{"ok":true,"data":{"evidence_id":"ev_1580ec490a3ec31834ec419e4408fdbbe6d32a9d37d236f30696409d142ab816","subject":{"name":"Tabbit.dll","digest":{"sha256":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c"},"local_path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","format":"unknown","architecture":null},"provider":{"id":"rizin","name":"Rizin","version":null},"analysis_profile":null,"predicate_type":"rea.reverse-engineering.command-observation","operation":"execute_rizin_command","parameters":{"path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","command":"e scr.color=0;af @ 0x183812280;pdgo @ 0x183812280;afij @ 0x183812280","provider_executable":"C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe","command_arguments":["-N","-q","-c","e scr.color=0;af @ 0x183812280;pdgo @ 0x183812280;afij @ 0x183812280","C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"]},"raw_result":{"stdout":"    0x183812280    |\r\n    0x183812280    |// WARNING: [rz-ghidra] Removing arg arg_bfh because it doesn't fit into ProtoModel\r\n                   |\r\n    0x183812280    |int64_t fcn.183812280(int64_t arg1, int64_t arg2)\r\n                   |{\r\n                   |    int32_t *piVar1;\r\n                   |    int32_t iVar2;\r\n                   |    code *pcVar3;\r\n                   |    undefined8 uVar4;\r\n                   |    int64_t iVar5;\r\n                   |    int64_t *piVar6;\r\n                   |    undefined auStack_178 [32];\r\n                   |    int64_t var_158h;\r\n                   |    int64_t var_150h;\r\n                   |    int64_t var_148h;\r\n                   |    int64_t var_138h;\r\n                   |    undefined4 uStack_130;\r\n                   |    undefined4 uStack_12c;\r\n                   |    int64_t var_128h;\r\n                   |    int64_t var_118h;\r\n                   |    int64_t var_110h;\r\n                   |    int64_t var_108h;\r\n                   |    int64_t var_100h;\r\n                   |    int64_t var_f8h;\r\n                   |    undefined4 uStack_f0;\r\n                   |    undefined4 uStack_ec;\r\n                   |    undefined2 uStack_e8;\r\n                   |    int64_t var_e6h;\r\n                   |    int64_t var_d8h;\r\n                   |    undefined8 uStack_d0;\r\n                   |    int64_t var_c8h;\r\n                   |    double dStack_c0;\r\n                   |    double dStack_b8;\r\n                   |    undefined8 uStack_b0;\r\n                   |    int64_t var_a8h;\r\n                   |    int64_t var_a0h;\r\n                   |    undefined4 uStack_98;\r\n                   |    int64_t var_28h;\r\n                   |    \r\n    0x183812293    |    var_28h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_178;\r\n    0x1838122a2    |    if (*(char *)(arg1 + 0x30) == '\\0') {\r\n                   |code_r0x0001838125cd:\r\n    0x1838125cd    |    // WARNING: Does not return\r\n    0x1838125cd    |        pcVar3 = (code *)invalidInstructionException();\r\n    0x1838125cd    |        (*pcVar3)();\r\n                   |    }\r\n    0x1838122b9    |    dStack_b8 = 0.0;\r\n    0x1838122b9    |    uStack_b0 = 0;\r\n    0x1838122bd    |    var_c8h = 0;\r\n    0x1838122bd    |    dStack_c0 = 0.0;\r\n    0x1838122c1    |    var_d8h = 0;\r\n    0x1838122c1    |    uStack_d0 = 0;\r\n    0x1838122c4    |    var_a8h = 0;\r\n    0x1838122b1    |    func_0x00018391fe10(&var_d8h, arg1 + 0x18);\r\n    0x1838122dc    |    if ((var_a8h & 1U) == 0) {\r\n    0x1838124c9    |        var_e6h._5_1_ = 0x12;\r\n    0x1838124ea    |        if ((int64_t *)0x1905959d0 < &var_e6h && &var_f8h < (int64_t *)0x1905959d1) goto code_r0x0001838125cd;\r\n    0x1838124f7    |        piVar6 = &var_f8h;\r\n    0x1838124ff    |        uStack_e8 = 0x7372;\r\n    0x18381250c    |        var_f8h._0_4_ = 0x61766e49;\r\n    0x18381250c    |        var_f8h._4_4_ = 0x2064696c;\r\n    0x18381250c    |        uStack_f0 = 0x61726170;\r\n    0x18381250c    |        uStack_ec = 0x6574656d;\r\n    0x183812511    |        var_e6h._0_1_ = 0;\r\n                   |code_r0x000183812516:\r\n    0x18381251c    |        func_0x000188ac4940(arg1, arg2, piVar6);\r\n    0x183812538    |        var_a0h = 0x188ac5700;\r\n    0x18381253b    |        uStack_98 = 0;\r\n    0x183812549    |        var_138h = arg1;\r\n    0x183812549    |        uVar4 = func_0x000188ac69e0(0x1861e7020);\r\n    0x18381254e    |        *(undefined8 *)(arg2 + 8) = uVar4;\r\n    0x183812552    |        *(undefined *)(arg2 + 0x10) = 1;\r\n                   |    } else {\r\n    0x1838122e2    |        iVar5 = *(int64_t *)(arg1 + 0x1d0);\r\n    0x1838122ec    |        if (iVar5 == 0) {\r\n    0x1838122ee    |            iVar5 = *(int64_t *)(arg1 + 0x1c8);\r\n                   |        }\r\n    0x1838122f5    |        uVar4 = func_0x00018382d4f0();\r\n    0x183812303    |        iVar5 = func_0x000184300b20(uVar4, iVar5, 1);\r\n    0x18381230b    |        if (iVar5 == 0) {\r\n    0x183812560    |            var_110h = func_0x000185f006b8(0x20);\r\n    0x18381256a    |            var_108h = 0x1f;\r\n    0x183812581    |            var_100h = -0x7fffffffffffffe0;\r\n    0x1838125a6    |            if (((undefined4 *)(var_110h + 0x1f) < (uint64_t)var_110h) ||\r\n    0x1838125a0    |               ((undefined4 *)0x190c236d0 < (undefined4 *)(var_110h + 0x1f) &&\r\n    0x183812599    |                (uint64_t)var_110h < (undefined4 *)0x190c236d1)) goto code_r0x0001838125cd;\r\n    0x1838125af    |            *(undefined8 *)(var_110h + 0xf) = 0x6120746f6e206563;\r\n    0x1838125af    |            *(undefined8 *)(var_110h + 0x17) = 0x656c62616c696176;\r\n    0x1838125bb    |            *(undefined4 *)var_110h = 0x4c626154;\r\n    0x1838125bb    |            *(undefined4 *)(var_110h + 4) = 0x6c61636f;\r\n    0x1838125bb    |            *(undefined4 *)(var_110h + 8) = 0x65535346;\r\n    0x1838125bb    |            *(undefined4 *)(var_110h + 0xc) = 0x63697672;\r\n    0x1838125bf    |            *(undefined *)(var_110h + 0x1f) = 0;\r\n    0x1838125c3    |            piVar6 = &var_110h;\r\n    0x1838125c8    |            goto code_r0x000183812516;\r\n                   |        }\r\n    0x183812317    |        if (arg1 != 0) {\r\n    0x18381231e    |            LOCK();\r\n    0x18381231e    |            piVar1 = (int32_t *)(arg1 + 8);\r\n    0x18381231e    |            iVar2 = *piVar1;\r\n    0x18381231e    |            *piVar1 = *piVar1 + 1;\r\n    0x18381231e    |            UNLOCK();\r\n    0x183812328    |            if (iVar2 == 0x7fffffff) goto code_r0x0001838125df;\r\n                   |        }\r\n    0x183812333    |        var_118h = func_0x000185f006b8(0x38);\r\n    0x183812338    |        *(undefined4 *)var_118h = 1;\r\n    0x183812345    |        *(undefined8 *)(var_118h + 8) = 0x1838148b0;\r\n    0x183812350    |        *(undefined8 *)(var_118h + 0x10) = 0x18333c920;\r\n    0x18381235b    |        *(undefined8 *)(var_118h + 0x18) = 0x1841d75d0;\r\n    0x183812366    |        *(undefined8 *)(var_118h + 0x20) = 0x1838125f0;\r\n    0x18381236a    |        *(undefined4 *)(var_118h + 0x28) = 0;\r\n    0x183812371    |        *(int64_t *)(var_118h + 0x30) = arg1;\r\n    0x18381237a    |        func_0x00018556a010(arg1 + 0xc0, &var_a0h);\r\n    0x183812397    |        piVar6 = (int64_t *)func_0x000184c155e0(&var_a0h);\r\n    0x1838123a0    |        if (*(char *)((int64_t)piVar6 + 0x17) < '\\0') {\r\n    0x1838124b2    |            func_0x0001841dd0f0(&var_138h, *piVar6, piVar6[1]);\r\n                   |        } else {\r\n    0x1838123a6    |            var_128h = piVar6[2];\r\n    0x1838123af    |            var_138h = *piVar6;\r\n    0x1838123af    |            uStack_130 = (undefined4)piVar6[1];\r\n    0x1838123af    |            uStack_12c = *(undefined4 *)((int64_t)piVar6 + 0xc);\r\n                   |        }\r\n    0x1838123b7    |        func_0x0001841c04a0(&var_a0h);\r\n    0x1838123cc    |        if ((var_a8h & 1U) == 0) goto code_r0x0001838125cd;\r\n    0x183812407    |        var_148h = (int64_t)&var_118h;\r\n    0x183812411    |        var_150h = (int64_t)&var_138h;\r\n    0x18381241b    |        var_158h._0_4_ = (undefined4)uStack_b0;\r\n    0x183812422    |        func_0x000183823560(iVar5, &var_d8h, \r\n    0x1838123f4    |                            (int64_t)(dStack_c0 - 9.223372036854776e+18) & (int64_t)dStack_c0 >> 0x3f |\r\n    0x183812422    |                            (int64_t)dStack_c0, (int64_t)dStack_b8);\r\n    0x18381242b    |        if (var_128h < 0) {\r\n    0x183812441    |            func_0x0001841dcbe0(var_138h, var_128h & 0x7fffffffffffffff);\r\n                   |        }\r\n    0x183812448    |        *(undefined *)arg2 = 0;\r\n    0x18381244a    |        *(undefined *)(arg2 + 0x10) = 0;\r\n                   |    }\r\n    0x18381245f    |    if (((char)var_a8h == '\\x01') && (var_c8h < 0)) {\r\n    0x18381247b    |        func_0x0001841dcbe0(var_d8h, var_c8h & 0x7fffffffffffffff);\r\n                   |    }\r\n    0x183812495    |    if (*(uint64_t *)0x191c71040 == (var_28h ^ (uint64_t)auStack_178)) {\r\n    0x1838124aa    |        return arg2;\r\n                   |    }\r\n    0x1838125d7    |    func_0x000185f05b40(var_28h ^ (uint64_t)auStack_178);\r\n                   |code_r0x0001838125df:\r\n    0x1838125df    |    pcVar3 = (code *)swi(3);\r\n    0x1838125df    |    iVar5 = (*pcVar3)();\r\n    0x1838125df    |    return iVar5;\r\n                   |}\r\n[{\"offset\":6501245568,\"name\":\"fcn.183812280\",\"size\":864,\"is-pure\":false,\"realsz\":864,\"noreturn\":false,\"stackframe\":376,\"calltype\":\"ms\",\"cost\":233,\"cc\":18,\"loops\":3,\"bits\":64,\"type\":\"fcn\",\"nbbs\":28,\"edges\":40,\"ebbs\":3,\"signature\":\"fcn.183812280(int64_t arg1, int64_t arg2, int64_t arg_bfh);\",\"minbound\":6501245568,\"maxbound\":6501246432,\"callrefs\":[{\"from\":6501245651,\"to\":6502350352,\"type\":\"CALL\"},{\"from\":6501245685,\"to\":6501356784,\"type\":\"CALL\"},{\"from\":6501245699,\"to\":6512708384,\"type\":\"CALL\"},{\"from\":6501245747,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6501245839,\"to\":6532014096,\"type\":\"CALL\"},{\"from\":6501245847,\"to\":6522230240,\"type\":\"CALL\"},{\"from\":6501245887,\"to\":6511396000,\"type\":\"CALL\"},{\"from\":6501245986,\"to\":6501315936,\"type\":\"CALL\"},{\"from\":6501246017,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6501246075,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6501246135,\"to\":6511513840,\"type\":\"CALL\"},{\"from\":6501246140,\"to\":6501245879,\"type\":\"CODE\"},{\"from\":6501246236,\"to\":6587959616,\"type\":\"CALL\"},{\"from\":6501246281,\"to\":6587967968,\"type\":\"CALL\"},{\"from\":6501246294,\"to\":6501246029,\"type\":\"CODE\"},{\"from\":6501246304,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6501246408,\"to\":6501246230,\"type\":\"CODE\"},{\"from\":6501246426,\"to\":6542089024,\"type\":\"CALL\"}],\"datarefs\":[{\"from\":6501245580,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6501245758,\"to\":6501255344,\"type\":\"DATA\"},{\"from\":6501245769,\"to\":6496176416,\"type\":\"DATA\"},{\"from\":6501245780,\"to\":6511490512,\"type\":\"DATA\"},{\"from\":6501245791,\"to\":6501246448,\"type\":\"DATA\"},{\"from\":6501246091,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6501246157,\"