{"ok":true,"data":{"evidence_id":"ev_ce332c4225abd15ca106920ebc125d6d6d72c57a3bac8791c25dc853db62bd38","subject":{"name":"Tabbit.dll","digest":{"sha256":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c"},"local_path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","format":"unknown","architecture":null},"provider":{"id":"rizin","name":"Rizin","version":null},"analysis_profile":null,"predicate_type":"rea.reverse-engineering.command-observation","operation":"execute_rizin_command","parameters":{"path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","command":"e scr.color=0;af @ 0x1838203b0;pdgo @ 0x1838203b0;afij @ 0x1838203b0","provider_executable":"C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe","command_arguments":["-N","-q","-c","e scr.color=0;af @ 0x1838203b0;pdgo @ 0x1838203b0;afij @ 0x1838203b0","C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"]},"raw_result":{"stdout":"    0x1838203b0    |\r\n    0x1838203b0    |// WARNING: [rz-ghidra] Detected overlap for variable var_78h\r\n    0x1838203b0    |// WARNING: [rz-ghidra] Detected overlap for variable var_51h\r\n    0x1838203b0    |// WARNING: [rz-ghidra] Detected overlap for variable var_58h\r\n    0x1838203b0    |// WARNING: [rz-ghidra] Detected overlap for variable var_b0h\r\n    0x1838203b0    |// WARNING: [rz-ghidra] Detected overlap for variable var_a8h\r\n                   |\r\n    0x1838203b0    |void fcn.1838203b0(undefined8 placeholder_0, undefined8 placeholder_1, int64_t arg3, int64_t arg4, int64_t arg_28h,\r\n                   |                  int64_t arg_30h, int64_t arg_78h)\r\n                   |{\r\n                   |    int32_t *piVar1;\r\n                   |    code *pcVar2;\r\n                   |    char cVar3;\r\n                   |    undefined4 *puVar4;\r\n                   |    int64_t iVar5;\r\n                   |    uint64_t uVar6;\r\n                   |    undefined auStack_d8 [32];\r\n                   |    int64_t var_b8h;\r\n                   |    undefined var_b0h [4];\r\n                   |    int64_t var_ach;\r\n                   |    int64_t var_a1h;\r\n                   |    int64_t var_98h;\r\n                   |    int64_t var_90h;\r\n                   |    int64_t var_88h;\r\n                   |    int64_t var_80h;\r\n                   |    undefined var_78h [7];\r\n                   |    int64_t var_71h;\r\n                   |    int64_t var_68h;\r\n                   |    int64_t var_60h;\r\n                   |    int64_t var_58h;\r\n                   |    int64_t var_50h;\r\n                   |    int64_t var_48h;\r\n                   |    \r\n    0x1838203e4    |    var_50h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_d8;\r\n    0x1838203f7    |    var_68h = 0;\r\n    0x1838203f7    |    var_60h = 0;\r\n    0x1838203fb    |    var_58h = 0;\r\n    0x183820403    |    cVar3 = func_0x00018381e110(placeholder_0, placeholder_1, arg_28h);\r\n    0x18382040a    |    if (cVar3 == '\\0') {\r\n    0x18382041f    |        var_b8h = func_0x000185f006b8(0x20);\r\n    0x183820429    |        _var_b0h = 0x1e;\r\n    0x183820436    |        stack0xffffffffffffff58 = 0x8000000000000020;\r\n    0x183820442    |        if ((undefined4 *)(var_b8h + 0x1e) < (uint64_t)var_b8h) goto code_r0x000183820762;\r\n    0x18382045f    |        if ((undefined4 *)0x190c24398 < (undefined4 *)(var_b8h + 0x1e) && (uint64_t)var_b8h < (undefined4 *)0x190c24399)\r\n    0x18382045f    |        goto code_r0x000183820762;\r\n    0x18382046c    |        *(undefined8 *)(var_b8h + 0xe) = 0x6f20656c646e6168;\r\n    0x18382046c    |        *(undefined8 *)(var_b8h + 0x16) = 0x6e696769726f2072;\r\n    0x183820477    |        *(undefined4 *)var_b8h = 0x61766e49;\r\n    0x183820477    |        *(undefined4 *)(var_b8h + 4) = 0x2064696c;\r\n    0x183820477    |        *(undefined4 *)(var_b8h + 8) = 