{"ok":true,"data":{"evidence_id":"ev_4af1b7225ffa45d2bcb77fccf6c62d0e85b7375fcc8aaf016f268be61d8c960b","subject":{"name":"Tabbit.dll","digest":{"sha256":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c"},"local_path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","format":"unknown","architecture":null},"provider":{"id":"rizin","name":"Rizin","version":null},"analysis_profile":null,"predicate_type":"rea.reverse-engineering.command-observation","operation":"execute_rizin_command","parameters":{"path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","command":"e scr.color=0;af @ 0x18380e390;pdgo @ 0x18380e390;afij @ 0x18380e390","provider_executable":"C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe","command_arguments":["-N","-q","-c","e scr.color=0;af @ 0x18380e390;pdgo @ 0x18380e390;afij @ 0x18380e390","C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"]},"raw_result":{"stdout":"    0x18380e390    |\r\n    0x18380e390    |// WARNING: [rz-ghidra] Detected overlap for variable var_c9h\r\n    0x18380e390    |// WARNING: [rz-ghidra] Removing arg arg_1ffh because it doesn't fit into ProtoModel\r\n    0x18380e390    |// WARNING: [rz-ghidra] Detected overlap for variable var_219h\r\n    0x18380e390    |// WARNING: [rz-ghidra] Detected overlap for variable var_220h\r\n    0x18380e390    |// WARNING: [rz-ghidra] Detected overlap for variable var_268h\r\n    0x18380e390    |// WARNING: [rz-ghidra] Detected overlap for variable var_249h\r\n                   |\r\n    0x18380e390    |int64_t fcn.18380e390(int64_t arg1, int64_t arg2)\r\n                   |{\r\n                   |    code *pcVar1;\r\n                   |    undefined4 uVar2;\r\n                   |    undefined8 uVar3;\r\n                   |    int64_t iVar4;\r\n                   |    undefined8 *puVar5;\r\n                   |    int64_t *piVar6;\r\n                   |    int64_t *piVar7;\r\n                   |    int64_t iVar8;\r\n                   |    int64_t iVar9;\r\n                   |    undefined auStack_2a8 [32];\r\n                   |    int64_t var_288h;\r\n                   |    undefined8 uStack_280;\r\n                   |    undefined8 uStack_278;\r\n                   |    int64_t var_269h;\r\n                   |    int64_t var_260h;\r\n                   |    int64_t var_258h;\r\n                   |    undefined var_249h;\r\n                   |    int64_t var_248h;\r\n                   |    undefined4 uStack_240;\r\n                   |    undefined4 uStack_23c;\r\n                   |    int64_t var_238h;\r\n                   |    int64_t var_230h;\r\n                   |    int64_t var_228h;\r\n                   |    unkbyte7 var_220h;\r\n                   |    char var_219h;\r\n                   |    int64_t var_218h;\r\n                   |    int64_t var_208h;\r\n                   |    int64_t var_e8h;\r\n                   |    undefined4 uStack_e0;\r\n                   |    undefined4 uStack_dc;\r\n                   |    undefined2 uStack_d8;\r\n                   |    int64_t var_d6h;\r\n                   |    undefined var_c9h;\r\n                   |    int64_t var_c8h;\r\n                   |    undefined8 uStack_c0;\r\n                   |    int64_t var_b8h;\r\n                   |    int64_t var_b0h;\r\n                   |    int64_t var_a8h;\r\n                   |    undefined4 uStack_a0;\r\n                   |    undefined4 uStack_9c;\r\n                   |    int64_t var_98h;\r\n                   |    int64_t var_30h;\r\n                   |    \r\n    0x18380e3a5    |    var_30h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_2a8;\r\n    0x18380e3b4    |    if (*(char *)(arg1 + 0x30) == '\\0') {\r\n                   |code_r0x00018380e97f:\r\n    0x18380e97f    |    // WARNING: Does not return\r\n    0x18380e97f    |        pcVar1 = (code *)invalidInstructionException();\r\n    0x18380e97f    |        (*pcVar1)();\r\n                   |    }\r\n    0x18380e3cb    |    var_b8h = 0;\r\n    0x18380e3cb    |    var_b0h = 0;\r\n    0x18380e3cf    |    var_c8h = 0;\r\n    0x18380e3cf    |    uStack_c0 = 0;\r\n    0x18380e3c3    |    func_0x000183916250(&var_c8h, arg1 + 0x18);\r\n    0x18380e3e2    |    if ((char)var_b0h == '\\0') {\r\n    0x18380e62b    |        var_d6h._5_1_ = 0x12;\r\n    0x18380e64c    |        if ((int64_t *)0x1905959d0 < &var_d6h && &var_e8h < (int64_t *)0x1905959d1) goto code_r0x00018380e97f;\r\n    0x18380e659    |        piVar6 = &var_e8h;\r\n    0x18380e661    |        uStack_d8 = 0x7372;\r\n    0x18380e66d    |        var_e8h._0_4_ = 0x61766e49;\r\n    0x18380e66d    |        var_e8h._4_4_ = 0x2064696c;\r\n    0x18380e66d    |        uStack_e0 = 0x61726170;\r\n    0x18380e66d    |        uStack_dc = 0x6574656d;\r\n    0x18380e671    |        var_d6h._0_1_ = 0;\r\n    0x18380e676    |        piVar7 = (int64_t *)&var_c9h;\r\n                   |    } else {\r\n    0x18380e3e8    |        iVar4 = *(int64_t *)(arg1 + 0x1d0);\r\n    0x18380e3f2    |        if (iVar4 == 0) {\r\n    0x18380e3f4    |            iVar4 = *(int64_t *)(arg1 + 0x1c8);\r\n                   |        }\r\n    0x18380e3fb    |        uVar3 = func_0x00018382d4f0();\r\n    0x18380e409    |        iVar4 = func_0x000184300b20(uVar3, iVar4, 1);\r\n    0x18380e41a    |        if (iVar4 != 0) {\r\n    0x18380e710    |            if ((*(int32_t *)0x191de85c0 < 1) && ((*(int32_t *)0x191cd6be0 != 0 || (*(int64_t *)0x191de85c8 != 0)))) {\r\n    0x18380e71d    |                func_0x00018030d390(&var_218h, 0x190c23650, 0x176, 0);\r\n    0x18380e748    |                uVar3 = func_0x000184dcd0d0(&var_208h, 0x1908fb27c, 6);\r\n    