{"ok":true,"data":{"evidence_id":"ev_7daf1864ae1634ec75b1a07cce252a4a2418ddf06d84d1fb204745a216d1be2b","subject":{"name":"Tabbit.dll","digest":{"sha256":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c"},"local_path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","format":"unknown","architecture":null},"provider":{"id":"rizin","name":"Rizin","version":null},"analysis_profile":null,"predicate_type":"rea.reverse-engineering.command-observation","operation":"execute_rizin_command","parameters":{"path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","command":"e scr.color=0;af @ 0x1836d1410;pdgo @ 0x1836d1410;afij @ 0x1836d1410","provider_executable":"C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe","command_arguments":["-N","-q","-c","e scr.color=0;af @ 0x1836d1410;pdgo @ 0x1836d1410;afij @ 0x1836d1410","C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"]},"raw_result":{"stdout":"                   |\r\n    0x1836d1410    |undefined8 * fcn.1836d1410(int64_t arg1, int64_t arg2, int64_t arg_40h)\r\n                   |{\r\n                   |    int64_t iVar1;\r\n                   |    undefined8 uVar2;\r\n                   |    int64_t iVar3;\r\n                   |    code *pcVar4;\r\n                   |    uint64_t uVar5;\r\n                   |    undefined4 uVar6;\r\n                   |    undefined4 uVar7;\r\n                   |    undefined4 uVar8;\r\n                   |    int64_t iVar9;\r\n                   |    undefined8 *puVar10;\r\n                   |    int64_t iVar11;\r\n                   |    uint64_t uVar12;\r\n                   |    int64_t iVar13;\r\n                   |    undefined auStack_88 [32];\r\n                   |    int64_t var_68h;\r\n                   |    int64_t var_60h;\r\n                   |    int64_t iStack_58;\r\n                   |    int64_t var_50h;\r\n                   |    int64_t var_48h;\r\n                   |    int64_t iVar14;\r\n                   |    \r\n    0x1836d1427    |    var_48h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_88;\r\n    0x1836d142f    |    iVar1 = *(int64_t *)(arg1 + 8);\r\n    0x1836d1433    |    uVar12 = iVar1 + 1;\r\n    0x1836d143e    |    if (uVar12 >> 0x3a == 0) {\r\n    0x1836d144e    |        uVar5 = *(uint64_t *)(arg1 + 0x10) * 2;\r\n    0x1836d1455    |        if (uVar12 < uVar5) {\r\n    0x1836d1455    |            uVar12 = uVar5;\r\n                   |        }\r\n    0x1836d1470    |        if (0x1fffffffffffffe < *(uint64_t *)(arg1 + 0x10)) {\r\n    0x1836d1470    |            uVar12 = 0x3ffffffffffffff;\r\n                   |        }\r\n    0x1836d1474    |        var_68h = 0;\r\n    0x1836d1480    |        if (uVar12 != 0) {\r\n    0x1836d1489    |            if (0x3ffffffffffffff < uVar12) goto code_r0x0001836d1608;\r\n    0x1836d1496    |            var_68h = func_0x000185f006b8(uVar12 << 6);\r\n                   |        }\r\n    0x1836d14a4    |        puVar10 = (undefined8 *)(iVar1 * 0x40 + var_68h);\r\n    0x1836d14b1    |        var_60h = (int64_t)puVar10;\r\n    0x1836d14b1    |        var_50h = uVar12;\r\n    0x1836d14b1    |        if (puVar10 == (undefined8 *)0x0) {\r\n                   |code_r0x0001836d1601:\r\n    0x1836d1601    |    // WARNING: Does not return\r\n    0x1836d1601    |            pcVar4 = (code *)invalidInstructionException();\r\n    0x1836d1601    |            (*pcVar4)();\r\n                   |        }\r\n    0x1836d14c3    |        puVar10[2] = *(undefined8 *)(arg2 + 0x10);\r\n    0x1836d14c7    |        uVar2 = *(undefined8 *)(arg2 + 8);\r\n    0x1836d14ca    |        *puVar10 = *(undefined8 *)arg2;\r\n    0x1836d14ca    |        puVar10[1] = uVar2;\r\n    0x1836d14d0    |        *(undefined8 *)arg2 = 0;\r\n    0x1836d14d0    |        *(undefined8 *)(arg2 + 8) = 