0x6e756f6d;\r\n    0x183820477    |        *(undefined4 *)(var_b8h + 0xc) = 0x61682074;\r\n    0x18382047a    |        *(undefined *)(var_b8h + 0x1e) = 0;\r\n    0x18382047e    |        piVar1 = *(int32_t **)arg_30h;\r\n    0x183820484    |        if (piVar1 == (int32_t *)0x0) {\r\n    0x183820764    |            pcVar2 = (code *)swi(3);\r\n    0x183820764    |            (*pcVar2)();\r\n    0x183820764    |            return;\r\n                   |        }\r\n    0x18382048a    |        *(undefined8 *)arg_30h = 0;\r\n    0x18382049f    |        (*(code *)0x185f59da0)(piVar1, 0, &var_b8h);\r\n    0x1838204a5    |        LOCK();\r\n    0x1838204a5    |        *piVar1 = *piVar1 + -1;\r\n    0x1838204a5    |        UNLOCK();\r\n    0x1838204a8    |        if (*piVar1 == 0) {\r\n    0x1838204b1    |            (*(code *)0x185f59da0)(piVar1);\r\n                   |        }\r\n    0x1838204bc    |        if ((int64_t)stack0xffffffffffffff58 < 0) {\r\n    0x1838204c2    |            uVar6 = stack0xffffffffffffff58 & 0x7fffffffffffffff;\r\n    0x1838204cf    |            iVar5 = var_b8h;\r\n    0x1838204cf    |            goto code_r0x0001838206cd;\r\n                   |        }\r\n                   |    } else {\r\n    0x1838204d9    |        var_88h = 0;\r\n    0x1838204d9    |        var_80h = 0;\r\n    0x1838204dd    |        _var_78h = 0;\r\n    0x1838204ed    |        cVar3 = func_0x00018381ed30(&var_68h, arg3);\r\n    0x1838204f4    |        if (cVar3 == '\\0') {\r\n    0x1838204ff    |            stack0xffffffffffffff58 = CONCAT17(0xc, stack0xffffffffffffff58);\r\n    0x18382051d    |            if ((int64_t *)0x190c243b8 < &var_ach && &var_b8h < (int64_t *)0x190c243b9) goto code_r0x000183820762;\r\n    0x18382052d    |            var_b8h = 0x2064696c61766e49;\r\n    0x18382053a    |            _var_b0h = CONCAT35(var_ach._1_3_, 0x68746170);\r\n    0x18382053f    |            piVar1 = *(int32_t **)arg_30h;\r\n    0x183820545    |            if (piVar1 == (int32_t *)0x0) {\r\n    0x183820767    |                pcVar2 = (code *)swi(3);\r\n    0x183820767    |                (*pcVar2)();\r\n    0x183820767    |                return;\r\n                   |            }\r\n    0x18382054b    |            *(undefined8 *)arg_30h = 0;\r\n    0x183820560    |            (*(code *)0x185f59da0)(piVar1, 0, &var_b8h);\r\n    0x183820566    |            LOCK();\r\n    0x183820566    |            *piVar1 = *piVar1 + -1;\r\n    0x183820566    |            UNLOCK();\r\n    0x183820569    |            if (*piVar1 == 0) {\r\n    0x183820572    |                (*(code *)0x185f59da0)(piVar1);\r\n                   |            }\r\n    0x18382057d    |            if ((int64_t)stack0xffffffffffffff58 < 0) {\r\n    0x183820597    |                func_0x0001841dcbe0(var_b8h, stack0xffffffffffffff58 & 0x7fffffffffffffff);\r\n                   |            }\r\n                   |        } else {\r\n    0x1838205bc    |            var_90h = func_0x000185f006b8(0x30);\r\n    0x1838205c6    |            *(undefined4 *)var_90h = 1;\r\n    0x1838205cf    |            *(undefined8 *)(var_90h + 8) = 0x183829ca0;\r\n    0x1838205da    |            *(undefined8 *)(var_90h + 0x10) = 0x183283eb0;\r\n    0x1838205e5    |            *(undefined8 *)(var_90h + 0x18) = 0x1841d75d0;\r\n    0x1838205ec    |            *(undefined8 *)(var_90h + 0x28) = *(undefined8 *)arg_30h;\r\n    0x1838205f0    |            *(undefined8 *)arg_30h = 0;\r\n    0x183820601    |            puVar4 = (undefined4 *)func_0x000185f006b8(0x60);\r\n    0x18382060c    |            *puVar4 = 1;\r\n    0x183820615    |            *(undefined8 *)(puVar4 + 2) = 0x183829d60;\r\n    0x183820620    |            *(undefined8 *)(puVar4 + 4) = 0x183829af0;\r\n    0x183820624    |            *(undefined8 *)(puVar4 + 6) = 0x1841d75d0;\r\n    0x18382062f    |            *(undefined8 *)(puVar4 + 8) = 0x1838164b0;\r\n    0x18382063c    |            if (_var_78h < 0) {\r\n    0x183820633    |                func_0x000184c2f840(puVar4 + 10, var_88h, var_80h);\r\n                   |            } else {\r\n    0x1838205a6    |                *(int64_t *)(puVar4 + 0xe) = _var_78h;\r\n    0x1838205af    |                puVar4[10] = (undefined4)var_88h;\r\n    0x1838205af    |                puVar4[0xb] = var_88h._4_4_;\r\n    0x1838205af    |                puVar4[0xc] = (undefined4)var_80h;\r\n    0x1838205af    |                puVar4[0xd] = var_80h._4_4_;\r\n                   |            }\r\n    0x183820651    |            puVar4[0x10] = (int32_t)arg4;\r\n    0x183820661    |            if (var_58h < 0) {\r\n    0x183820655    |                func_0x000184c2f840(puVar4 + 0x12, var_68h, var_60h);\r\n                   |            } else {\r\n    0x183820741    |                *(int64_t *)(puVar4 + 0x16) = var_58h;\r\n    0x18382074a    |                puVar4[0x12] = (undefined4)var_68h;\r\n    0x18382074a    |                puVar4[0x13] = var_68h._4_4_;\r\n    0x18382074a    |                puVar4[0x14] = (undefined4)var_60h;\r\n    0x18382074a    |                puVar4[0x15] = var_60h._4_4_;\r\n                   |            }\r\n    0x18382069d    |            var_98h = (int64_t)puVar4;\r\n    0x18382068f    |            func_0x000184339cd0(&var_b8h, 0x190c24450, 0x190c23b08, 0x677);\r\n    0x18382068f    |            func_0x0001833e5880(&var_b8h, 0x190c24447, &var_98h, &var_90h);\r\n                   |        }\r\n    0x1838206be    |        if (_var_78h < 0) {\r\n    0x1838206ca    |            uVar6 = _var_78h * 2;\r\n    0x1838206ca    |            iVar5 = var_88h;\r\n                   |code_r0x0001838206cd:\r\n    0x1838206cd    |            func_0x0001841dcbe0(iVar5, uVar6);\r\n                   |        }\r\n                   |    }\r\n    0x1838206da    |    if (var_58h < 0) {\r\n    0x1838206ec    |        func_0x0001841dcbe0(var_68h, var_58h * 2);\r\n                   |    }\r\n    0x1838206f1    |    piVar1 = *(int32_t **)arg_30h;\r\n    0x1838206f7    |    if (piVar1 != (int32_t *)0x0) {\r\n    0x183820728    |        LOCK();\r\n    0x183820728    |        *piVar1 = *piVar1 + -1;\r\n    0x183820728    |        UNLOCK();\r\n    0x18382072b    |        if (*piVar1 == 0) {\r\n    0x183820731    |            (*(code *)0x185f59da0)();\r\n                   |        }\r\n                   |    }\r\n    0x18382070e    |    if (*(uint64_t *)0x191c71040 == (var_50h ^ (uint64_t)auStack_d8)) {\r\n    0x183820727    |        return;\r\n                   |    }\r\n    0x18382075a    |    func_0x000185f05b40(var_50h ^ (uint64_t)auStack_d8);\r\n                   |code_r0x000183820762:\r\n    0x183820762    |    // WARNING: Does not return\r\n    0x183820762    |    pcVar2 = (code *)invalidInstructionException();\r\n    0x183820762    |    (*pcVar2)();\r\n                   |}\r\n[{\"offset\":6501303216,\"name\":\"fcn.1838203b0\",\"size\":952,\"is-pure\":false,\"realsz\":950,\"noreturn\":false,\"stackframe\":216,\"calltype\":\"ms\",\"cost\":276,\"cc\":22,\"loops\":4,\"bits\":64,\"type\":\"fcn\",\"nbbs\":36,\"edges\":50,\"ebbs\":4,\"signature\":\"fcn.1838203b0(int64_t arg3, int64_t arg4, int64_t arg_28h, int64_t arg_30h, int64_t