0x18380e75d    |                uVar3 = func_0x000184dcd0d0(uVar3, 0x190c23870, 0x27);\r\n    0x18380e76a    |                if ((char)var_b0h == '\\0') goto code_r0x00018380e97f;\r\n    0x18380e773    |                func_0x00018380ccc0(&var_230h, &var_c8h);\r\n    0x18380e790    |                iVar8 = (int64_t)var_219h;\r\n    0x18380e790    |                piVar6 = &var_230h;\r\n    0x18380e790    |                if ((int64_t)var_219h < 0) {\r\n    0x18380e79a    |                    iVar8 = var_228h;\r\n    0x18380e79a    |                    piVar6 = (int64_t *)var_230h;\r\n                   |                }\r\n    0x18380e7a5    |                uVar3 = func_0x000184dcd0d0(uVar3, piVar6, iVar8);\r\n    0x18380e7ba    |                uVar3 = func_0x000184dcd0d0(uVar3, 0x190c23a88, 8);\r\n    0x18380e7c2    |                func_0x00018556a010(arg1 + 0xc0, &var_a8h);\r\n    0x18380e7dc    |                puVar5 = (undefined8 *)func_0x000184c155e0(&var_a8h);\r\n    0x18380e7e5    |                if (*(char *)((int64_t)puVar5 + 0x17) < '\\0') {\r\n    0x18380e801    |                    func_0x0001841dd0f0(&var_248h, *puVar5, puVar5[1]);\r\n                   |                } else {\r\n    0x18380e7e7    |                    var_238h = puVar5[2];\r\n    0x18380e7f0    |                    var_248h._0_4_ = *(undefined4 *)puVar5;\r\n    0x18380e7f0    |                    var_248h._4_4_ = *(undefined4 *)((int64_t)puVar5 + 4);\r\n    0x18380e7f0    |                    uStack_240 = *(undefined4 *)(puVar5 + 1);\r\n    0x18380e7f0    |                    uStack_23c = *(undefined4 *)((int64_t)puVar5 + 0xc);\r\n                   |                }\r\n    0x18380e80b    |                func_0x0001841c04a0(&var_a8h);\r\n    0x18380e81d    |                iVar9 = (int64_t)var_238h._7_1_;\r\n    0x18380e825    |                iVar8 = iVar9;\r\n    0x18380e825    |                if (iVar9 < 0) {\r\n    0x18380e825    |                    iVar8 = CONCAT44(uStack_23c, uStack_240);\r\n                   |                }\r\n    0x18380e82d    |                piVar6 = (int64_t *)CONCAT44(var_248h._4_4_, (undefined4)var_248h);\r\n    0x18380e82d    |                if (iVar9 >= 0) {\r\n    0x18380e82d    |                    piVar6 = &var_248h;\r\n                   |                }\r\n    0x18380e834    |                func_0x000184dcd0d0(uVar3, piVar6, iVar8);\r\n    0x18380e83e    |                if (var_238h < 0) {\r\n    0x18380e84f    |                    func_0x0001841dcbe0(CONCAT44(var_248h._4_4_, (undefined4)var_248h), var_238h & 0x7fffffffffffffff);\r\n                   |                }\r\n    0x18380e861    |                if (var_219h < '\\0') {\r\n    0x18380e87a    |                    func_0x0001841dcbe0(var_230h, CONCAT17(var_219h, var_220h) & 0x7fffffffffffffff);\r\n                   |                }\r\n    0x18380e87f    |                func_0x0001804b0120(&var_218h);\r\n                   |            }\r\n    0x18380e88c    |            func_0x00018556a010(arg1 + 0xc0, &var_218h);\r\n    0x18380e8a6    |            puVar5 = (undefined8 *)func_0x000184c155e0(&var_218h);\r\n    0x18380e8af    |            if (*(char *)((int64_t)puVar5 + 0x17) < '\\0') {\r\n    0x18380e8d1    |                func_0x0001841dd0f0(&var_a8h, *puVar5, puVar5[1]);\r\n                   |            } else {\r\n    0x18380e8b1    |                var_98h = puVar5[2];\r\n    0x18380e8bd    |                var_a8h._0_4_ = *(undefined4 *)puVar5;\r\n    0x18380e8bd    |                var_a8h._4_4_ = *(undefined4 *)((int64_t)puVar5 + 4);\r\n    0x18380e8bd    |                uStack_a0 = *(undefined4 *)(puVar5 + 1);\r\n    0x18380e8bd    |                uStack_9c = *(undefined4 *)((int64_t)puVar5 + 0xc);\r\n                   |            }\r\n    0x18380e8de    |            func_0x0001841c04a0(&var_218h);\r\n    0x18380e8f3    |            if ((char)var_b0h == '\\0') goto code_r0x00018380e97f;\r\n    0x18380e90f    |            uVar2 = func_0x00018381d2b0(iVar4, &var_c8h, &var_a8h);\r\n    0x18380e91b    |            if (var_98h < 0) {\r\n    0x18380e92f    |                func_0x0001841dcbe0(CONCAT44(var_a8h._4_4_, (undefined4)var_a8h), var_98h & 0x7fffffffffffffff);\r\n                   |            }\r\n    0x18380e944    |            var_288h = 0;\r\n    0x18380e944    |            uStack_280 = 0;\r\n    0x18380e948    |            uStack_278 = 0;\r\n    0x18380e93f    |            func_0x000180ebbdc0(&var_288h, 1);\r\n    0x18380e93f    |            func_0x0001828e1cc0(&var_288h, uVar2);\r\n    0x18380e967    |            piVar7 = &var_269h;\r\n    0x18380e975    |            func_0x000188ac5420(arg1, piVar7, &var_288h);\r\n    0x18380e97a    |            goto code_r0x00018380e689;\r\n                   |        }\r\n    0x18380e42d    |        if (*(int32_t *)0x191de85c0 < 3) {\r\n    0x18380e43a    |            func_0x00018030d390(&var_218h, 0x190c23650, 0x170, 2);\r\n    0x18380e468    |            uVar3 = func_0x000184dcd0d0(&var_208h, 0x1908fb27c, 6);\r\n    0x18380e47d    |            uVar3 = func_0x000184dcd0d0(uVar3, 0x190c23838, 0x33);\r\n    0x18380e492    |            uVar3 = func_0x000184dcd0d0(uVar3, 0x190c23aa8, 8);\r\n    0x18380e49f    |            if ((char)var_b0h == '\\0') goto code_r0x00018380e97f;\r\n    0x18380e4a8    |            func_0x00018380ccc0(&var_230h, &var_c8h);\r\n    0x18380e4c5    |            iVar4 = (int64_t)var_219h;\r\n    0x18380e4c5    |            piVar6 = &var_230h;\r\n    0x18380e4c5    |            if ((int64_t)var_219h < 0) {\r\n    0x18380e4cf    |                iVar4 = var_228h;\r\n    