{"ok":true,"data":{"evidence_id":"ev_fd7440eef50fadbd7de18cd706f3cdda8335d1d1ab01721909549d2e78244d5e","subject":{"name":"Tabbit.dll","digest":{"sha256":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c"},"local_path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","format":"unknown","architecture":null},"provider":{"id":"rizin","name":"Rizin","version":null},"analysis_profile":null,"predicate_type":"rea.reverse-engineering.command-observation","operation":"execute_rizin_command","parameters":{"path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","command":"e scr.color=0;af @ 0x183824690;pdgo @ 0x183824690;afij @ 0x183824690","provider_executable":"C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe","command_arguments":["-N","-q","-c","e scr.color=0;af @ 0x183824690;pdgo @ 0x183824690;afij @ 0x183824690","C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"]},"raw_result":{"stdout":"                   |\r\n    0x183824690    |int64_t fcn.183824690(int64_t arg1, int64_t arg2, int64_t arg3, int64_t arg4, int64_t arg_28h)\r\n                   |{\r\n                   |    int32_t *piVar1;\r\n                   |    code *pcVar2;\r\n                   |    char cVar3;\r\n                   |    int32_t iVar4;\r\n                   |    undefined8 uVar5;\r\n                   |    int64_t iVar6;\r\n                   |    undefined8 *puVar7;\r\n                   |    undefined4 uVar8;\r\n                   |    int64_t var_170h;\r\n                   |    int64_t var_160h;\r\n                   |    int64_t var_158h;\r\n                   |    int64_t iStack_150;\r\n                   |    int64_t var_118h;\r\n                   |    int64_t var_108h;\r\n                   |    int64_t var_f0h;\r\n                   |    \r\n    0x1838246af    |    cVar3 = (*(code *)0x11c22ea4)();\r\n    0x1838246b7    |    if (cVar3 == '\\0') {\r\n    0x18382488e    |        func_0x0001842fee20(arg1, 0x190ca6410);\r\n                   |    }\r\n    0x1838246c5    |    puVar7 = *(undefined8 **)(arg1 + 0x18);\r\n    0x1838246cc    |    if (puVar7 != (undefined8 *)0x0) {\r\n                   |        do {\r\n    0x1838246e0    |            if ((uint64_t)arg3 < (uint64_t)puVar7[4]) {\r\n    0x1838246d4    |                puVar7 = (undefined8 *)*puVar7;\r\n                   |            } else {\r\n    0x1838246e2    |                if ((uint64_t)arg3 <= (uint64_t)puVar7[4]) {\r\n    0x1838246ed    |                    if (puVar7 != (undefined8 *)(arg1 + 0x18)) {\r\n    0x183824701    |                        if (0x7fffffff < *(uint64_t *)(arg_28h + 8)) {\r\n    0x1838248b5    |                            pcVar2 = (code *)swi(3);\r\n    0x1838248b5    |                            iVar6 = (*pcVar2)(puVar7 + 5);\r\n    0x1838248b5    |                            return iVar6;\r\n                   |                        }\r\n    0x18382470a    |                        iVar4 = func_0x000185a5a820(puVar7 + 5, arg4);\r\n    0x183824711    |                        if (-1 < iVar4) {\r\n    0x183824717    |                            uVar8 = 0;\r\n    0x183824719    |                            goto code_r0x00018382485f;\r\n                   |                        }\r\n    0x1838248c5    |                        if (*(int32_t *)0x191de85c0 < 3) {\r\n    0x1838248d2    |                            func_0x00018030d390(&var_170h, 0x190c23b08, 0x1d6, 2);\r\n    0x183824900    |                            uVar5 = func_0x000184dcd0d0(&var_160h, 0x1908fb27c, 6);\r\n    0x183824915    |                            