 0x1836863d9 | (*(int64_t *)(*(int64_t *)(unaff_GS_OFFSET + 0x58) + (uint64_t)*(uint32_t *)0x191d832e0 * 8) + 4) <\r\n 0x1836863e3 | *(int32_t *)0x191dd7a50) goto code_r0x0001836864a5;\r\n 0x1836863e3 | goto code_r0x0001836863e9;\r\n | }\r\n 0x18368639d | var_30h = (int64_t)piVar6;\r\n 0x18368639d | func_0x00018367f730();\r\n | do {\r\n 0x1836863b4 | if (*(uint64_t *)0x191c71040 == (var_28h ^ (uint64_t)auStack_88)) {\r\n 0x1836863c3 | return;\r\n | }\r\n 0x18368649d | func_0x000185f05b40(var_28h ^ (uint64_t)auStack_88);\r\n |code_r0x0001836864a5:\r\n 0x1836864ac | func_0x000185f00fe8(0x191dd7a50);\r\n 0x1836864b8 | if (*(int32_t *)0x191dd7a50 == -1) {\r\n 0x1836864d4 | func_0x000180a1dea0(*(undefined8 *)0x191de73d0, &var_60h, 0x190c0a899);\r\n 0x1836864dc | *(int64_t *)0x191dd7a48 = var_60h;\r\n 0x1836864ea | func_0x000185f00f7c(0x191dd7a50);\r\n | }\r\n |code_r0x0001836863e9:\r\n 0x1836863e9 | iVar2 = *(int64_t *)0x191dd7a48;\r\n 0x1836863f3 | if (*(int64_t *)0x191dd7a48 != 0) {\r\n 0x1836863fa | LOCK();\r\n 0x1836863fa | piVar3 = (int32_t *)(*(int64_t *)0x191dd7a48 + 8);\r\n 0x1836863fa | iVar1 = *piVar3;\r\n 0x1836863fa | *piVar3 = *piVar3 + 1;\r\n 0x1836863fa | UNLOCK();\r\n 0x183686404 | if (iVar1 == 0x7fffffff) {\r\n 0x1836864f7 | pcVar4 = (code *)swi(3);\r\n 0x1836864f7 | (*pcVar4)();\r\n 0x1836864f7 | return;\r\n | }\r\n | }\r\n 0x183686417 | var_38h = (int64_t)piVar6;\r\n 0x183686417 | var_40h = func_0x000185f006b8(0x28);\r\n 0x18368641c | *(undefined4 *)var_40h = 1;\r\n 0x183686429 | *(undefined8 *)(var_40h + 8) = 0x180369640;\r\n 0x183686434 | *(undefined8 *)(var_40h + 0x10) = 0x180b5d930;\r\n 0x183686438 | *(int64_t **)(var_40h + 0x18) = piVar10;\r\n 0x18368643c | piVar6 = &var_40h;\r\n 0x183686452 | piVar10 = &var_60h;\r\n 0x183686460 | func_0x000184339cd0(piVar10, 0x190c0a3e0, 0x190c0a368, 0xf0);\r\n 0x183686471 | func_0x000185549590(iVar2, piVar10, piVar6, &var_38h);\r\n 0x183686479 | if (iVar2 != 0) {\r\n 0x18368647f | LOCK();\r\n 0x18368647f | piVar3 = (int32_t *)(iVar2 + 8);\r\n 0x18368647f | *piVar3 = *piVar3 + -1;\r\n 0x18368647f | UNLOCK();\r\n 0x183686483 | if (*piVar3 == 0) {\r\n 0x18368648c | func_0x000185578b40(iVar2);\r\n | }\r\n | }\r\n | } while( true );\r\n |}\r\n[{\"offset\":6499623488,\"name\":\"fcn.183686240\",\"size\":696,\"is-pure\":false,\"realsz\":694,\"noreturn\":false,\"stackframe\":136,\"calltype\":\"ms\",\"cost\":210,\"cc\":22,\"loops\":9,\"bits\":64,\"type\":\"fcn\",\"nbbs\":32,\"edges\":46,\"ebbs\":4,\"signature\":\"fcn.183686240(int64_t arg1);\",\"minbound\":6499623488,\"maxbound\":6499624184,\"callrefs\":[{\"from\":6499623571,\"to\":6499623624,\"type\":\"CODE\"},{\"from\":6499623583,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6499623588,\"to\":6499623608,\"type\":\"CODE\"},{\"from\":6499623595,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6499623637,\"to\":6511396000,\"type\":\"CALL\"},{\"from\":6499623656,\"to\":6499623600,\"type\":\"CODE\"},{\"from\":6499623700,\"to\":6522894224,\"type\":\"CALL\"},{\"from\":6499623725,\"to\":6511396