arg_78h);\",\"minbound\":6501303216,\"maxbound\":6501304168,\"callrefs\":[{\"from\":6501303299,\"to\":6501294352,\"type\":\"CALL\"},{\"from\":6501303327,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6501303455,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6501303473,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6501303503,\"to\":6501304013,\"type\":\"CODE\"},{\"from\":6501303533,\"to\":6501297456,\"type\":\"CALL\"},{\"from\":6501303648,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6501303666,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6501303703,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6501303708,\"to\":6501303993,\"type\":\"CODE\"},{\"from\":6501303730,\"to\":6501303889,\"type\":\"CODE\"},{\"from\":6501303740,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6501303809,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6501303884,\"to\":6522337344,\"type\":\"CALL\"},{\"from\":6501303924,\"to\":6522337344,\"type\":\"CALL\"},{\"from\":6501303965,\"to\":6512942288,\"type\":\"CALL\"},{\"from\":6501303988,\"to\":6496868480,\"type\":\"CALL\"},{\"from\":6501304013,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6501304044,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6501304113,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6501304119,\"to\":6501304057,\"type\":\"CODE\"},{\"from\":6501304141,\"to\":6501303929,\"type\":\"CODE\"},{\"from\":6501304157,\"to\":6542089024,\"type\":\"CALL\"}],\"datarefs\":[{\"from\":6501303261,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6501303368,\"to\":6723617688,\"type\":\"DATA\"},{\"from\":6501303397,\"to\":6723617702,\"type\":\"DATA\"},{\"from\":6501303408,\"to\":6723617688,\"type\":\"DATA\"},{\"from\":6501303555,\"to\":6723617720,\"type\":\"DATA\"},{\"from\":6501303752,\"to\":6501342368,\"type\":\"DATA\"},{\"from\":6501303763,\"to\":6495420080,\"type\":\"DATA\"},{\"from\":6501303774,\"to\":6511490512,\"type\":\"DATA\"},{\"from\":6501303822,\"to\":6501342560,\"type\":\"DATA\"},{\"from\":6501303833,\"to\":6501341936,\"type\":\"DATA\"},{\"from\":6501303848,\"to\":6501262512,\"type\":\"DATA\"},{\"from\":6501303937,\"to\":6723617872,\"type\":\"DATA\"},{\"from\":6501303944,\"to\":6723615496,\"type\":\"DATA\"},{\"from\":6501303970,\"to\":6723617863,\"type\":\"DATA\"},{\"from\":6501304068,\"to\":6740709440,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6501303503,\"to\":6501304013,\"type\":\"CODE\"},{\"from\":6501303708,\"to\":6501303993,\"type\":\"CODE\"},{\"from\":6501303730,\"to\":6501303889,\"type\":\"CODE\"},{\"from\":6501304119,\"to\":6501304057,\"type\":\"CODE\"},{\"from\":6501304141,\"to\":6501303929,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":5,\"outdegree\":18,\"nlocals\":17,\"nargs\":5,\"stackvars\":[{\"name\":\"var_b8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-184}},{\"name\":\"var_b0h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-176}},{\"name\":\"var_ach\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-172}},{\"name\":\"var_a8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-168}},{\"name\":\"var_a1h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-161}},{\"name\":\"var_98h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-152}},{\"name\":\"var_90h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-144}},{\"name\":\"var_88h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-136}},{\"name\":\"var_80h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-128}},{\"name\":\"var_78h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-120}},{\"name\":\"var_71h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-113}},{\"name\":\"var_68h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-104}},{\"name\":\"var_60h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-96}},{\"name\":\"var_58h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-88}},{\"name\":\"var_51h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-81}},{\"name\":\"var_50h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-80}},{\"name\":\"var_48h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-72}},{\"name\":\"arg_28h\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":40}},{\"name\":\"arg_30h\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":48}},{\"name\":\"arg_78h\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":120}}],\"regvars\":[{\"name\":\"arg3\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"r8\"}},{\"name\":\"arg4\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"r9\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"normalized_result":{"stdout":"    