uVar5 = func_0x000184dcd0d0(uVar5, 0x190c24cd8, 0x1e);\r\n    0x183824920    |                            uVar5 = func_0x0001813014a0(uVar5, arg3);\r\n    0x183824935    |                            uVar5 = func_0x000184dcd0d0(uVar5, 0x19014ff38, 8);\r\n    0x183824940    |                            uVar5 = func_0x000184dd1300(uVar5, arg4);\r\n    0x183824955    |                            uVar5 = func_0x000184dcd0d0(uVar5, 0x19028e144, 6);\r\n    0x183824961    |                            uVar5 = func_0x0001813014a0(uVar5, *(undefined8 *)(arg_28h + 8));\r\n    0x183824976    |                            uVar5 = func_0x000184dcd0d0(uVar5, 0x190c23bc0, 7);\r\n    0x183824983    |                            func_0x00018041ca10(uVar5, 5);\r\n    0x18382498f    |                            var_170h = 0x18ff81648;\r\n    0x1838248d2    |                            func_0x00018030e9d0(&var_170h);\r\n    0x1838249ab    |                            *(undefined8 *)((int64_t)&var_160h + (int64_t)*(int32_t *)(var_160h + 4)) = 0x18fe1b290;\r\n    0x1838249b7    |                            var_158h = 0x18fe20d40;\r\n    0x1838249c2    |                            if (var_108h._7_1_ < '\\0') {\r\n    0x1838249de    |                                func_0x0001841dcbe0(var_118h, \r\n    0x1838249ce    |                                                    CONCAT17(var_108h._7_1_, (unkbyte7)var_108h) & 0x7fffffffffffffff);\r\n                   |                            }\r\n    0x1838249ef    |                            var_158h = 0x18fe20db0;\r\n    0x183824a00    |                            if (iStack_150 != 0x191de1450) {\r\n    0x183824a29    |                                LOCK();\r\n    0x183824a29    |                                piVar1 = (int32_t *)(iStack_150 + 8);\r\n    0x183824a29    |                                iVar4 = *piVar1;\r\n    0x183824a29    |                                *piVar1 = *piVar1 + -1;\r\n    0x183824a29    |                                UNLOCK();\r\n    0x183824a30    |                                if (iVar4 == 0) {\r\n    0x183824a39    |                                    (*(code *)0x185f59da0)();\r\n                   |                                }\r\n                   |                            }\r\n    0x1838249e3    |                            func_0x00018424db70(&var_158h);\r\n    0x183824a02    |                            func_0x0001848f8b80(&var_f0h);\r\n                   |                        }\r\n    0x183824a1a    |                        uVar8 = 5;\r\n    0x183824a1f    |                        goto code_r0x00018382485d;\r\n                   |                    }\r\n                   |                    break;\r\n                   |                }\r\n    0x1838246e4    |                puVar7 = (undefined8 *)puVar7[1];\r\n                   |            }\r\n    0x1838246da    |        } while (puVar7 != (undefined8 *)0x0);\r\n                   |    }\r\n    0x18382471e    |    uVar8 = 9;\r\n    0x18382472a    |    if (*(int32_t *)0x191de85c0 < 3) {\r\n    0x183824737    |        func_0x00018030d390(&var_170h, 0x190c23b08, 0x1cf, 2);\r\n    0x183824765    |        uVar5 = func_0x000184dcd0d0(&var_160h, 0x1908fb27c, 6);\r\n    0x18382477a    |        uVar5 = func_0x000184dcd0d0(uVar5, 0x190c24cb0, 0x22);\r\n    0x183824785    |        uVar5 = func_0x0001813014a0(uVar5, arg3);\r\n    0x18382479a    |        uVar5 = func_0x000184dcd0d0(uVar5, 0x19014ff38, 8);\r\n    0x1838247a5    |        uVar5 = func_0x000184dd1300(uVar5, arg4);\r\n    