000,\"type\":\"CALL\"},{\"from\":6499623755,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6499623837,\"to\":6499596080,\"type\":\"CALL\"},{\"from\":6499623959,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6499624032,\"to\":6512942288,\"type\":\"CALL\"},{\"from\":6499624049,\"to\":6531880336,\"type\":\"CALL\"},{\"from\":6499624076,\"to\":6532074304,\"type\":\"CALL\"},{\"from\":6499624081,\"to\":6499623842,\"type\":\"CODE\"},{\"from\":6499624096,\"to\":6542089024,\"type\":\"CALL\"},{\"from\":6499624108,\"to\":6542069736,\"type\":\"CALL\"},{\"from\":6499624148,\"to\":6453059232,\"type\":\"CALL\"},{\"from\":6499624170,\"to\":6542069628,\"type\":\"CALL\"},{\"from\":6499624175,\"to\":6499623913,\"type\":\"CODE\"}],\"datarefs\":[{\"from\":6499623500,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6499623769,\"to\":6455944992,\"type\":\"DATA\"},{\"from\":6499623780,\"to\":6499634416,\"type\":\"DATA\"},{\"from\":6499623791,\"to\":6511490512,\"type\":\"DATA\"},{\"from\":6499623802,\"to\":6499623360,\"type\":\"DATA\"},{\"from\":6499623850,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6499623876,\"to\":6742178384,\"type\":\"DATA\"},{\"from\":6499623882,\"to\":6741832416,\"type\":\"DATA\"},{\"from\":6499623913,\"to\":6742178376,\"type\":\"DATA\"},{\"from\":6499623970,\"to\":6446028352,\"type\":\"DATA\"},{\"from\":6499623981,\"to\":6454368560,\"type\":\"DATA\"},{\"from\":6499624004,\"to\":6723511264,\"type\":\"DATA\"},{\"from\":6499624011,\"to\":6723511144,\"type\":\"DATA\"},{\"from\":6499624101,\"to\":6742178384,\"type\":\"DATA\"},{\"from\":6499624113,\"to\":6742178384,\"type\":\"DATA\"},{\"from\":6499624126,\"to\":6742242256,\"type\":\"DATA\"},{\"from\":6499624133,\"to\":6723512473,\"type\":\"DATA\"},{\"from\":6499624156,\"to\":6742178376,\"type\":\"DATA\"},{\"from\":6499624163,\"to\":6742178384,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6499623571,\"to\":6499623624,\"type\":\"CODE\"},{\"from\":6499623588,\"to\":6499623608,\"type\":\"CODE\"},{\"from\":6499623656,\"to\":6499623600,\"type\":\"CODE\"},{\"from\":6499624081,\"to\":6499623842,\"type\":\"CODE\"},{\"from\":6499624175,\"to\":6499623913,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":5,\"outdegree\":15,\"nlocals\":5,\"nargs\":1,\"stackvars\":[{\"name\":\"var_60h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-96}},{\"name\":\"var_40h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-64}},{\"name\":\"var_38h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-56}},{\"name\":\"var_30h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-48}},{\"name\":\"var_28h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-40}}],\"regvars\":[{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"normalized_result":{"stdout":" |\r\n 0x183686240 |void fcn.183686240(int64_t arg1)\r\n |{\r\n | int32_t iVar1;\r\n | int64_t iVar2;\r\n | int32_t *piVar3;\r\n | code *pcVar4;\r\n | undefined8 *puVar5;\r\n | int64_t *piVar6;\r\n | int64_t iVar7;\r\n | undefined8 *puVar8;\r\n | int64_t iVar9;\r\n | int64_t *piVar10;\r\n | int64_t unaff_GS_OFFSET;\r\n | undefined auStack_88 [40];\r\n | int64_t var_60h;\r\n | int64_t var_40h;\r\n | int64_t var_38h;\r\n | int64_t var_30h;\r\n | int64_t var_28h;\r\n | \r\n 0x183686253 | var_28h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_88;\r\n 0x18368625b | *(undefined4 *)(arg1 + 0x20) = 5;\r\n 0x183686262 | iVar2 = *(int64_t *)(arg1 + 0x1b0);\r\n 0x183686270 | iVar7 = *(int64_t *)(arg1 + 0x1b8) * 0x98;\r\n 0x18368627d | iVar9 = iVar2;\r\n 0x18368627d | if (iVar7 != 0) {\r\n 0x18368628c | iVar9 = *(int64_t *)(arg1 + 0x1b8) * -0x98;\r\n 0x183686293 | puVar5 = (undefined8 *)(iVar7 + iVar2);\r\n | do {\r\n 0x183686289 | puVar8 = puVar5 + -0x13;\r\n 0x1836862cb | if (puVar8 == (undefined8 *)0x0) {\r\n 0x183686496 | // WARNING: Does not return\r\n 0x183686496 | pcVar4 = (code *)invalidInstructionException();\r\n 0x183686496 | (*pcVar4)();\r\n | }\r\n 0x1836862d1 | func_0x0001841c04a0(puVar5 + -0xf);\r\n 0x1836862da | piVar3 = (int32_t *)puVar5[-0x11];\r\n 0x1836862e1 | if (piVar3 != (int32_t *)0x0) {\r\n 0x1836862e3 | LOCK();\r\n 0x1836862e3 | *piVar3 = *piVar3 + -1;\r\n 0x1836862e3 | UNLOCK();\r\n 0x1836862e6 | if (*piVar3 == 0) {\r\n 0x1836862ab | func_0x0001841dcbe0(piVar3, 8);\r\n | }\r\n | }\r\n 0x1836862b0 | piVar3 = (int32_t *)*puVar8;\r\n 0x1836862b6 | if (piVar3 != (int32_t *)0x0) {\r\n 0x183686295 | LOCK();\r\n 0x183686295 | *piVar3 = *piVar3 + -1;\r\n 0x183686295 | UNLOCK();\r\n 0x183686298 | if (*piVar3 == 0) {\r\n 0x18368629f | func_0x0001841dcbe0(piVar3, 8);\r\n | }\r\n | }\r\n 0x1836862bf | iVar9 = iVar9 + 0x98;\r\n 0x1836862c6 | puVar5 = puVar8;\r\n 0x1836862c6 | } while (iVar9 != 0);\r\n 0x1836862ea | iVar9 = *(int64_t *)(arg1 + 0x1b0);\r\n | }\r\n 0x183686306 | *(int64_t *)(arg1 + 0x1b8) = (iVar2 - iVar9 >> 3) * -0x79435e50d79435e5;\r\n 0x18368630d | func_0x000184cb7790(arg1 + 0x1e8);\r\n 0x183686319 | *(undefined *)(arg1 + 400) = 0;\r\n 0x183686327 | if (*(char *)(arg1 + 0xa0) == '\\x01') {\r\n 0x183686329 | func_0x0001841c04a0(arg1 + 0x28);\r\n 0x183686332 | *(undefined *)(arg1 + 0xa0) = 0;\r\n | }\r\n 0x183686340 | if ((arg1 != 0) && (*(int32_t *)arg1 = *(int32_t *)arg1 + 1, *(int32_t *)arg1 == 0)) {\r\n 0x1836864f4 | pcVar4 = (code *)swi(3);\r\n 0x1836864f4 | (*pcVar4)();\r\n 0x1836864f4 | return;\r\n | }\r\n 0x18368634b | piVar6 = (int64_t *)func_0x000185f006b8(0x30);\r\n 0x183686353 | *(undefined4 *)piVar6 = 1;\r\n 0x183686360 | piVar6[1] = 0x180cde720;\r\n 0x18368636b | piVar6[2] = 0x183688cf0;\r\n 0x18368636f | piVar10 = (int64_t *)0x1841d75d0;\r\n 0x183686376 | piVar6[3] = 0x1841d75d0;\r\n 0x183686381 | piVar6[4] = 0x1836861c0;\r\n 0x183686385 | piVar6[5] = arg1;\r\n 0x183686393 | if (*(int64_t *)(arg1 + 0x1e0) == 0) {\r\n 0x1836863e3 | if (*(int32_t *)\r\n 0x1836863d9 | (*(int64_t *)(*(int64_t *)(unaff_GS_OFFSET + 0x58) + (uint64_t)*(uint32_t *)0x191d832e0 * 8) + 4) <\r\n 0x1836863e3 | *(int32_t *)0x191dd7a50) goto code_r0x0001836864a5;\r\n 0x1836863e3 | goto code_r0x0001836863e9;\r\n | }\r\n 0x18368639d | var_30h = (int64_t)piVar6;\r\n 0x18368639d | func_0x00018367f730();\r\n | do {\r\n 0x1836863b4 | if (*(uint64_t *)0x191c71040 == (var_28h ^ (uint64_t)auStack_88)) {\r\n 0x1836863c3 | return;\r\n | }\r\n 0x18368649d | func_0x000185f05b40(var_28h ^ (uint64_t)auStack_88);\r\n |code_r0x0001836864a5:\r\n 0x1836864ac | func_0x000185f00fe8(0x191dd7a50);\r\n 0x1836864b8 | if (*(int32_t *)0x191dd7a50 == -1) {\r\n 0x1836864d4 | func_0x000180a1dea0(*(undefined8 *)0x191de73d0, &var_60h, 0x190c0a899);\r\n 0x1836864dc | *(int64_t *)0x191dd7a48 = var_60h;\r\n 0x1836864ea | func_0x000185f00f7c(0x191dd7a50);\r\n | }\r\n |code_r0x0001836863e9:\r\n 0x1836863e9 | iVar2 = *(int64_t *)0x191dd7a48;\r\n 0x1836863f3 | if (*(int64_t *)0x191dd7a48 != 0) {\r\n 0x1836863fa | LOCK();\r\n 0x1836863fa | piVar3 = (int32_t *)(*(int64_t *)0x191dd7a48 + 8);\r\n 0x1836863fa | iVar1 = *piVar3;\r\n 0x1836863fa | *piVar3 = *piVar3 + 1;\r\n 0x1836863fa | UNLOCK();\r\n 0x183686404 | if (iVar1 == 0x7fffffff) {\r\n 0x1836864f7 | pcVar4 = (code *)swi(3);\r\n 0x1836864f7 | (*pcVar4)();\r\n 0x1836864f7 | return;\r\n | }\r\n | }\r\n 0x183686417 | var_38h = (int64_t)piVar6;\r\n 0x183686417 | var_40h = func_0x000185f006b8(0x28);\r\n 0x18368641c | *(undefined4 *)var_40h = 1;\r\n 0x183686429 | *(undefined8 *)(var_40h + 8) = 0x180369640;\r\n 0x183686434 | *(undefined8 *)(var_40h + 0x10) = 0x180b5d930;\r\n 0x183686438 | *(int64_t **)(var_40h + 0x18) = piVar10;\r\n 0x18368643c | piVar6 = &var_40h;\r\n 0x183686452 | piVar10 = &var_60h;\r\n 0x183686460 | func_0x000184339cd0(piVar10, 0x190c0a3e0, 0x190c0a368, 0xf0);\r\n 0x183686471 | func_0x000185549590(iVar2, piVar10, piVar6, &var_38h);\r\n 0x183686479 | if (iVar2 != 0) {\r\n 0x18368647f | LOCK();\r\n 0x18368647f | piVar3 = (int32_t *)(iVar2 + 8);\r\n 0x18368647f | *piVar3 = *piVar3 + -1;\r\n 0x18368647f | UNLOCK();\r\n 0x183686483 | if (*piVar3 == 0) {\r\n 0x18368648c | func_0x000185578b40(iVar2);\r\n | }\r\n | }\r\n | } while( true );\r\n |}\r\n[{\"offset\":6499623488,\"name\":\"fcn.183686240\",\"size\":696,\"is-pure\":false,\"realsz\":694,\"noreturn\":false,\"stackframe\":136,\"calltype\":\"ms\",\"cost\":210,\"cc\":22,\"loops\":9,\"bits\":64,\"type\":\"fcn\",\"nbbs\":32,\"edges\":46,\"ebbs\":4,\"signature\":\"fcn.183686240(int64_t arg1);\",\"minbound\":6499623488,\"maxbound\":6499624184,\"callrefs\":[{\"from\":6499623571,\"to\":6499623624,\"type\":\"CODE\"},{\"from\":6499623583,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6499623588,\"to\":6499623608,\"type\":\"CODE\"},{\"from\":6499623595,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6499623637,\"to\":6511396000,\"type\":\"CALL\"},{\"from\":6499623656,\"to\":6499623600,\"type\":\"CODE\"},{\"from\":6499623700,\"to\":6522894224,\"type\":\"CALL\"},{\"from\":6499623725,\"to\":6511396000,\"type\":\"CALL\"},{\"from\":6499623755,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6499623837,\"to\":6499596080,\"type\":\"CALL\"},{\"from\":6499623959,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6499624032,\"to\":6512942288,\"type\":\"CALL\"},{\"from\":6499624049,\"to\":