to\":6716742096,\"type\":\"DATA\"},{\"from\":6501246192,\"to\":6716742112,\"type\":\"DATA\"},{\"from\":6501246249,\"to\":6587963136,\"type\":\"DATA\"},{\"from\":6501246274,\"to\":6545109024,\"type\":\"DATA\"},{\"from\":6501246351,\"to\":6723614416,\"type\":\"DATA\"},{\"from\":6501246376,\"to\":6723614431,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6501246140,\"to\":6501245879,\"type\":\"CODE\"},{\"from\":6501246294,\"to\":6501246029,\"type\":\"CODE\"},{\"from\":6501246408,\"to\":6501246230,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":3,\"outdegree\":15,\"nlocals\":16,\"nargs\":3,\"stackvars\":[{\"name\":\"var_158h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-344}},{\"name\":\"var_150h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-336}},{\"name\":\"var_148h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-328}},{\"name\":\"var_138h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-312}},{\"name\":\"var_128h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-296}},{\"name\":\"var_118h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-280}},{\"name\":\"var_110h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-272}},{\"name\":\"var_108h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-264}},{\"name\":\"var_100h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-256}},{\"name\":\"var_f8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-248}},{\"name\":\"var_e6h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-230}},{\"name\":\"var_d8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-216}},{\"name\":\"var_c8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-200}},{\"name\":\"var_a8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-168}},{\"name\":\"var_a0h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-160}},{\"name\":\"var_28h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-40}},{\"name\":\"arg_bfh\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":191}}],\"regvars\":[{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"normalized_result":{"stdout":"    0x183812280    |\r\n    0x183812280    |// WARNING: [rz-ghidra] Removing arg arg_bfh because it doesn't fit into ProtoModel\r\n                   |\r\n    0x183812280    |int64_t fcn.183812280(int64_t arg1, int64_t arg2)\r\n                   |{\r\n                   |    int32_t *piVar1;\r\n                   |    int32_t iVar2;\r\n                   |    code *pcVar3;\r\n                   |    undefined8 uVar4;\r\n                   |    int64_t iVar5;\r\n                   |    int64_t *piVar6;\r\n                   |    undefined auStack_178 [32];\r\n                   |    int64_t var_158h;\r\n                   |    int64_t var_150h;\r\n                   |    int64_t var_148h;\r\n                   |    int64_t var_138h;\r\n                   |    undefined4 uStack_130;\r\n                   |    undefined4 uStack_12c;\r\n                   |    int64_t var_128h;\r\n                   |    int64_t var_118h;\r\n                   |    int64_t var_110h;\r\n                   |    int64_t var_108h;\r\n                   |    int64_t var_100h;\r\n                   |    int64_t var_f8h;\r\n                   |    undefined4 uStack_f0;\r\n                   |    undefined4 uStack_ec;\r\n                   |    undefined2 uStack_e8;\r\n                   |    int64_t var_e6h;\r\n                   |    int64_t var_d8h;\r\n                   |    undefined8 uStack_d0;\r\n                   |    int64_t var_c8h;\r\n                   |    double dStack_c0;\r\n                   |    double dStack_b8;\r\n                   |    undefined8 uStack_b0;\r\n                   |    int64_t var_a8h;\r\n                   |    int64_t var_a0h;\r\n                   |    undefined4 uStack_98;\r\n                   |    int64_t var_28h;\r\n                   |    \r\n    0x183812293    |    var_28h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_178;\r\n    0x1838122a2    |    if (*(char *)(arg1 + 0x30) == '\\0') {\r\n                   |code_r0x0001838125cd:\r\n    0x1838125cd    |    // WARNING: Does not return\r\n    0x1838125cd    |        pcVar3 = (code *)invalidInstructionException();\r\n    0x1838125cd    |        (*pcVar3)();\r\n                   |    }\r\n    0x1838122b9    |    dStack_b8 = 0.0;\r\n    0x1838122b9    |    uStack_b0 = 0;\r\n    0x1838122bd    |    var_c8h = 0;\r\n    0x1838122bd    |    dStack_c0 = 0.0;\r\n    0x1838122c1    |    var_d8h = 0;\r\n    0x1838122c1    |    uStack_d0 = 0;\r\n    0x1838122c4    |    var_a8h = 0;\r\n    0x1838122b1    |    func_0x00018391fe10(&var_d8h, arg1 + 0x18);\r\n    0x1838122dc    |    if ((var_a8h & 1U) == 0) {\r\n    0x1838124c9    |        var_e6h._5_1_ = 0x12;\r\n    0x1838124ea    |        if ((int64_t *)0x1905959d0 < &var_e6h && &var_f8h < (int64_t *)0x1905959d1) goto code_r0x0001838125cd;\r\n    0x1838124f7    |        piVar6 = &var_f8h;\r\n    0x1838124ff    |        uStack_e8 = 0x7372;\r\n    0x18381250c    |        var_f8h._0_4_ = 0x61766e49;\r\n    0x18381250c    |        var_f8h._4_4_ = 0x2064696c;\r\n    0x18381250c    |        uStack_f0 = 0x61726170;\r\n    0x18381250c    |        uStack_ec = 0x6574656d;\r\n    0x183812511    |        var_e6h._0_1_ = 0;\r\n                   |code_r0x000183812516:\r\n    0x18381251c    |        func_0x000188ac4940(arg1, arg2, piVar6);\r\n    0x183812538    |        var_a0h = 0x188ac5700;\r\n    0x18381253b    |        uStack_98 = 0;\r\n    0x183812549    |        var_138h = arg1;\r\n    0x183812549    |        uVar4 = func_0x000188ac69e0(0x1861e7020);\r\n    0x18381254e    |        *(undefined8 *)(arg2 + 8) = uVar4;\r\n    0x183812552    |        *(undefined *)(arg2 + 0x10) = 1;\r\n                   |    } else {\r\n    0x1838122e2    |        iVar5 = *(int64_t *)(arg1 + 0x1d0);\r\n    0x1838122ec    |        if (iVar5 == 0) {\r\n    0x1838122ee    |            iVar5 = *(int64_t *)(arg1 + 0x1c8);\r\n                   |        }\r\n    0x1838122f5    |        uVar4 = func_0x00018382d4f0();\r\n    0x183812303    |        iVar5 = func_0x000184300b20(uVar4, iVar5, 1);\r\n    0x18381230b    |        if (iVar5 == 0) {\r\n    0x183812560    |            var_110h = func_0x000185f006b8(0x20);\r\n    0x18381256a    |            var_108h = 0x1f;\r\n    0x183812581    |            var_100h = -0x7fffffffffffffe0;\r\n    0x1838125a6    |            if (((undefined4 *)(var_110h + 0x1f) < (uint64_t)var_110h) ||\r\n    0x1838125a0    |               ((undefined4 *)0x190c236d0 < (undefined4 *)(var_110h + 0x1f) &&\r\n    0x183812599    |                (uint64_t)var_110h < (undefined4 *)0x190c236d1)) goto code_r0x0001838125cd;\r\n    0x1838125af    |            *(undefined8 *)(var_110h + 0xf) = 0x6120746f6e206563;\r\n    0x1838125af    |            *(undefined8 *)(var_110h + 0x17) = 0x656c62616c696176;\r\n    0x1838125bb    |            *(undefined4 *)var_110h = 0x4c626154;\r\n    0x1838125bb    |            *(undefined4 *)(var_110h + 4) = 0x6c61636f;\r\n    0x1838125bb    |            *(undefined4 *)(var_110h + 8) = 0x65535346;\r\n    0x1838125bb    |            *(undefined4 *)(var_110h + 0xc) = 0x63697672;\r\n    0x1838125bf    |            *(undefined *)(var_110h + 0x1f) = 0;\r\n    0x1838125c3    |            piVar6 = &var_110h;\r\n    0x1838125c8    |            goto code_r0x000183812516;\r\n                   |        }\r\n    0x183812317    |        if (arg1 != 0) {\r\n    0x18381231e    |            LOCK();\r\n    0x18381231e    |            piVar1 = (int32_t *)(arg1 + 8);\r\n    0x18381231e    |            iVar2 = *piVar1;\r\n    