0x1838247ba    |        uVar5 = func_0x000184dcd0d0(uVar5, 0x19028e144, 6);\r\n    0x1838247c6    |        func_0x0001813014a0(uVar5, *(undefined8 *)(arg_28h + 8));\r\n    0x1838247d2    |        var_170h = 0x18ff81648;\r\n    0x183824737    |        func_0x00018030e9d0(&var_170h);\r\n    0x1838247ee    |        *(undefined8 *)((int64_t)&var_160h + (int64_t)*(int32_t *)(var_160h + 4)) = 0x18fe1b290;\r\n    0x1838247fa    |        var_158h = 0x18fe20d40;\r\n    0x183824805    |        if (var_108h._7_1_ < '\\0') {\r\n    0x183824821    |            func_0x0001841dcbe0(var_118h, CONCAT17(var_108h._7_1_, (unkbyte7)var_108h) & 0x7fffffffffffffff);\r\n                   |        }\r\n    0x183824832    |        var_158h = 0x18fe20db0;\r\n    0x183824843    |        if (iStack_150 != 0x191de1450) {\r\n    0x18382489d    |            LOCK();\r\n    0x18382489d    |            piVar1 = (int32_t *)(iStack_150 + 8);\r\n    0x18382489d    |            iVar4 = *piVar1;\r\n    0x18382489d    |            *piVar1 = *piVar1 + -1;\r\n    0x18382489d    |            UNLOCK();\r\n    0x1838248a4    |            if (iVar4 == 0) {\r\n    0x1838248ad    |                (*(code *)0x185f59da0)();\r\n                   |            }\r\n                   |        }\r\n    0x183824826    |        func_0x00018424db70(&var_158h);\r\n    0x183824845    |        func_0x0001848f8b80(&var_f0h);\r\n                   |    }\r\n                   |code_r0x00018382485d:\r\n    0x18382485d    |    iVar4 = 0;\r\n                   |code_r0x00018382485f:\r\n    0x18382485f    |    *(int32_t *)arg2 = iVar4;\r\n    0x183824861    |    *(undefined4 *)(arg2 + 4) = uVar8;\r\n    0x183824867    |    (*(code *)0x11c22954)(arg1);\r\n    0x183824883    |    return arg2;\r\n                   |}\r\n[{\"offset\":6501320336,\"name\":\"fcn.183824690\",\"size\":945,\"is-pure\":false,\"realsz\":937,\"noreturn\":false,\"stackframe\":408,\"calltype\":\"ms\",\"cost\":307,\"cc\":18,\"loops\":8,\"bits\":64,\"type\":\"fcn\",\"nbbs\":31,\"edges\":45,\"ebbs\":2,\"signature\":\"fcn.183824690(int64_t arg1, int64_t arg2, int64_t arg3, int64_t arg4, int64_t arg_28h);\",\"minbound\":6501320336,\"maxbound\":6501321281,\"callrefs\":[{\"from\":6501320367,\"to\":6740380256,\"type\":\"CALL\"},{\"from\":6501320402,\"to\":6501320412,\"type\":\"CODE\"},{\"from\":6501320424,\"to\":6501320407,\"type\":\"CODE\"},{\"from\":6501320458,\"to\":6537193504,\"type\":\"CALL\"},{\"from\":6501320473,\"to\":6501320799,\"type\":\"CODE\"},{\"from\":6501320523,\"to\":6445650832,\"type\":\"CALL\"},{\"from\":6501320549,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6501320570,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6501320581,\"to\":6462379168,\"type\":\"CALL\"},{\"from\":6501320602,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6501320613,\"to\":6524048128,\"type\":\"CALL\"},{\"from\":6501320634,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6501320646,\"to\":6462379168,\"type\":\"CALL\"},{\"from\":6501320666,\"to\":6445656528,\"type\":\"CALL\"},{\"from\":6501320737,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6501320784,\"to\":6511975280,\"type\":\"CALL\"},{\"from\":6501320792,\"to\":6518967168,\"type\":\"CALL\"},{\"from\":6501320807,\"to\":6740379744,\"type\":\"CALL\"},{\"from\":6501320846,\"to\":6512700960,\"type\":\"CALL\"},{\"from\":6501320851,\"to\":6501320381,\"type\":\"CODE\"},{\"from\":6501320877,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6501320883,\"to\":6501320773,\"type\":\"CODE\"},{\"from\":6501320934,\"to\":6445650832,