0x18380e4cf    |                piVar6 = (int64_t *)var_230h;\r\n                   |            }\r\n    0x18380e4da    |            uVar3 = func_0x000184dcd0d0(uVar3, piVar6, iVar4);\r\n    0x18380e4ef    |            uVar3 = func_0x000184dcd0d0(uVar3, 0x190c23a88, 8);\r\n    0x18380e4f7    |            func_0x00018556a010(arg1 + 0xc0, &var_a8h);\r\n    0x18380e511    |            puVar5 = (undefined8 *)func_0x000184c155e0(&var_a8h);\r\n    0x18380e51a    |            if (*(char *)((int64_t)puVar5 + 0x17) < '\\0') {\r\n    0x18380e536    |                func_0x0001841dd0f0(&var_248h, *puVar5, puVar5[1]);\r\n                   |            } else {\r\n    0x18380e51c    |                var_238h = puVar5[2];\r\n    0x18380e525    |                var_248h._0_4_ = *(undefined4 *)puVar5;\r\n    0x18380e525    |                var_248h._4_4_ = *(undefined4 *)((int64_t)puVar5 + 4);\r\n    0x18380e525    |                uStack_240 = *(undefined4 *)(puVar5 + 1);\r\n    0x18380e525    |                uStack_23c = *(undefined4 *)((int64_t)puVar5 + 0xc);\r\n                   |            }\r\n    0x18380e540    |            func_0x0001841c04a0(&var_a8h);\r\n    0x18380e552    |            iVar8 = (int64_t)var_238h._7_1_;\r\n    0x18380e55a    |            iVar4 = iVar8;\r\n    0x18380e55a    |            if (iVar8 < 0) {\r\n    0x18380e55a    |                iVar4 = CONCAT44(uStack_23c, uStack_240);\r\n                   |            }\r\n    0x18380e562    |            piVar6 = (int64_t *)CONCAT44(var_248h._4_4_, (undefined4)var_248h);\r\n    0x18380e562    |            if (iVar8 >= 0) {\r\n    0x18380e562    |                piVar6 = &var_248h;\r\n                   |            }\r\n    0x18380e569    |            func_0x000184dcd0d0(uVar3, piVar6, iVar4);\r\n    0x18380e573    |            if (var_238h < 0) {\r\n    0x18380e57d    |                func_0x0001841dcbe0(CONCAT44(var_248h._4_4_, (undefined4)var_248h), var_238h & 0x7fffffffffffffff);\r\n                   |            }\r\n    0x18380e58f    |            if (var_219h < '\\0') {\r\n    0x18380e5a1    |                func_0x0001841dcbe0(var_230h, CONCAT17(var_219h, var_220h) & 0x7fffffffffffffff);\r\n                   |            }\r\n    0x18380e5a6    |            func_0x0001804b0120(&var_218h);\r\n                   |        }\r\n    0x18380e5b8    |        *(undefined4 **)0x0 = (undefined4 *)func_0x000185f006b8(0x20);\r\n    0x18380e5c2    |        var_260h = 0x1f;\r\n    0x18380e5cf    |        var_258h = -0x7fffffffffffffe0;\r\n    0x18380e5f8    |        if (((undefined4 *)((int64_t)*(undefined4 **)0x0 + 0x1f) < *(undefined4 **)0x0) ||\r\n    0x18380e5f2    |           ((undefined4 *)0x190c236d0 < (undefined4 *)((int64_t)*(undefined4 **)0x0 + 0x1f) &&\r\n    0x18380e5eb    |            *(undefined4 **)0x0 < (undefined4 *)0x190c236d1)) goto code_r0x00018380e97f;\r\n    0x18380e605    |        *(undefined8 *)((int64_t)*(undefined4 **)0x0 + 0xf) = 0x6120746f6e206563;\r\n    0x18380e605    |        *(undefined8 *)((int64_t)*(undefined4 **)0x0 + 0x17) = 0x656c62616c696176;\r\n    0x18380e610    |        **(undefined4 **)0x0 = 0x4c626154;\r\n    0x18380e610    |        (*(undefined4 **)0x0)[1] = 0x6c61636f;\r\n    0x18380e610    |        (*(undefined4 **)0x0)[2] = 0x65535346;\r\n    0x18380e610    |        (*(undefined4 **)0x0)[3] = 0x63697672;\r\n    0x18380e613    |        *(undefined *)((int64_t)*(undefined4 **)0x0 + 0x1f) = 0;\r\n    0x18380e617    |        piVar7 = (int64_t *)&var_249h;\r\n    0x18380e61c    |        piVar6 = (int64_t *)((int64_t)&var_269h + 1);\r\n                   |    }\r\n    0x18380e684    |    func_0x000188ac4940(arg1, piVar7, piVar6);\r\n                   |code_r0x00018380e689:\r\n    0x18380e692    |    func_0x000188ac4bd0(arg1, arg2, piVar7);\r\n    0x18380e6a9    |    if (((char)var_b0h == '\\x01') && (var_b8h < 0)) {\r\n    0x18380e6c5    |        func_0x0001841dcbe0(var_c8h, var_b8h & 0x7fffffffffffffff);\r\n                   |    }\r\n    0x18380e6df    |    if (*(uint64_t *)0x191c71040 == (var_30h ^ (uint64_t)auStack_2a8)) {\r\n    0x18380e6f6    |        return arg2;\r\n                   |    }\r\n    0x18380e989    |    func_0x000185f05b40(var_30h ^ (uint64_t)auStack_2a8);\r\n    0x18380e991    |    pcVar1 = (code *)swi(3);\r\n    0x18380e991    |    iVar4 = (*pcVar1)();\r\n    0x18380e991    |    return iVar4;\r\n                   |}\r\n[{\"offset\":6501229456,\"name\":\"fcn.18380e390\",\"size\":1538,\"is-pure\":false,\"realsz\":1538,\"noreturn\":false,\"stackframe\":680,\"calltype\":\"ms\",\"cost\":445,\"cc\":30,\"loops\":1,\"bits\":64,\"type\":\"fcn\",\"nbbs\":51,\"edges\":75,\"ebbs\":3,\"signature\":\"fcn.18380e390(int64_t arg1, int64_t arg2, int64_t arg_1ffh);\",\"minbound\":6501229456,\"maxbound\":6501230994,\"callrefs\":[{\"from\":6501229529,\"to\":6502310480,\"type\":\"CALL\"},{\"from\":6501229563,\"to\":6501356784,\"type\":\"CALL\"},{\"from\":6501229577,\"to\":6512708384,\"type\":\"CALL\"},{\"from\":6501229646,\"to\":6445650832,\"type\":\"CALL\"},{\"from\":6501229672,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6501229693,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6501229714,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6501229752,\"to\":6501223616,\"type\":\"CALL\"},{\"from\":6501229786,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6501229807,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6501229833,\"to\":6532014096,\"type\":\"CALL\"},{\"from\":6501229841,\"to\":6522230240,\"type\":\"CALL\"},{\"from\":6501229869,\"to\":6501229888,\"type\":\"CODE\"},{\"from\":6501229883,\"to\":6511513840,\"type\":\"CALL\"},