0x1838203b0    |\r\n    0x1838203b0    |// WARNING: [rz-ghidra] Detected overlap for variable var_78h\r\n    0x1838203b0    |// WARNING: [rz-ghidra] Detected overlap for variable var_51h\r\n    0x1838203b0    |// WARNING: [rz-ghidra] Detected overlap for variable var_58h\r\n    0x1838203b0    |// WARNING: [rz-ghidra] Detected overlap for variable var_b0h\r\n    0x1838203b0    |// WARNING: [rz-ghidra] Detected overlap for variable var_a8h\r\n                   |\r\n    0x1838203b0    |void fcn.1838203b0(undefined8 placeholder_0, undefined8 placeholder_1, int64_t arg3, int64_t arg4, int64_t arg_28h,\r\n                   |                  int64_t arg_30h, int64_t arg_78h)\r\n                   |{\r\n                   |    int32_t *piVar1;\r\n                   |    code *pcVar2;\r\n                   |    char cVar3;\r\n                   |    undefined4 *puVar4;\r\n                   |    int64_t iVar5;\r\n                   |    uint64_t uVar6;\r\n                   |    undefined auStack_d8 [32];\r\n                   |    int64_t var_b8h;\r\n                   |    undefined var_b0h [4];\r\n                   |    int64_t var_ach;\r\n                   |    int64_t var_a1h;\r\n                   |    int64_t var_98h;\r\n                   |    int64_t var_90h;\r\n                   |    int64_t var_88h;\r\n                   |    int64_t var_80h;\r\n                   |    undefined var_78h [7];\r\n                   |    int64_t var_71h;\r\n                   |    int64_t var_68h;\r\n                   |    int64_t var_60h;\r\n                   |    int64_t var_58h;\r\n                   |    int64_t var_50h;\r\n                   |    int64_t var_48h;\r\n                   |    \r\n    0x1838203e4    |    var_50h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_d8;\r\n    0x1838203f7    |    var_68h = 0;\r\n    0x1838203f7    |    var_60h = 0;\r\n    0x1838203fb    |    var_58h = 0;\r\n    0x183820403    |    cVar3 = func_0x00018381e110(placeholder_0, placeholder_1, arg_28h);\r\n    0x18382040a    |    if (cVar3 == '\\0') {\r\n    0x18382041f    |        var_b8h = func_0x000185f006b8(0x20);\r\n    0x183820429    |        _var_b0h = 0x1e;\r\n    0x183820436    |        stack0xffffffffffffff58 = 0x8000000000000020;\r\n    0x183820442    |        if ((undefined4 *)(var_b8h + 0x1e) < (uint64_t)var_b8h) goto code_r0x000183820762;\r\n    0x18382045f    |        if ((undefined4 *)0x190c24398 < (undefined4 *)(var_b8h + 0x1e) && (uint64_t)var_b8h < (undefined4 *)0x190c24399)\r\n    0x18382045f    |        goto code_r0x000183820762;\r\n    0x18382046c    |        *(undefined8 *)(var_b8h + 0xe) = 0x6f20656c646e6168;\r\n    0x18382046c    |        *(undefined8 *)(var_b8h + 0x16) = 0x6e696769726f2072;\r\n    0x183820477    |        *(undefined4 *)var_b8h = 0x61766e49;\r\n    0x183820477    |        *(undefined4 *)(var_b8h + 4) = 0x2064696c;\r\n    0x183820477    |        *(undefined4 *)(var_b8h + 8) = 0x6e756f6d;\r\n    0x183820477    |        *(undefined4 *)(var_b8h + 0xc) = 0x61682074;\r\n    0x18382047a    |        *(undefined *)(var_b8h + 0x1e) = 0;\r\n    0x18382047e    |        piVar1 = *(int32_t **)arg_30h;\r\n    0x183820484    |        if (piVar1 == (int32_t *)0x0) {\r\n    0x183820764    |            pcVar2 = (code *)swi(3);\r\n    0x183820764    |            (*pcVar2)();\r\n    0x183820764    |            return;\r\n                   |        }\r\n    0x18382048a    |        *(undefined8 *)arg_30h = 0;\r\n    0x18382049f    |        (*(code *)0x185f59da0)(piVar1, 0, &var_b8h);\r\n    0x1838204a5    |        LOCK();\r\n    0x1838204a5    |        *piVar1 = *piVar1 + -1;\r\n    0x1838204a5    |        UNLOCK();\r\n    0x1838204a8    |        if (*piVar1 == 0) {\r\n    0x1838204b1    |            (*(code *)0x185f59da0)(piVar1);\r\n                   |        }\r\n    0x1838204bc    |        if ((int64_t)stack0xffffffffffffff58 < 0) {\r\n    0x1838204c2    |            uVar6 = stack0xffffffffffffff58 & 0x7fffffffffffffff;\r\n    0x1838204cf    |            iVar5 = var_b8h;\r\n    0x1838204cf    |            goto code_r0x0001838206cd;\r\n                   |        }\r\n                   |    } else {\r\n    0x1838204d9    |        var_88h = 0;\r\n    0x1838204d9    |        var_80h = 0;\r\n    0x1838204dd    |        _var_78h = 0;\r\n    0x1838204ed    |        cVar3 = func_0x00018381ed30(&var_68h, arg3);\r\n    0x1838204f4    |        if (cVar3 == '\\0') {\r\n    0x1838204ff    |            stack0xffffffffffffff58 = CONCAT17(0xc, stack0xffffffffffffff58);\r\n    0x18382051d    |            if ((int64_t *)0x190c243b8 < &var_ach && &var_b8h < (int64_t *)0x190c243b9) goto code_r0x000183820762;\r\n    0x18382052d    |            var_b8h = 0x2064696c61766e49;\r\n    0x18382053a    |            _var_b0h = CONCAT35(var_ach._1_3_, 0x68746170);\r\n    0x18382053f    |            piVar1 = *(int32_t **)arg_30h;\r\n    0x183820545    |            if (piVar1 == (int32_t *)0x0) {\r\n    0x183820767    |                pcVar2 = (code *)swi(3);\r\n    0x183820767    |                (*pcVar2)();\r\n    0x183820767    |                return;\r\n                   |            }\r\n    0x18382054b    |            *(undefined8 *)arg_30h = 0;\r\n    0x183820560    |            (*(code *)0x185f59da0)(piVar1, 0, &var_b8h);\r\n    0x183820566    |            LOCK();\r\n    0x183820566    |            *piVar1 = *piVar1 + -1;\r\n    0x183820566    |            UNLOCK();\r\n    0x183820569    |            if (*piVar1 == 0) {\r\n    0x183820572    |                (*(code *)0x185f59da0)(piVar1);\r\n                   |            }\r\n    0x18382057d    |            if ((int64_t)stack0xffffffffffffff58 < 0) {\r\n    0x183820597    |                func_0x0001841dcbe0(var_b8h, stack0xffffffffffffff58 & 0x7fffffffffffffff);\r\n                   |            }\r\n                   |        } else {\r\n    0x1838205bc    |            var_90h = func_0x000185f006b8(0x30);\r\n    0x1838205c6    |            *(undefined4 *)var_90h = 1;\r\n    0x1838205cf    |            *(undefined8 *)(var_90h + 8) = 0x183829ca0;\r\n    0x1838205da    |            *(undefined8 *)(var_90h + 0x10) = 0x183283eb0;\r\n    0x1838205e5    |            *(undefined8 *)(var_90h + 0x18) = 0x1841d75d0;\r\n    0x1838205ec    |            *(undefined8 *)(var_90h + 0x28) = *(undefined8 *)arg_30h;\r\n    0x1838205f0    |            *(undefined8 *)arg_30h = 0;\r\n    0x183820601    |            puVar4 = (undefined4 *)func_0x000185f006b8(0x60);\r\n    0x18382060c    |            *puVar4 = 1;\r\n    0x183820615    |            *(undefined8 *)(puVar4 + 2) = 0x183829d60;\r\n    0x183820620    |            *(undefined8 *)(puVar4 + 4) = 0x183829af0;\r\n    0x183820624    |            *(undefined8 *)(puVar4 + 6) = 0x1841d75d0;\r\n    0x18382062f    |            *(undefined8 *)(puVar4 + 8) = 0x1838164b0;\r\n    0x18382063c    |            if (_var_78h < 0) {\r\n    0x183820633    |                func_0x000184c2f840(puVar4 + 10, var_88h, var_80h);\r\n                   |            } else {\r\n    0x1838205a6    |                *(int64_t *)(puVar4 + 0xe) = _var_78h;\r\n    0x1838205af    |                puVar4[10] = (undefined4)var_88h;\r\n    0x1838205af    |                puVar4[0xb] = var_88h._4_4_;\r\n    0x1838205af    |                puVar4[0xc] = (undefined4)var_80h;\r\n    0x1838205af    |                puVar4[0xd] = var_80h._4_4_;\r\n                   |            }\r\n    0x183820651    |            puVar4[0x10] = (int32_t)arg4;\r\n    0x183820661    |            if (var_58h < 0) {\r\n    