\"type\":\"CALL\"},{\"from\":6501320960,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6501320981,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6501320992,\"to\":6462379168,\"type\":\"CALL\"},{\"from\":6501321013,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6501321024,\"to\":6524048128,\"type\":\"CALL\"},{\"from\":6501321045,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6501321057,\"to\":6462379168,\"type\":\"CALL\"},{\"from\":6501321078,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6501321091,\"to\":6446762512,\"type\":\"CALL\"},{\"from\":6501321111,\"to\":6445656528,\"type\":\"CALL\"},{\"from\":6501321182,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6501321229,\"to\":6511975280,\"type\":\"CALL\"},{\"from\":6501321237,\"to\":6518967168,\"type\":\"CALL\"},{\"from\":6501321247,\"to\":6501320797,\"type\":\"CODE\"},{\"from\":6501321273,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6501321279,\"to\":6501321218,\"type\":\"CODE\"}],\"datarefs\":[{\"from\":6501320483,\"to\":6742246848,\"type\":\"DATA\"},{\"from\":6501320496,\"to\":6723615496,\"type\":\"DATA\"},{\"from\":6501320533,\"to\":6720303740,\"type\":\"DATA\"},{\"from\":6501320554,\"to\":6723620016,\"type\":\"DATA\"},{\"from\":6501320586,\"to\":6712262456,\"type\":\"DATA\"},{\"from\":6501320618,\"to\":6713565508,\"type\":\"DATA\"},{\"from\":6501320651,\"to\":6710367816,\"type\":\"DATA\"},{\"from\":6501320679,\"to\":6708900496,\"type\":\"DATA\"},{\"from\":6501320691,\"to\":6708923712,\"type\":\"DATA\"},{\"from\":6501320747,\"to\":6708923824,\"type\":\"DATA\"},{\"from\":6501320761,\"to\":6742217808,\"type\":\"DATA\"},{\"from\":6501320836,\"to\":6724150288,\"type\":\"DATA\"},{\"from\":6501320894,\"to\":6742246848,\"type\":\"DATA\"},{\"from\":6501320907,\"to\":6723615496,\"type\":\"DATA\"},{\"from\":6501320944,\"to\":6720303740,\"type\":\"DATA\"},{\"from\":6501320965,\"to\":6723620056,\"type\":\"DATA\"},{\"from\":6501320997,\"to\":6712262456,\"type\":\"DATA\"},{\"from\":6501321029,\"to\":6713565508,\"type\":\"DATA\"},{\"from\":6501321062,\"to\":6723615680,\"type\":\"DATA\"},{\"from\":6501321096,\"to\":6710367816,\"type\":\"DATA\"},{\"from\":6501321124,\"to\":6708900496,\"type\":\"DATA\"},{\"from\":6501321136,\"to\":6708923712,\"type\":\"DATA\"},{\"from\":6501321192,\"to\":6708923824,\"type\":\"DATA\"},{\"from\":6501321206,\"to\":6742217808,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6501320402,\"to\":6501320412,\"type\":\"CODE\"},{\"from\":6501320424,\"to\":6501320407,\"type\":\"CODE\"},{\"from\":6501320473,\"to\":6501320799,\"type\":\"CODE\"},{\"from\":6501320851,\"to\":6501320381,\"type\":\"CODE\"},{\"from\":6501320883,\"to\":6501320773,\"type\":\"CODE\"},{\"from\":6501321247,\"to\":6501320797,\"type\":\"CODE\"},{\"from\":6501321279,\"to\":6501321218,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":7,\"outdegree\":32,\"nlocals\":6,\"nargs\":5,\"stackvars\":[{\"name\":\"var_170h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-368}},{\"name\":\"var_160h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-352}},{\"name\":\"var_158h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-344}},{\"name\":\"var_118h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-280}},{\"name\":\"var_108h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-264}},{\"name\":\"var_f0h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-240}},{\"name\":\"arg_28h\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":40}}],\"regvars\":[{\"name\":\"arg3\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"r8\"}},{\"name\":\"arg4\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"r9\"}},{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"normalized_result":{"stdout":"                   |\r\n    0x183824690    |int64_t fcn.183824690(int64_t arg1, int64_t arg2, int64_t arg3, int64_t arg4, int64_t arg_28h)\r\n                   |{\r\n                   |    int32_t *piVar1;\r\n                   |    code *pcVar2;\r\n                   |    char cVar3;\r\n                   |    int32_t iVar4;\r\n                   |    undefined8 uVar5;\r\n                   |    int64_t iVar6;\r\n                   |    undefined8 *puVar7;\r\n                   |    undefined4 uVar8;\r\n                   |    int64_t var_170h;\r\n                   |    int64_t var_160h;\r\n                   |    int64_t var_158h;\r\n                   |    int64_t iStack_150;\r\n                   |    int64_t var_118h;\r\n                   |    int64_t var_108h;\r\n                   |    int64_t var_f0h;\r\n                   |    \r\n    0x1838246af    |    cVar3 = (*(code *)0x11c22ea4)();\r\n    0x1838246b7    |    if (cVar3 == '\\0') {\r\n    0x18382488e    |        func_0x0001842fee20(arg1, 0x190ca6410);\r\n                   |    }\r\n    0x1838246c5    |    puVar7 = *(undefined8 **)(arg1 + 0x18);\r\n    0x1838246cc    |    if (puVar7 != (undefined8 *)0x0) {\r\n                   |        do {\r\n    0x1838246e0    |            if ((uint64_t)arg3 < (uint64_t)puVar7[4]) {\r\n    0x1838246d4    |                puVar7 = (undefined8 *)*puVar7;\r\n                   |            } else {\r\n    0x1838246e2    |                if ((uint64_t)arg3 <= (uint64_t)puVar7[4]) {\r\n    0x1838246ed    |                    if (puVar7 != (undefined8 *)(arg1 + 0x18)) {\r\n    0x183824701    |                        if (0x7fffffff < *(uint64_t *)(arg_28h + 8)) {\r\n    0x1838248b5    |                            pcVar2 = (code *)swi(3);\r\n    0x1838248b5    |                            iVar6 = (*pcVar2)(puVar7 + 5);\r\n    0x1838248b5    |                            return iVar6;\r\n                   |                        }\r\n    0x18382470a    |                        iVar4 = func_0x000185a5a820(puVar7 + 5, arg4);\r\n    0x183824711    |                        if (-1 < iVar4) {\r\n    0x183824717    |                            uVar8 = 0;\r\n    0x183824719    |                            goto code_r0x00018382485f;\r\n                   |                        }\r\n    0x1838248c5    |                        if (*(int32_t *)0x191de85c0 < 3) {\r\n    0x1838248d2    |                            func_0x00018030d390(&var_170h, 0x190c23b08, 0x1d6, 2);\r\n    0x183824900    |                            uVar5 = func_0x000184dcd0d0(&var_160h, 0x1908fb27c, 6);\r\n    0x183824915    |                            uVar5 = func_0x000184dcd0d0(uVar5, 0x190c24cd8, 0x1e);\r\n    0x183824920    |                            uVar5 = func_0x0001813014a0(uVar5, arg3);\r\n    0x183824935    |                            uVar5 = func_0x000184dcd0d0(uVar5, 0x19014ff38, 8);\r\n    0x183824940    |                            uVar5 = func_0x000184dd1300(uVar5, arg4);\r\n    0x183824955    |                            uVar5 = func_0x000184dcd0d0(uVar5, 0x19028e144, 6);\r\n    0x183824961    |                            uVar5 = func_0x0001813014a0(uVar5, *(undefined8 *)(arg_28h + 8));\r\n    0x183824976    |                            uVar5 = func_0x000184dcd0d0(uVar5, 0x190c23bc0, 7);\r\n    0x183824983    |                            func_0x00018041ca10(uVar5, 