{\"from\":6501229896,\"to\":6511396000,\"type\":\"CALL\"},{\"from\":6501229929,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6501229954,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6501229985,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6501229998,\"to\":6447366432,\"type\":\"CALL\"},{\"from\":6501230008,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6501230113,\"to\":6501230206,\"type\":\"CODE\"},{\"from\":6501230212,\"to\":6587959616,\"type\":\"CALL\"},{\"from\":6501230226,\"to\":6587960272,\"type\":\"CALL\"},{\"from\":6501230277,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6501230382,\"to\":6445650832,\"type\":\"CALL\"},{\"from\":6501230408,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6501230429,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6501230467,\"to\":6501223616,\"type\":\"CALL\"},{\"from\":6501230501,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6501230522,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6501230548,\"to\":6532014096,\"type\":\"CALL\"},{\"from\":6501230556,\"to\":6522230240,\"type\":\"CALL\"},{\"from\":6501230584,\"to\":6501230603,\"type\":\"CODE\"},{\"from\":6501230598,\"to\":6511513840,\"type\":\"CALL\"},{\"from\":6501230611,\"to\":6511396000,\"type\":\"CALL\"},{\"from\":6501230644,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6501230676,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6501230714,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6501230727,\"to\":6447366432,\"type\":\"CALL\"},{\"from\":6501230750,\"to\":6532014096,\"type\":\"CALL\"},{\"from\":6501230758,\"to\":6522230240,\"type\":\"CALL\"},{\"from\":6501230792,\"to\":6501230814,\"type\":\"CODE\"},{\"from\":6501230809,\"to\":6511513840,\"type\":\"CALL\"},{\"from\":6501230822,\"to\":6511396000,\"type\":\"CALL\"},{\"from\":6501230863,\"to\":6501290672,\"type\":\"CALL\"},{\"from\":6501230903,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6501230936,\"to\":6457900480,\"type\":\"CALL\"},{\"from\":6501230946,\"to\":6485318848,\"type\":\"CALL\"},{\"from\":6501230965,\"to\":6587962400,\"type\":\"CALL\"},{\"from\":6501230970,\"to\":6501230217,\"type\":\"CODE\"},{\"from\":6501230988,\"to\":6542089024,\"type\":\"CALL\"}],\"datarefs\":[{\"from\":6501229470,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6501229585,\"to\":6742246848,\"type\":\"DATA\"},{\"from\":6501229619,\"to\":6723614288,\"type\":\"DATA\"},{\"from\":6501229659,\"to\":6720303740,\"type\":\"DATA\"},{\"from\":6501229677,\"to\":6723614776,\"type\":\"DATA\"},{\"from\":6501229698,\"to\":6723615400,\"type\":\"DATA\"},{\"from\":6501229791,\"to\":6723615368,\"type\":\"DATA\"},{\"from\":6501230049,\"to\":6723614416,\"type\":\"DATA\"},{\"from\":6501230078,\"to\":6723614431,\"type\":\"DATA\"},{\"from\":6501230089,\"to\":6723614416,\"type\":\"DATA\"},{\"from\":6501230127,\"to\":6716742096,\"type\":\"DATA\"},{\"from\":6501230162,\"to\":6716742112,\"type\":\"DATA\"},{\"from\":6501230182,\"to\":6716742096,\"type\":\"DATA\"},{\"from\":6501230293,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6501230335,\"to\":6741126112,\"type\":\"DATA\"},{\"from\":6501230344,\"to\":6742246856,\"type\":\"DATA\"},{\"from\":6501230358,\"to\":6723614288,\"type\":\"DATA\"},{\"from\":6501230395,\"to\":6720303740,\"type\":\"DATA\"},{\"from\":6501230413,\"to\":6723614832,\"type\":\"DATA\"},{\"from\":6501230506,\"to\":6723615368,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6501229869,\"to\":6501229888,\"type\":\"CODE\"},{\"from\":6501230113,\"to\":6501230206,\"type\":\"CODE\"},{\"from\":6501230584,\"to\":6501230603,\"type\":\"CODE\"},{\"from\":6501230792,\"to\":6501230814,\"type\":\"CODE\"},{\"from\":6501230970,\"to\":6501230217,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":5,\"outdegree\":46,\"nlocals\":23,\"nargs\":3,\"stackvars\":[{\"name\":\"var_288h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-648}},{\"name\":\"var_269h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-617}},{\"name\":\"var_268h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-616}},{\"name\":\"var_260h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-608}},{\"name\":\"var_258h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-600}},{\"name\":\"var_249h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-585}},{\"name\":\"var_248h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-584}},{\"name\":\"var_238h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-568}},{\"name\":\"var_230h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-560}},{\"name\":\"var_228h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-552}},{\"name\":\"var_220h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-544}},{\"name\":\"var_219h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-537}},{\"name\":\"var_218h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-536}},{\"name\":\"var_208h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-520}},{\"name\":\"var_e8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-232}},{\"name\":\"var_d6h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-214}},{\"name\":\"var_c9h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-201}},{\"name\":\"var_c8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-200}},{\"name\":\"var_b8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-184}},{\"name\":\"var_b0h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-176}},{\"name\":\"var_a8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-168}},{\"name\":\"var_98h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-152}},{\"name\":\"var_30h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-48}},{\"name\":\"arg_1ffh\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":511}}],\"regvars\":[{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"normalized_result":{"stdout":"    