0;\r\n    0x1836d14d5    |        *(undefined8 *)(arg2 + 0x10) = 0;\r\n    0x1836d14d9    |        uVar2 = *(undefined8 *)(arg2 + 0x18);\r\n    0x1836d14dd    |        *(undefined8 *)(arg2 + 0x18) = 0;\r\n    0x1836d14e1    |        puVar10[3] = uVar2;\r\n    0x1836d14e5    |        uVar2 = *(undefined8 *)(arg2 + 0x20);\r\n    0x1836d14e9    |        *(undefined8 *)(arg2 + 0x20) = 0;\r\n    0x1836d14ed    |        puVar10[4] = uVar2;\r\n    0x1836d14f1    |        uVar2 = *(undefined8 *)(arg2 + 0x28);\r\n    0x1836d14f5    |        *(undefined8 *)(arg2 + 0x28) = 0;\r\n    0x1836d14f9    |        puVar10[5] = uVar2;\r\n    0x1836d14fd    |        uVar6 = *(undefined4 *)(arg2 + 0x34);\r\n    0x1836d14fd    |        uVar7 = *(undefined4 *)(arg2 + 0x38);\r\n    0x1836d14fd    |        uVar8 = *(undefined4 *)(arg2 + 0x3c);\r\n    0x1836d1501    |        *(undefined4 *)(puVar10 + 6) = *(undefined4 *)(arg2 + 0x30);\r\n    0x1836d1501    |        *(undefined4 *)((int64_t)puVar10 + 0x34) = uVar6;\r\n    0x1836d1501    |        *(undefined4 *)(puVar10 + 7) = uVar7;\r\n    0x1836d1501    |        *(undefined4 *)((int64_t)puVar10 + 0x3c) = uVar8;\r\n    0x1836d150a    |        iStack_58 = 1;\r\n    0x1836d1505    |        func_0x0001836d1620(&var_68h, arg1, arg1 + 8, arg1 + 0x10);\r\n    0x1836d1518    |        iVar1 = var_60h;\r\n    0x1836d1525    |        if (iStack_58 * 0x40 != 0) {\r\n    0x1836d1540    |            iVar14 = iStack_58 * 0x40 + var_60h;\r\n                   |            do {\r\n    0x1836d1561    |                iVar13 = iVar14 + -0x40;\r\n    0x1836d1565    |                if (iVar13 == 0) goto code_r0x0001836d1601;\r\n    0x1836d156b    |                iVar3 = *(int64_t *)(iVar14 + -0x28);\r\n    0x1836d1572    |                if (iVar3 != 0) {\r\n    0x1836d1580    |                    iVar11 = *(int64_t *)(iVar14 + -0x20) << 5;\r\n    0x1836d1587    |                    iVar9 = iVar3;\r\n    0x1836d1587    |                    if (iVar11 != 0) {\r\n                   |                        do {\r\n    0x1836d1589    |                            func_0x000184e58cd0(iVar3 + -0x20 + iVar11);\r\n    0x1836d1599    |                            iVar11 = iVar11 + -0x20;\r\n    0x1836d159d    |                        } while (iVar11 != 0);\r\n    0x1836d159f    |                        iVar9 = *(int64_t *)(iVar14 + -0x28);\r\n                   |                    }\r\n    0x1836d15aa    |                    *(int64_t *)(iVar14 + -0x20) = iVar3 - iVar9 >> 5;\r\n    0x1836d15b6    |                    func_0x0001841dcbe0(iVar9, *(int64_t *)(iVar14 + -0x18) << 5);\r\n                   |                }\r\n    0x1836d1578    |                if (*(char *)(iVar14 + -0x29) < '\\0') {\r\n    0x1836d1550    |                    func_0x0001841dcbe0(*(undefined8 *)(iVar14 + -0x40), \r\n    0x1836d1549    |                                        *(uint64_t *)(iVar14 + -0x30) & 0x7fffffffffffffff);\r\n                   |                }\r\n    0x1836d155f    |                iVar14 = iVar13;\r\n    0x1836d155f    |            } while (iVar1 != iVar13);\r\n                   |        }\r\n    0x1836d15c5    |        if (var_68h != 0) {\r\n    0x1836d15d0    |            func_0x0001841dcbe0(var_68h, var_50h << 6);\r\n                   |        }\r\n    0x1836d15e7    |        if (*(uint64_t *)0x191c71040 == (var_48h ^ (uint64_t)auStack_88)) {\r\n    0x1836d1600    |            return puVar10 + 8;\r\n                   |        }\r\n                   |    } else {\r\n    0x1836d1603    |        func_0x00018628dc40();\r\n                   |code_r0x0001836d1608:\r\n    0x1836d1608    |        func_0x0001860265d0();\r\n                   |    }\r\n    0x1836d1612    |    func_0x000185f05b40(var_48h ^ (uint64_t)auStack_88);\r\n    