5);\r\n    0x18382498f    |                            var_170h = 0x18ff81648;\r\n    0x1838248d2    |                            func_0x00018030e9d0(&var_170h);\r\n    0x1838249ab    |                            *(undefined8 *)((int64_t)&var_160h + (int64_t)*(int32_t *)(var_160h + 4)) = 0x18fe1b290;\r\n    0x1838249b7    |                            var_158h = 0x18fe20d40;\r\n    0x1838249c2    |                            if (var_108h._7_1_ < '\\0') {\r\n    0x1838249de    |                                func_0x0001841dcbe0(var_118h, \r\n    0x1838249ce    |                                                    CONCAT17(var_108h._7_1_, (unkbyte7)var_108h) & 0x7fffffffffffffff);\r\n                   |                            }\r\n    0x1838249ef    |                            var_158h = 0x18fe20db0;\r\n    0x183824a00    |                            if (iStack_150 != 0x191de1450) {\r\n    0x183824a29    |                                LOCK();\r\n    0x183824a29    |                                piVar1 = (int32_t *)(iStack_150 + 8);\r\n    0x183824a29    |                                iVar4 = *piVar1;\r\n    0x183824a29    |                                *piVar1 = *piVar1 + -1;\r\n    0x183824a29    |                                UNLOCK();\r\n    0x183824a30    |                                if (iVar4 == 0) {\r\n    0x183824a39    |                                    (*(code *)0x185f59da0)();\r\n                   |                                }\r\n                   |                            }\r\n    0x1838249e3    |                            func_0x00018424db70(&var_158h);\r\n    0x183824a02    |                            func_0x0001848f8b80(&var_f0h);\r\n                   |                        }\r\n    0x183824a1a    |                        uVar8 = 5;\r\n    0x183824a1f    |                        goto code_r0x00018382485d;\r\n                   |                    }\r\n                   |                    break;\r\n                   |                }\r\n    0x1838246e4    |                puVar7 = (undefined8 *)puVar7[1];\r\n                   |            }\r\n    0x1838246da    |        } while (puVar7 != (undefined8 *)0x0);\r\n                   |    }\r\n    0x18382471e    |    uVar8 = 9;\r\n    0x18382472a    |    if (*(int32_t *)0x191de85c0 < 3) {\r\n    0x183824737    |        func_0x00018030d390(&var_170h, 0x190c23b08, 0x1cf, 2);\r\n    0x183824765    |        uVar5 = func_0x000184dcd0d0(&var_160h, 0x1908fb27c, 6);\r\n    0x18382477a    |        uVar5 = func_0x000184dcd0d0(uVar5, 0x190c24cb0, 0x22);\r\n    0x183824785    |        uVar5 = func_0x0001813014a0(uVar5, arg3);\r\n    0x18382479a    |        uVar5 = func_0x000184dcd0d0(uVar5, 0x19014ff38, 8);\r\n    0x1838247a5    |        uVar5 = func_0x000184dd1300(uVar5, arg4);\r\n    0x1838247ba    |        uVar5 = func_0x000184dcd0d0(uVar5, 0x19028e144, 6);\r\n    0x1838247c6    |        func_0x0001813014a0(uVar5, *(undefined8 *)(arg_28h + 8));\r\n    0x1838247d2    |        var_170h = 0x18ff81648;\r\n    0x183824737    |        func_0x00018030e9d0(&var_170h);\r\n    0x1838247ee    |        *(undefined8 *)((int64_t)&var_160h + (int64_t)*(int32_t *)(var_160h + 4)) = 0x18fe1b290;\r\n    0x1838247fa    |        var_158h = 0x18fe20d40;\r\n    0x183824805    |        if (var_108h._7_1_ < '\\0') {\r\n    0x183824821    |            func_0x0001841dcbe0(var_118h, CONCAT17(var_108h._7_1_, (unkbyte7)var_108h) & 0x7fffffffffffffff);\r\n                   |        }\r\n    0x183824832    |        var_158h = 0x18fe20db0;\r\n    