0x18381231e    |            *piVar1 = *piVar1 + 1;\r\n    0x18381231e    |            UNLOCK();\r\n    0x183812328    |            if (iVar2 == 0x7fffffff) goto code_r0x0001838125df;\r\n                   |        }\r\n    0x183812333    |        var_118h = func_0x000185f006b8(0x38);\r\n    0x183812338    |        *(undefined4 *)var_118h = 1;\r\n    0x183812345    |        *(undefined8 *)(var_118h + 8) = 0x1838148b0;\r\n    0x183812350    |        *(undefined8 *)(var_118h + 0x10) = 0x18333c920;\r\n    0x18381235b    |        *(undefined8 *)(var_118h + 0x18) = 0x1841d75d0;\r\n    0x183812366    |        *(undefined8 *)(var_118h + 0x20) = 0x1838125f0;\r\n    0x18381236a    |        *(undefined4 *)(var_118h + 0x28) = 0;\r\n    0x183812371    |        *(int64_t *)(var_118h + 0x30) = arg1;\r\n    0x18381237a    |        func_0x00018556a010(arg1 + 0xc0, &var_a0h);\r\n    0x183812397    |        piVar6 = (int64_t *)func_0x000184c155e0(&var_a0h);\r\n    0x1838123a0    |        if (*(char *)((int64_t)piVar6 + 0x17) < '\\0') {\r\n    0x1838124b2    |            func_0x0001841dd0f0(&var_138h, *piVar6, piVar6[1]);\r\n                   |        } else {\r\n    0x1838123a6    |            var_128h = piVar6[2];\r\n    0x1838123af    |            var_138h = *piVar6;\r\n    0x1838123af    |            uStack_130 = (undefined4)piVar6[1];\r\n    0x1838123af    |            uStack_12c = *(undefined4 *)((int64_t)piVar6 + 0xc);\r\n                   |        }\r\n    0x1838123b7    |        func_0x0001841c04a0(&var_a0h);\r\n    0x1838123cc    |        if ((var_a8h & 1U) == 0) goto code_r0x0001838125cd;\r\n    0x183812407    |        var_148h = (int64_t)&var_118h;\r\n    0x183812411    |        var_150h = (int64_t)&var_138h;\r\n    0x18381241b    |        var_158h._0_4_ = (undefined4)uStack_b0;\r\n    0x183812422    |        func_0x000183823560(iVar5, &var_d8h, \r\n    0x1838123f4    |                            (int64_t)(dStack_c0 - 9.223372036854776e+18) & (int64_t)dStack_c0 >> 0x3f |\r\n    0x183812422    |                            (int64_t)dStack_c0, (int64_t)dStack_b8);\r\n    0x18381242b    |        if (var_128h < 0) {\r\n    0x183812441    |            func_0x0001841dcbe0(var_138h, var_128h & 0x7fffffffffffffff);\r\n                   |        }\r\n    0x183812448    |        *(undefined *)arg2 = 0;\r\n    0x18381244a    |        *(undefined *)(arg2 + 0x10) = 0;\r\n                   |    }\r\n    0x18381245f    |    if (((char)var_a8h == '\\x01') && (var_c8h < 0)) {\r\n    0x18381247b    |        func_0x0001841dcbe0(var_d8h, var_c8h & 0x7fffffffffffffff);\r\n                   |    }\r\n    0x183812495    |    if (*(uint64_t *)0x191c71040 == (var_28h ^ (uint64_t)auStack_178)) {\r\n    0x1838124aa    |        return arg2;\r\n                   |    }\r\n    0x1838125d7    |    func_0x000185f05b40(var_28h ^ (uint64_t)auStack_178);\r\n                   |code_r0x0001838125df:\r\n    0x1838125df    |    pcVar3 = (code *)swi(3);\r\n    0x1838125df    |    iVar5 = (*pcVar3)();\r\n    0x1838125df    |    return iVar5;\r\n                   |}\r\n[{\"offset\":6501245568,\"name\":\"fcn.183812280\",\"size\":864,\"is-pure\":false,\"realsz\":864,\"noreturn\":false,\"stackframe\":376,\"calltype\":\"ms\",\"cost\":233,\"cc\":18,\"loops\":3,\"bits\":64,\"type\":\"fcn\",\"nbbs\":28,\"edges\":40,\"ebbs\":3,\"signature\":\"fcn.183812280(int64_t arg1, int64_t arg2, int64_t