0x18380e390    |\r\n    0x18380e390    |// WARNING: [rz-ghidra] Detected overlap for variable var_c9h\r\n    0x18380e390    |// WARNING: [rz-ghidra] Removing arg arg_1ffh because it doesn't fit into ProtoModel\r\n    0x18380e390    |// WARNING: [rz-ghidra] Detected overlap for variable var_219h\r\n    0x18380e390    |// WARNING: [rz-ghidra] Detected overlap for variable var_220h\r\n    0x18380e390    |// WARNING: [rz-ghidra] Detected overlap for variable var_268h\r\n    0x18380e390    |// WARNING: [rz-ghidra] Detected overlap for variable var_249h\r\n                   |\r\n    0x18380e390    |int64_t fcn.18380e390(int64_t arg1, int64_t arg2)\r\n                   |{\r\n                   |    code *pcVar1;\r\n                   |    undefined4 uVar2;\r\n                   |    undefined8 uVar3;\r\n                   |    int64_t iVar4;\r\n                   |    undefined8 *puVar5;\r\n                   |    int64_t *piVar6;\r\n                   |    int64_t *piVar7;\r\n                   |    int64_t iVar8;\r\n                   |    int64_t iVar9;\r\n                   |    undefined auStack_2a8 [32];\r\n                   |    int64_t var_288h;\r\n                   |    undefined8 uStack_280;\r\n                   |    undefined8 uStack_278;\r\n                   |    int64_t var_269h;\r\n                   |    int64_t var_260h;\r\n                   |    int64_t var_258h;\r\n                   |    undefined var_249h;\r\n                   |    int64_t var_248h;\r\n                   |    undefined4 uStack_240;\r\n                   |    undefined4 uStack_23c;\r\n                   |    int64_t var_238h;\r\n                   |    int64_t var_230h;\r\n                   |    int64_t var_228h;\r\n                   |    unkbyte7 var_220h;\r\n                   |    char var_219h;\r\n                   |    int64_t var_218h;\r\n                   |    int64_t var_208h;\r\n                   |    int64_t var_e8h;\r\n                   |    undefined4 uStack_e0;\r\n                   |    undefined4 uStack_dc;\r\n                   |    undefined2 uStack_d8;\r\n                   |    int64_t var_d6h;\r\n                   |    undefined var_c9h;\r\n                   |    int64_t var_c8h;\r\n                   |    undefined8 uStack_c0;\r\n                   |    int64_t var_b8h;\r\n                   |    int64_t var_b0h;\r\n                   |    int64_t var_a8h;\r\n                   |    undefined4 uStack_a0;\r\n                   |    undefined4 uStack_9c;\r\n                   |    int64_t var_98h;\r\n                   |    int64_t var_30h;\r\n                   |    \r\n    0x18380e3a5    |    var_30h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_2a8;\r\n    0x18380e3b4    |    if (*(char *)(arg1 + 0x30) == '\\0') {\r\n                   |code_r0x00018380e97f:\r\n    0x18380e97f    |    // WARNING: Does not return\r\n    0x18380e97f    |        pcVar1 = (code *)invalidInstructionException();\r\n    0x18380e97f    |        (*pcVar1)();\r\n                   |    }\r\n    0x18380e3cb    |    var_b8h = 0;\r\n    0x18380e3cb    |    var_b0h = 0;\r\n    0x18380e3cf    |    var_c8h = 0;\r\n    0x18380e3cf    |    uStack_c0 = 0;\r\n    0x18380e3c3    |    func_0x000183916250(&var_c8h, arg1 + 0x18);\r\n    0x18380e3e2    |    if ((char)var_b0h == '\\0') {\r\n    0x18380e62b    |        var_d6h._5_1_ = 0x12;\r\n    0x18380e64c    |        if ((int64_t *)0x1905959d0 < &var_d6h && &var_e8h < (int64_t *)0x1905959d1) goto code_r0x00018380e97f;\r\n    0x18380e659    |        piVar6 = &var_e8h;\r\n    0x18380e661    |        uStack_d8 = 0x7372;\r\n    0x18380e66d    |        var_e8h._0_4_ = 0x61766e49;\r\n    0x18380e66d    |        var_e8h._4_4_ = 0x2064696c;\r\n    0x18380e66d    |        uStack_e0 = 0x61726170;\r\n    0x18380e66d    |        uStack_dc = 0x6574656d;\r\n    0x18380e671    |        var_d6h._0_1_ = 0;\r\n    0x18380e676    |        piVar7 = (int64_t *)&var_c9h;\r\n                   |    } else {\r\n    0x18380e3e8    |        iVar4 = *(int64_t *)(arg1 + 0x1d0);\r\n    0x18380e3f2    |        if (iVar4 == 0) {\r\n    0x18380e3f4    |            iVar4 = *(int64_t *)(arg1 + 0x1c8);\r\n                   |        }\r\n    0x18380e3fb    |        uVar3 = func_0x00018382d4f0();\r\n    0x18380e409    |        iVar4 = func_0x000184300b20(uVar3, iVar4, 1);\r\n    0x18380e41a    |        if (iVar4 != 0) {\r\n    0x18380e710    |            if ((*(int32_t *)0x191de85c0 < 1) && ((*(int32_t *)0x191cd6be0 != 0 || (*(int64_t *)0x191de85c8 != 0)))) {\r\n    0x18380e71d    |                func_0x00018030d390(&var_218h, 0x190c23650, 0x176, 0);\r\n    0x18380e748    |                uVar3 = func_0x000184dcd0d0(&var_208h, 0x1908fb27c, 6);\r\n    0x18380e75d    |                uVar3 = func_0x000184dcd0d0(uVar3, 0x190c23870, 0x27);\r\n    0x18380e76a    |                if ((char)var_b0h == '\\0') goto code_r0x00018380e97f;\r\n    0x18380e773    |                func_0x00018380ccc0(&var_230h, &var_c8h);\r\n    0x18380e790    |                iVar8 = (int64_t)var_219h;\r\n    0x18380e790    |                piVar6 = &var_230h;\r\n    0x18380e790    |                if ((int64_t)var_219h < 0) {\r\n    0x18380e79a    |                    iVar8 = var_228h;\r\n    0x18380e79a    |                    piVar6 = (int64_t *)var_230h;\r\n                   |                }\r\n    0x18380e7a5    |                uVar3 = func_0x000184dcd0d0(uVar3, piVar6, iVar8);\r\n    0x18380e7ba    |                