0x183824843    |        if (iStack_150 != 0x191de1450) {\r\n    0x18382489d    |            LOCK();\r\n    0x18382489d    |            piVar1 = (int32_t *)(iStack_150 + 8);\r\n    0x18382489d    |            iVar4 = *piVar1;\r\n    0x18382489d    |            *piVar1 = *piVar1 + -1;\r\n    0x18382489d    |            UNLOCK();\r\n    0x1838248a4    |            if (iVar4 == 0) {\r\n    0x1838248ad    |                (*(code *)0x185f59da0)();\r\n                   |            }\r\n                   |        }\r\n    0x183824826    |        func_0x00018424db70(&var_158h);\r\n    0x183824845    |        func_0x0001848f8b80(&var_f0h);\r\n                   |    }\r\n                   |code_r0x00018382485d:\r\n    0x18382485d    |    iVar4 = 0;\r\n                   |code_r0x00018382485f:\r\n    0x18382485f    |    *(int32_t *)arg2 = iVar4;\r\n    0x183824861    |    *(undefined4 *)(arg2 + 4) = uVar8;\r\n    0x183824867    |    (*(code *)0x11c22954)(arg1);\r\n    0x183824883    |    return arg2;\r\n                   |}\r\n[{\"offset\":6501320336,\"name\":\"fcn.183824690\",\"size\":945,\"is-pure\":false,\"realsz\":937,\"noreturn\":false,\"stackframe\":408,\"calltype\":\"ms\",\"cost\":307,\"cc\":18,\"loops\":8,\"bits\":64,\"type\":\"fcn\",\"nbbs\":31,\"edges\":45,\"ebbs\":2,\"signature\":\"fcn.183824690(int64_t arg1, int64_t arg2, int64_t arg3, int64_t arg4, int64_t arg_28h);\",\"minbound\":6501320336,\"maxbound\":6501321281,\"callrefs\":[{\"from\":6501320367,\"to\":6740380256,\"type\":\"CALL\"},{\"from\":6501320402,\"to\":6501320412,\"type\":\"CODE\"},{\"from\":6501320424,\"to\":6501320407,\"type\":\"CODE\"},{\"from\":6501320458,\"to\":6537193504,\"type\":\"CALL\"},{\"from\":6501320473,\"to\":6501320799,\"type\":\"CODE\"},{\"from\":6501320523,\"to\":6445650832,\"type\":\"CALL\"},{\"from\":6501320549,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6501320570,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6501320581,\"to\":6462379168,\"type\":\"CALL\"},{\"from\":6501320602,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6501320613,\"to\":6524048128,\"type\":\"CALL\"},{\"from\":6501320634,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6501320646,\"to\":6462379168,\"type\":\"CALL\"},{\"from\":6501320666,\"to\":6445656528,\"type\":\"CALL\"},{\"from\":6501320737,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6501320784,\"to\":6511975280,\"type\":\"CALL\"},{\"from\":6501320792,\"to\":6518967168,\"type\":\"CALL\"},{\"from\":6501320807,\"to\":6740379744,\"type\":\"CALL\"},{\"from\":6501320846,\"to\":6512700960,\"type\":\"CALL\"},{\"from\":6501320851,\"to\":6501320381,\"type\":\"CODE\"},{\"from\":6501320877,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6501320883,\"to\":6501320773,\"type\":\"CODE\"},{\"from\":6501320934,\"to\":6445650832,\"type\":\"CALL\"},{\"from\":6501320960,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6501320981,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6501320992,\"to\":6462379168,\"type\":\"CALL\"},{\"from\":6501321013,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6501321024,\"to\":6524048128,\"type\":\"CALL\"},{\"from\":6501321045,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6501321057,\"to\":6462379168,\"type\":\"CALL\"},{\"from\":6501321078,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6501321091,\"to\":6446762512,\"type\":\"CALL\"},{\"from\":6501321111,\"to\":6445656528,\"type\":\"CALL\"},{\"from\":6501321182,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6501321229,\"to\":6511975280,\"type\":\"CALL\"},{