0x183820655    |                func_0x000184c2f840(puVar4 + 0x12, var_68h, var_60h);\r\n                   |            } else {\r\n    0x183820741    |                *(int64_t *)(puVar4 + 0x16) = var_58h;\r\n    0x18382074a    |                puVar4[0x12] = (undefined4)var_68h;\r\n    0x18382074a    |                puVar4[0x13] = var_68h._4_4_;\r\n    0x18382074a    |                puVar4[0x14] = (undefined4)var_60h;\r\n    0x18382074a    |                puVar4[0x15] = var_60h._4_4_;\r\n                   |            }\r\n    0x18382069d    |            var_98h = (int64_t)puVar4;\r\n    0x18382068f    |            func_0x000184339cd0(&var_b8h, 0x190c24450, 0x190c23b08, 0x677);\r\n    0x18382068f    |            func_0x0001833e5880(&var_b8h, 0x190c24447, &var_98h, &var_90h);\r\n                   |        }\r\n    0x1838206be    |        if (_var_78h < 0) {\r\n    0x1838206ca    |            uVar6 = _var_78h * 2;\r\n    0x1838206ca    |            iVar5 = var_88h;\r\n                   |code_r0x0001838206cd:\r\n    0x1838206cd    |            func_0x0001841dcbe0(iVar5, uVar6);\r\n                   |        }\r\n                   |    }\r\n    0x1838206da    |    if (var_58h < 0) {\r\n    0x1838206ec    |        func_0x0001841dcbe0(var_68h, var_58h * 2);\r\n                   |    }\r\n    0x1838206f1    |    piVar1 = *(int32_t **)arg_30h;\r\n    0x1838206f7    |    if (piVar1 != (int32_t *)0x0) {\r\n    0x183820728    |        LOCK();\r\n    0x183820728    |        *piVar1 = *piVar1 + -1;\r\n    0x183820728    |        UNLOCK();\r\n    0x18382072b    |        if (*piVar1 == 0) {\r\n    0x183820731    |            (*(code *)0x185f59da0)();\r\n                   |        }\r\n                   |    }\r\n    0x18382070e    |    if (*(uint64_t *)0x191c71040 == (var_50h ^ (uint64_t)auStack_d8)) {\r\n    0x183820727    |        return;\r\n                   |    }\r\n    0x18382075a    |    func_0x000185f05b40(var_50h ^ (uint64_t)auStack_d8);\r\n                   |code_r0x000183820762:\r\n    0x183820762    |    // WARNING: Does not return\r\n    0x183820762    |    pcVar2 = (code *)invalidInstructionException();\r\n    0x183820762    |    (*pcVar2)();\r\n                   |}\r\n[{\"offset\":6501303216,\"name\":\"fcn.1838203b0\",\"size\":952,\"is-pure\":false,\"realsz\":950,\"noreturn\":false,\"stackframe\":216,\"calltype\":\"ms\",\"cost\":276,\"cc\":22,\"loops\":4,\"bits\":64,\"type\":\"fcn\",\"nbbs\":36,\"edges\":50,\"ebbs\":4,\"signature\":\"fcn.1838203b0(int64_t arg3, int64_t arg4, int64_t arg_28h, int64_t arg_30h, int64_t arg_78h);\",\"minbound\":6501303216,\"maxbound\":6501304168,\"callrefs\":[{\"from\":6501303299,\"to\":6501294352,\"type\":\"CALL\"},{\"from\":6501303327,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6501303455,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6501303473,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6501303503,\"to\":6501304013,\"type\":\"CODE\"},{\"from\":6501303533,\"to\":6501297456,\"type\":\"CALL\"},{\"from\":6501303648,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6501303666,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6501303703,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6501303708,\"to\":6501303993,\"type\":\"CODE\"},{\"from\":6501303730,\"to\":6501303889,\"type\":\"CODE\"},{\"from\":6501303740,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6501303809,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6501303884,\"to\":6522337344,\"type\":\"CALL\"},{\"from\":6501303924,\"to\":6522337344,\"type\":\"CALL\"},{\"from\":6501303965,\"to\":6512942288,\"type\":\"CALL\"},{\"from\":6501303988,\"to\":6496868480,\"type\":\"CALL\"},{\"from\":6501304013,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6501304044,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6501304113,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