uVar3 = func_0x000184dcd0d0(uVar3, 0x190c23a88, 8);\r\n    0x18380e7c2    |                func_0x00018556a010(arg1 + 0xc0, &var_a8h);\r\n    0x18380e7dc    |                puVar5 = (undefined8 *)func_0x000184c155e0(&var_a8h);\r\n    0x18380e7e5    |                if (*(char *)((int64_t)puVar5 + 0x17) < '\\0') {\r\n    0x18380e801    |                    func_0x0001841dd0f0(&var_248h, *puVar5, puVar5[1]);\r\n                   |                } else {\r\n    0x18380e7e7    |                    var_238h = puVar5[2];\r\n    0x18380e7f0    |                    var_248h._0_4_ = *(undefined4 *)puVar5;\r\n    0x18380e7f0    |                    var_248h._4_4_ = *(undefined4 *)((int64_t)puVar5 + 4);\r\n    0x18380e7f0    |                    uStack_240 = *(undefined4 *)(puVar5 + 1);\r\n    0x18380e7f0    |                    uStack_23c = *(undefined4 *)((int64_t)puVar5 + 0xc);\r\n                   |                }\r\n    0x18380e80b    |                func_0x0001841c04a0(&var_a8h);\r\n    0x18380e81d    |                iVar9 = (int64_t)var_238h._7_1_;\r\n    0x18380e825    |                iVar8 = iVar9;\r\n    0x18380e825    |                if (iVar9 < 0) {\r\n    0x18380e825    |                    iVar8 = CONCAT44(uStack_23c, uStack_240);\r\n                   |                }\r\n    0x18380e82d    |                piVar6 = (int64_t *)CONCAT44(var_248h._4_4_, (undefined4)var_248h);\r\n    0x18380e82d    |                if (iVar9 >= 0) {\r\n    0x18380e82d    |                    piVar6 = &var_248h;\r\n                   |                }\r\n    0x18380e834    |                func_0x000184dcd0d0(uVar3, piVar6, iVar8);\r\n    0x18380e83e    |                if (var_238h < 0) {\r\n    0x18380e84f    |                    func_0x0001841dcbe0(CONCAT44(var_248h._4_4_, (undefined4)var_248h), var_238h & 0x7fffffffffffffff);\r\n                   |                }\r\n    0x18380e861    |                if (var_219h < '\\0') {\r\n    0x18380e87a    |                    func_0x0001841dcbe0(var_230h, CONCAT17(var_219h, var_220h) & 0x7fffffffffffffff);\r\n                   |                }\r\n    0x18380e87f    |                func_0x0001804b0120(&var_218h);\r\n                   |            }\r\n    0x18380e88c    |            func_0x00018556a010(arg1 + 0xc0, &var_218h);\r\n    0x18380e8a6    |            puVar5 = (undefined8 *)func_0x000184c155e0(&var_218h);\r\n    0x18380e8af    |            if (*(char *)((int64_t)puVar5 + 0x17) < '\\0') {\r\n    0x18380e8d1    |                func_0x0001841dd0f0(&var_a8h, *puVar5, puVar5[1]);\r\n                   |            } else {\r\n    0x18380e8b1    |                var_98h = puVar5[2];\r\n    0x18380e8bd    |                var_a8h._0_4_ = *(undefined4 *)puVar5;\r\n    0x18380e8bd    |                var_a8h._4_4_ = *(undefined4 *)((int64_t)puVar5 + 4);\r\n    0x18380e8bd    |                uStack_a0 = *(undefined4 *)(puVar5 + 1);\r\n    0x18380e8bd    |                uStack_9c = *(undefined4 *)((int64_t)puVar5 + 0xc);\r\n                   |            }\r\n    0x18380e8de    |            func_0x0001841c04a0(&var_218h);\r\n    0x18380e8f3    |            if ((char)var_b0h == '\\0') goto code_r0x00018380e97f;\r\n    0x18380e90f    |            uVar2 = func_0x00018381d2b0(iVar4, &var_c8h, &var_a8h);\r\n    0x18380e91b    |            if (var_98h < 0) {\r\n    0x18380e92f    |                func_0x0001841dcbe0(CONCAT44(var_a8h._4_4_, (undefined4)var_a8h), var_98h & 0x7fffffffffffffff);\r\n                   |            }\r\n    0x18380e944    |            var_288h = 0;\r\n    0x18380e944    |            uStack_280 = 0;\r\n    0x18380e948    |            uStack_278 = 0;\r\n    0x18380e93f    |            func_0x000180ebbdc0(&var_288h, 1);\r\n    0x18380e93f    |            func_0x0001828e1cc0(&var_288h, uVar2);\r\n    0x18380e967    |            piVar7 = &var_269h;\r\n    0x18380e975    |            func_0x000188ac5420(arg1, piVar7, &var_288h);\r\n    0x18380e97a    |            goto code_r0x00018380e689;\r\n                   |        }\r\n    0x18380e42d    |        if (*(int32_t *)0x191de85c0 < 3) {\r\n    0x18380e43a    |            func_0x00018030d390(&var_218h, 0x190c23650, 0x170, 2);\r\n    0x18380e468    |            uVar3 = func_0x000184dcd0d0(&var_208h, 0x1908fb27c, 6);\r\n    0x18380e47d    |            uVar3 = func_0x000184dcd0d0(uVar3, 0x190c23838, 0x33);\r\n    0x18380e492    |            uVar3 = func_0x000184dcd0d0(uVar3, 0x190c23aa8, 8);\r\n    0x18380e49f    |            if ((char)var_b0h == '\\0') goto code_r0x00018380e97f;\r\n    0x18380e4a8    |            func_0x00018380ccc0(&var_230h, &var_c8h);\r\n    0x18380e4c5    |            iVar4 = (int64_t)var_219h;\r\n    0x18380e4c5    |            piVar6 = &var_230h;\r\n    0x18380e4c5    |            if ((int64_t)var_219h < 0) {\r\n    0x18380e4cf    |                iVar4 = var_228h;\r\n    0x18380e4cf    |                piVar6 = (int64_t *)var_230h;\r\n                   |            }\r\n    0x18380e4da    |            uVar3 = func_0x000184dcd0d0(uVar3, piVar6, iVar4);\r\n    0x18380e4ef    |            uVar3 = func_0x000184dcd0d0(uVar3, 0x190c23a88, 8);\r\n    0x18380e4f7    |            func_0x00018556a010(arg1 + 0xc0, &var_a8h);\r\n    0x18380e511    |            puVar5 = (undefined8 *)func_0x000184c155e0(&var_a8h);\r\n    0x18380e51a    |            if (*(char *)((int64_t)puVar5 + 0x17) < '\\0') {\r\n    0x18380e536    |                func_0x0001841dd0f0(&var_248h, *puVar5, puVar5[1]);\r\n                   |            } else {\r\n    0x18380e51c    |                var_238h = puVar5[2];\r\n    0x18380e525    |                