arg_bfh);\",\"minbound\":6501245568,\"maxbound\":6501246432,\"callrefs\":[{\"from\":6501245651,\"to\":6502350352,\"type\":\"CALL\"},{\"from\":6501245685,\"to\":6501356784,\"type\":\"CALL\"},{\"from\":6501245699,\"to\":6512708384,\"type\":\"CALL\"},{\"from\":6501245747,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6501245839,\"to\":6532014096,\"type\":\"CALL\"},{\"from\":6501245847,\"to\":6522230240,\"type\":\"CALL\"},{\"from\":6501245887,\"to\":6511396000,\"type\":\"CALL\"},{\"from\":6501245986,\"to\":6501315936,\"type\":\"CALL\"},{\"from\":6501246017,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6501246075,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6501246135,\"to\":6511513840,\"type\":\"CALL\"},{\"from\":6501246140,\"to\":6501245879,\"type\":\"CODE\"},{\"from\":6501246236,\"to\":6587959616,\"type\":\"CALL\"},{\"from\":6501246281,\"to\":6587967968,\"type\":\"CALL\"},{\"from\":6501246294,\"to\":6501246029,\"type\":\"CODE\"},{\"from\":6501246304,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6501246408,\"to\":6501246230,\"type\":\"CODE\"},{\"from\":6501246426,\"to\":6542089024,\"type\":\"CALL\"}],\"datarefs\":[{\"from\":6501245580,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6501245758,\"to\":6501255344,\"type\":\"DATA\"},{\"from\":6501245769,\"to\":6496176416,\"type\":\"DATA\"},{\"from\":6501245780,\"to\":6511490512,\"type\":\"DATA\"},{\"from\":6501245791,\"to\":6501246448,\"type\":\"DATA\"},{\"from\":6501246091,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6501246157,\"to\":6716742096,\"type\":\"DATA\"},{\"from\":6501246192,\"to\":6716742112,\"type\":\"DATA\"},{\"from\":6501246249,\"to\":6587963136,\"type\":\"DATA\"},{\"from\":6501246274,\"to\":6545109024,\"type\":\"DATA\"},{\"from\":6501246351,\"to\":6723614416,\"type\":\"DATA\"},{\"from\":6501246376,\"to\":6723614431,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6501246140,\"to\":6501245879,\"type\":\"CODE\"},{\"from\":6501246294,\"to\":6501246029,\"type\":\"CODE\"},{\"from\":6501246408,\"to\":6501246230,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":3,\"outdegree\":15,\"nlocals\":16,\"nargs\":3,\"stackvars\":[{\"name\":\"var_158h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-344}},{\"name\":\"var_150h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-336}},{\"name\":\"var_148h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-328}},{\"name\":\"var_138h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-312}},{\"name\":\"var_128h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-296}},{\"name\":\"var_118h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-280}},{\"name\":\"var_110h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-272}},{\"name\":\"var_108h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-264}},{\"name\":\"var_100h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-256}},{\"name\":\"var_f8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-248}},{\"name\":\"var_e6h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-230}},{\"name\":\"var_d8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-216}},{\"name\":\"var_c8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-200}},{\"name\":\"var_a8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-168}},{\"name\":\"var_a0h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-160}},{\"name\":\"var_28h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-40}},{\"name\":\"arg_bfh\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":191}}],\"regvars\":[{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"confidence":"observed","authority":"shipped-artifact","environment":null,"limitations":["The executable version and supported formats are reported as unknown because no reliable version probe was performed.","A non-zero process exit is preserved as an observed command result.","Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.","When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call."],"relationship_coverage":null,"locations":[{"kind":"artifact-path","path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"}],"evidence_links":[]},"meta":{"command":"execute-rizin-command","duration":"5083ms"}}