6531880336,\"type\":\"CALL\"},{\"from\":6499624076,\"to\":6532074304,\"type\":\"CALL\"},{\"from\":6499624081,\"to\":6499623842,\"type\":\"CODE\"},{\"from\":6499624096,\"to\":6542089024,\"type\":\"CALL\"},{\"from\":6499624108,\"to\":6542069736,\"type\":\"CALL\"},{\"from\":6499624148,\"to\":6453059232,\"type\":\"CALL\"},{\"from\":6499624170,\"to\":6542069628,\"type\":\"CALL\"},{\"from\":6499624175,\"to\":6499623913,\"type\":\"CODE\"}],\"datarefs\":[{\"from\":6499623500,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6499623769,\"to\":6455944992,\"type\":\"DATA\"},{\"from\":6499623780,\"to\":6499634416,\"type\":\"DATA\"},{\"from\":6499623791,\"to\":6511490512,\"type\":\"DATA\"},{\"from\":6499623802,\"to\":6499623360,\"type\":\"DATA\"},{\"from\":6499623850,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6499623876,\"to\":6742178384,\"type\":\"DATA\"},{\"from\":6499623882,\"to\":6741832416,\"type\":\"DATA\"},{\"from\":6499623913,\"to\":6742178376,\"type\":\"DATA\"},{\"from\":6499623970,\"to\":6446028352,\"type\":\"DATA\"},{\"from\":6499623981,\"to\":6454368560,\"type\":\"DATA\"},{\"from\":6499624004,\"to\":6723511264,\"type\":\"DATA\"},{\"from\":6499624011,\"to\":6723511144,\"type\":\"DATA\"},{\"from\":6499624101,\"to\":6742178384,\"type\":\"DATA\"},{\"from\":6499624113,\"to\":6742178384,\"type\":\"DATA\"},{\"from\":6499624126,\"to\":6742242256,\"type\":\"DATA\"},{\"from\":6499624133,\"to\":6723512473,\"type\":\"DATA\"},{\"from\":6499624156,\"to\":6742178376,\"type\":\"DATA\"},{\"from\":6499624163,\"to\":6742178384,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6499623571,\"to\":6499623624,\"type\":\"CODE\"},{\"from\":6499623588,\"to\":6499623608,\"type\":\"CODE\"},{\"from\":6499623656,\"to\":6499623600,\"type\":\"CODE\"},{\"from\":6499624081,\"to\":6499623842,\"type\":\"CODE\"},{\"from\":6499624175,\"to\":6499623913,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":5,\"outdegree\":15,\"nlocals\":5,\"nargs\":1,\"stackvars\":[{\"name\":\"var_60h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-96}},{\"name\":\"var_40h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-64}},{\"name\":\"var_38h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-56}},{\"name\":\"var_30h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-48}},{\"name\":\"var_28h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-40}}],\"regvars\":[{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"confidence":"observed","authority":"shipped-artifact","environment":null,"limitations":["The executable version and supported formats are reported as unknown because no reliable version probe was performed.","A non-zero process exit is preserved as an observed command result.","Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.","When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call."],"relationship_coverage":null,"locations":[{"kind":"artifact-path","path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"}],"evidence_links":[]},"meta":{"command":"execute-rizin-command","duration":"5025ms"}}