var_248h._0_4_ = *(undefined4 *)puVar5;\r\n    0x18380e525    |                var_248h._4_4_ = *(undefined4 *)((int64_t)puVar5 + 4);\r\n    0x18380e525    |                uStack_240 = *(undefined4 *)(puVar5 + 1);\r\n    0x18380e525    |                uStack_23c = *(undefined4 *)((int64_t)puVar5 + 0xc);\r\n                   |            }\r\n    0x18380e540    |            func_0x0001841c04a0(&var_a8h);\r\n    0x18380e552    |            iVar8 = (int64_t)var_238h._7_1_;\r\n    0x18380e55a    |            iVar4 = iVar8;\r\n    0x18380e55a    |            if (iVar8 < 0) {\r\n    0x18380e55a    |                iVar4 = CONCAT44(uStack_23c, uStack_240);\r\n                   |            }\r\n    0x18380e562    |            piVar6 = (int64_t *)CONCAT44(var_248h._4_4_, (undefined4)var_248h);\r\n    0x18380e562    |            if (iVar8 >= 0) {\r\n    0x18380e562    |                piVar6 = &var_248h;\r\n                   |            }\r\n    0x18380e569    |            func_0x000184dcd0d0(uVar3, piVar6, iVar4);\r\n    0x18380e573    |            if (var_238h < 0) {\r\n    0x18380e57d    |                func_0x0001841dcbe0(CONCAT44(var_248h._4_4_, (undefined4)var_248h), var_238h & 0x7fffffffffffffff);\r\n                   |            }\r\n    0x18380e58f    |            if (var_219h < '\\0') {\r\n    0x18380e5a1    |                func_0x0001841dcbe0(var_230h, CONCAT17(var_219h, var_220h) & 0x7fffffffffffffff);\r\n                   |            }\r\n    0x18380e5a6    |            func_0x0001804b0120(&var_218h);\r\n                   |        }\r\n    0x18380e5b8    |        *(undefined4 **)0x0 = (undefined4 *)func_0x000185f006b8(0x20);\r\n    0x18380e5c2    |        var_260h = 0x1f;\r\n    0x18380e5cf    |        var_258h = -0x7fffffffffffffe0;\r\n    0x18380e5f8    |        if (((undefined4 *)((int64_t)*(undefined4 **)0x0 + 0x1f) < *(undefined4 **)0x0) ||\r\n    0x18380e5f2    |           ((undefined4 *)0x190c236d0 < (undefined4 *)((int64_t)*(undefined4 **)0x0 + 0x1f) &&\r\n    0x18380e5eb    |            *(undefined4 **)0x0 < (undefined4 *)0x190c236d1)) goto code_r0x00018380e97f;\r\n    0x18380e605    |        *(undefined8 *)((int64_t)*(undefined4 **)0x0 + 0xf) = 0x6120746f6e206563;\r\n    0x18380e605    |        *(undefined8 *)((int64_t)*(undefined4 **)0x0 + 0x17) = 0x656c62616c696176;\r\n    0x18380e610    |        **(undefined4 **)0x0 = 0x4c626154;\r\n    0x18380e610    |        (*(undefined4 **)0x0)[1] = 0x6c61636f;\r\n    0x18380e610    |        (*(undefined4 **)0x0)[2] = 0x65535346;\r\n    0x18380e610    |        (*(undefined4 **)0x0)[3] = 0x63697672;\r\n    0x18380e613    |        *(undefined *)((int64_t)*(undefined4 **)0x0 + 0x1f) = 0;\r\n    0x18380e617    |        piVar7 = (int64_t *)&var_249h;\r\n    0x18380e61c    |        piVar6 = (int64_t *)((int64_t)&var_269h + 1);\r\n                   |    }\r\n    0x18380e684    |    func_0x000188ac4940(arg1, piVar7, piVar6);\r\n                   |code_r0x00018380e689:\r\n    0x18380e692    |    func_0x000188ac4bd0(arg1, arg2, piVar7);\r\n    0x18380e6a9    |    if (((char)var_b0h == '\\x01') && (var_b8h < 0)) {\r\n    0x18380e6c5    |        func_0x0001841dcbe0(var_c8h, var_b8h & 0x7fffffffffffffff);\r\n                   |    }\r\n    0x18380e6df    |    if (*(uint64_t *)0x191c71040 == (var_30h ^ (uint64_t)auStack_2a8)) {\r\n    0x18380e6f6    |        return arg2;\r\n                   |    }\r\n    0x18380e989    |    func_0x000185f05b40(var_30h ^ (uint64_t)auStack_2a8);\r\n    0x18380e991    |    pcVar1 = (code *)swi(3);\r\n    0x18380e991    |    iVar4 = (*pcVar1)();\r\n    0x18380e991    |    return iVar4;\r\n                   |}\r\n[{\"offset\":6501229456,\"name\":\"fcn.18380e390\",\"size\":1538,\"is-pure\":false,\"realsz\":1538,\"noreturn\":false,\"stackframe\":680,\"calltype\":\"ms\",\"cost\":445,\"cc\":30,\"loops\":1,\"bits\":64,\"type\":\"fcn\",\"nbbs\":51,\"edges\":75,\"ebbs\":3,\"signature\":\"fcn.18380e390(int64_t arg1, int64_t arg2, int64_t arg_1ffh);\",\"minbound\":6501229456,\"maxbound\":6501230994,\"callrefs\":[{\"from\":6501229529,\"to\":6502310480,\"type\":\"CALL\"},{\"from\":6501229563,\"to\":6501356784,\"type\":\"CALL\"},{\"from\":6501229577,\"to\":6512708384,\"type\":\"CALL\"},{\"from\":6501229646,\"to\":6445650832,\"type\":\"CALL\"},{\"from\":6501229672,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6501229693,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6501229714,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6501229752,\"to\":6501223616,\"type\":\"CALL\"},{\"from\":6501229786,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6501229807,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6501229833,\"to\":6532014096,\"type\":\"CALL\"},{\"from\":6501229841,\"to\":6522230240,\"type\":\"CALL\"},{\"from\":6501229869,\"to\":6501229888,\"type\":\"CODE\"},{\"from\":6501229883,\"to\":6511513840,\"type\":\"CALL\"},{\"from\":6501229896,\"to\":6511396000,\"type\":\"CALL\"},{\"from\":6501229929,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6501229954,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6501229985,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6501229998,\"to\":6447366432,\"type\":\"CALL\"},{\"from\":6501230008,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6501230113,\"to\":6501230206,\"type\":\"CODE\"},{\"from\":6501230212,\"to\":6587959616,\"type\":\"CALL\"},{\"from\":6501230226,\"to\":6587960272,\"type\":\"CALL\"},{\"from\":6501230277,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6501230382,\"to\":6445650832,\"type\":\"CALL\"},{\"from\":6501230408,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6501230429