\"from\":6501321237,\"to\":6518967168,\"type\":\"CALL\"},{\"from\":6501321247,\"to\":6501320797,\"type\":\"CODE\"},{\"from\":6501321273,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6501321279,\"to\":6501321218,\"type\":\"CODE\"}],\"datarefs\":[{\"from\":6501320483,\"to\":6742246848,\"type\":\"DATA\"},{\"from\":6501320496,\"to\":6723615496,\"type\":\"DATA\"},{\"from\":6501320533,\"to\":6720303740,\"type\":\"DATA\"},{\"from\":6501320554,\"to\":6723620016,\"type\":\"DATA\"},{\"from\":6501320586,\"to\":6712262456,\"type\":\"DATA\"},{\"from\":6501320618,\"to\":6713565508,\"type\":\"DATA\"},{\"from\":6501320651,\"to\":6710367816,\"type\":\"DATA\"},{\"from\":6501320679,\"to\":6708900496,\"type\":\"DATA\"},{\"from\":6501320691,\"to\":6708923712,\"type\":\"DATA\"},{\"from\":6501320747,\"to\":6708923824,\"type\":\"DATA\"},{\"from\":6501320761,\"to\":6742217808,\"type\":\"DATA\"},{\"from\":6501320836,\"to\":6724150288,\"type\":\"DATA\"},{\"from\":6501320894,\"to\":6742246848,\"type\":\"DATA\"},{\"from\":6501320907,\"to\":6723615496,\"type\":\"DATA\"},{\"from\":6501320944,\"to\":6720303740,\"type\":\"DATA\"},{\"from\":6501320965,\"to\":6723620056,\"type\":\"DATA\"},{\"from\":6501320997,\"to\":6712262456,\"type\":\"DATA\"},{\"from\":6501321029,\"to\":6713565508,\"type\":\"DATA\"},{\"from\":6501321062,\"to\":6723615680,\"type\":\"DATA\"},{\"from\":6501321096,\"to\":6710367816,\"type\":\"DATA\"},{\"from\":6501321124,\"to\":6708900496,\"type\":\"DATA\"},{\"from\":6501321136,\"to\":6708923712,\"type\":\"DATA\"},{\"from\":6501321192,\"to\":6708923824,\"type\":\"DATA\"},{\"from\":6501321206,\"to\":6742217808,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6501320402,\"to\":6501320412,\"type\":\"CODE\"},{\"from\":6501320424,\"to\":6501320407,\"type\":\"CODE\"},{\"from\":6501320473,\"to\":6501320799,\"type\":\"CODE\"},{\"from\":6501320851,\"to\":6501320381,\"type\":\"CODE\"},{\"from\":6501320883,\"to\":6501320773,\"type\":\"CODE\"},{\"from\":6501321247,\"to\":6501320797,\"type\":\"CODE\"},{\"from\":6501321279,\"to\":6501321218,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":7,\"outdegree\":32,\"nlocals\":6,\"nargs\":5,\"stackvars\":[{\"name\":\"var_170h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-368}},{\"name\":\"var_160h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-352}},{\"name\":\"var_158h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-344}},{\"name\":\"var_118h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-280}},{\"name\":\"var_108h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-264}},{\"name\":\"var_f0h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-240}},{\"name\":\"arg_28h\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":40}}],\"regvars\":[{\"name\":\"arg3\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"r8\"}},{\"name\":\"arg4\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"r9\"}},{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"confidence":"observed","authority":"shipped-artifact","environment":null,"limitations":["The executable version and supported formats are reported as unknown because no reliable version probe was performed.","A non-zero process exit is preserved as an observed command result.","Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.","When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call."],"relationship_coverage":null,"locations":[{"kind":"artifact-path","path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"}],"evidence_links":[]},"meta":{"command":"execute-rizin-command","duration":"4969ms"}}