6501304119,\"to\":6501304057,\"type\":\"CODE\"},{\"from\":6501304141,\"to\":6501303929,\"type\":\"CODE\"},{\"from\":6501304157,\"to\":6542089024,\"type\":\"CALL\"}],\"datarefs\":[{\"from\":6501303261,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6501303368,\"to\":6723617688,\"type\":\"DATA\"},{\"from\":6501303397,\"to\":6723617702,\"type\":\"DATA\"},{\"from\":6501303408,\"to\":6723617688,\"type\":\"DATA\"},{\"from\":6501303555,\"to\":6723617720,\"type\":\"DATA\"},{\"from\":6501303752,\"to\":6501342368,\"type\":\"DATA\"},{\"from\":6501303763,\"to\":6495420080,\"type\":\"DATA\"},{\"from\":6501303774,\"to\":6511490512,\"type\":\"DATA\"},{\"from\":6501303822,\"to\":6501342560,\"type\":\"DATA\"},{\"from\":6501303833,\"to\":6501341936,\"type\":\"DATA\"},{\"from\":6501303848,\"to\":6501262512,\"type\":\"DATA\"},{\"from\":6501303937,\"to\":6723617872,\"type\":\"DATA\"},{\"from\":6501303944,\"to\":6723615496,\"type\":\"DATA\"},{\"from\":6501303970,\"to\":6723617863,\"type\":\"DATA\"},{\"from\":6501304068,\"to\":6740709440,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6501303503,\"to\":6501304013,\"type\":\"CODE\"},{\"from\":6501303708,\"to\":6501303993,\"type\":\"CODE\"},{\"from\":6501303730,\"to\":6501303889,\"type\":\"CODE\"},{\"from\":6501304119,\"to\":6501304057,\"type\":\"CODE\"},{\"from\":6501304141,\"to\":6501303929,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":5,\"outdegree\":18,\"nlocals\":17,\"nargs\":5,\"stackvars\":[{\"name\":\"var_b8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-184}},{\"name\":\"var_b0h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-176}},{\"name\":\"var_ach\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-172}},{\"name\":\"var_a8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-168}},{\"name\":\"var_a1h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-161}},{\"name\":\"var_98h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-152}},{\"name\":\"var_90h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-144}},{\"name\":\"var_88h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-136}},{\"name\":\"var_80h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-128}},{\"name\":\"var_78h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-120}},{\"name\":\"var_71h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-113}},{\"name\":\"var_68h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-104}},{\"name\":\"var_60h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-96}},{\"name\":\"var_58h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-88}},{\"name\":\"var_51h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-81}},{\"name\":\"var_50h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-80}},{\"name\":\"var_48h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-72}},{\"name\":\"arg_28h\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":40}},{\"name\":\"arg_30h\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":48}},{\"name\":\"arg_78h\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":120}}],\"regvars\":[{\"name\":\"arg3\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"r8\"}},{\"name\":\"arg4\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"r9\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"confidence":"observed","authority":"shipped-artifact","environment":null,"limitations":["The executable version and supported formats are reported as unknown because no reliable version probe was performed.","A non-zero process exit is preserved as an observed command result.","Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.","When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call."],"relationship_coverage":null,"locations":[{"kind":"artifact-path","path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"}],"evidence_links":[]},"meta":{"command":"execute-rizin-command","duration":"5075ms"}}