,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6501230467,\"to\":6501223616,\"type\":\"CALL\"},{\"from\":6501230501,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6501230522,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6501230548,\"to\":6532014096,\"type\":\"CALL\"},{\"from\":6501230556,\"to\":6522230240,\"type\":\"CALL\"},{\"from\":6501230584,\"to\":6501230603,\"type\":\"CODE\"},{\"from\":6501230598,\"to\":6511513840,\"type\":\"CALL\"},{\"from\":6501230611,\"to\":6511396000,\"type\":\"CALL\"},{\"from\":6501230644,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6501230676,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6501230714,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6501230727,\"to\":6447366432,\"type\":\"CALL\"},{\"from\":6501230750,\"to\":6532014096,\"type\":\"CALL\"},{\"from\":6501230758,\"to\":6522230240,\"type\":\"CALL\"},{\"from\":6501230792,\"to\":6501230814,\"type\":\"CODE\"},{\"from\":6501230809,\"to\":6511513840,\"type\":\"CALL\"},{\"from\":6501230822,\"to\":6511396000,\"type\":\"CALL\"},{\"from\":6501230863,\"to\":6501290672,\"type\":\"CALL\"},{\"from\":6501230903,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6501230936,\"to\":6457900480,\"type\":\"CALL\"},{\"from\":6501230946,\"to\":6485318848,\"type\":\"CALL\"},{\"from\":6501230965,\"to\":6587962400,\"type\":\"CALL\"},{\"from\":6501230970,\"to\":6501230217,\"type\":\"CODE\"},{\"from\":6501230988,\"to\":6542089024,\"type\":\"CALL\"}],\"datarefs\":[{\"from\":6501229470,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6501229585,\"to\":6742246848,\"type\":\"DATA\"},{\"from\":6501229619,\"to\":6723614288,\"type\":\"DATA\"},{\"from\":6501229659,\"to\":6720303740,\"type\":\"DATA\"},{\"from\":6501229677,\"to\":6723614776,\"type\":\"DATA\"},{\"from\":6501229698,\"to\":6723615400,\"type\":\"DATA\"},{\"from\":6501229791,\"to\":6723615368,\"type\":\"DATA\"},{\"from\":6501230049,\"to\":6723614416,\"type\":\"DATA\"},{\"from\":6501230078,\"to\":6723614431,\"type\":\"DATA\"},{\"from\":6501230089,\"to\":6723614416,\"type\":\"DATA\"},{\"from\":6501230127,\"to\":6716742096,\"type\":\"DATA\"},{\"from\":6501230162,\"to\":6716742112,\"type\":\"DATA\"},{\"from\":6501230182,\"to\":6716742096,\"type\":\"DATA\"},{\"from\":6501230293,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6501230335,\"to\":6741126112,\"type\":\"DATA\"},{\"from\":6501230344,\"to\":6742246856,\"type\":\"DATA\"},{\"from\":6501230358,\"to\":6723614288,\"type\":\"DATA\"},{\"from\":6501230395,\"to\":6720303740,\"type\":\"DATA\"},{\"from\":6501230413,\"to\":6723614832,\"type\":\"DATA\"},{\"from\":6501230506,\"to\":6723615368,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6501229869,\"to\":6501229888,\"type\":\"CODE\"},{\"from\":6501230113,\"to\":6501230206,\"type\":\"CODE\"},{\"from\":6501230584,\"to\":6501230603,\"type\":\"CODE\"},{\"from\":6501230792,\"to\":6501230814,\"type\":\"CODE\"},{\"from\":6501230970,\"to\":6501230217,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":5,\"outdegree\":46,\"nlocals\":23,\"nargs\":3,\"stackvars\":[{\"name\":\"var_288h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-648}},{\"name\":\"var_269h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-617}},{\"name\":\"var_268h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-616}},{\"name\":\"var_260h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-608}},{\"name\":\"var_258h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-600}},{\"name\":\"var_249h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-585}},{\"name\":\"var_248h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-584}},{\"name\":\"var_238h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-568}},{\"name\":\"var_230h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-560}},{\"name\":\"var_228h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-552}},{\"name\":\"var_220h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-544}},{\"name\":\"var_219h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-537}},{\"name\":\"var_218h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-536}},{\"name\":\"var_208h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-520}},{\"name\":\"var_e8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-232}},{\"name\":\"var_d6h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-214}},{\"name\":\"var_c9h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-201}},{\"name\":\"var_c8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-200}},{\"name\":\"var_b8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-184}},{\"name\":\"var_b0h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-176}},{\"name\":\"var_a8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-168}},{\"name\":\"var_98h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-152}},{\"name\":\"var_30h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-48}},{\"name\":\"arg_1ffh\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":511}}],\"regvars\":[{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"confidence":"observed","authority":"shipped-artifact","environment":null,"limitations":["The executable version and supported formats are reported as unknown because no reliable version probe was performed.","A non-zero process exit is preserved as an observed command result.","Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.","When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call."],"relationship_coverage":null,"locations":[{"kind":"artifact-path","path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"}],"evidence_links":[]},"meta":{"command":"execute-rizin-command","duration":"5227ms"}}