0x1836d161a    |    pcVar4 = (code *)swi(3);\r\n    0x1836d161a    |    puVar10 = (undefined8 *)(*pcVar4)();\r\n    0x1836d161a    |    return puVar10;\r\n                   |}\r\n[{\"offset\":6499931152,\"name\":\"fcn.1836d1410\",\"size\":523,\"is-pure\":false,\"realsz\":523,\"noreturn\":false,\"stackframe\":136,\"calltype\":\"ms\",\"cost\":177,\"cc\":16,\"loops\":4,\"bits\":64,\"type\":\"fcn\",\"nbbs\":27,\"edges\":37,\"ebbs\":3,\"signature\":\"fcn.1836d1410(int64_t arg1, int64_t arg2, int64_t arg_40h);\",\"minbound\":6499931152,\"maxbound\":6499931675,\"callrefs\":[{\"from\":6499931286,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6499931416,\"to\":6499931680,\"type\":\"CALL\"},{\"from\":6499931456,\"to\":6499931489,\"type\":\"CODE\"},{\"from\":6499931460,\"to\":6499931296,\"type\":\"CODE\"},{\"from\":6499931476,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6499931514,\"to\":6499931465,\"type\":\"CODE\"},{\"from\":6499931540,\"to\":6524603600,\"type\":\"CALL\"},{\"from\":6499931574,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6499931579,\"to\":6499931508,\"type\":\"CODE\"},{\"from\":6499931600,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6499931651,\"to\":6545792064,\"type\":\"CALL\"},{\"from\":6499931656,\"to\":6543271376,\"type\":\"CALL\"},{\"from\":6499931669,\"to\":6542089024,\"type\":\"CALL\"}],\"datarefs\":[{\"from\":6499931168,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6499931613,\"to\":6740709440,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6499931456,\"to\":6499931489,\"type\":\"CODE\"},{\"from\":6499931460,\"to\":6499931296,\"type\":\"CODE\"},{\"from\":6499931514,\"to\":6499931465,\"type\":\"CODE\"},{\"from\":6499931579,\"to\":6499931508,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":4,\"outdegree\":9,\"nlocals\":4,\"nargs\":3,\"stackvars\":[{\"name\":\"var_68h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-104}},{\"name\":\"var_60h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-96}},{\"name\":\"var_50h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-80}},{\"name\":\"var_48h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-72}},{\"name\":\"arg_40h\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":64}}],\"regvars\":[{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"normalized_result":{"stdout":"                   |\r\n    0x1836d1410    |undefined8 * fcn.1836d1410(int64_t arg1, int64_t arg2, int64_t arg_40h)\r\n                   |{\r\n                   |    int64_t iVar1;\r\n                   |    undefined8 uVar2;\r\n                   |    int64_t iVar3;\r\n                   |    code *pcVar4;\r\n                   |    uint64_t uVar5;\r\n                   |    undefined4 uVar6;\r\n                   |    undefined4 uVar7;\r\n                   |    undefined4 uVar8;\r\n                   |    int64_t iVar9;\r\n                   |    undefined8 *puVar10;\r\n                   |    int64_t iVar11;\r\n                   |    uint64_t uVar12;\r\n                   |    int64_t iVar13;\r\n                   |    undefined auStack_88 [32];\r\n                   |    int64_t var_68h;\r\n                   |    int64_t var_60h;\r\n                   |    int64_t iStack_58;\r\n                   |    int64_t var_50h;\r\n                   |    int64_t var_48h;\r\n                   |    int64_t iVar14;\r\n                   |    \r\n    0x1836d1427    |    var_48h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_88;\r\n    0x1836d142f    |    iVar1 = *(int64_t *)(arg1 + 8);\r\n    0x1836d1433    |    uVar12 = iVar1 + 1;\r\n    0x1836d143e    |    if (uVar12 >> 0x3a == 0) {\r\n    0x1836d144e    |        uVar5 = *(uint64_t *)(arg1 + 0x10) * 2;\r\n    0x1836d1455    |        if (uVar12 < uVar5) {\r\n    0x1836d1455    |            uVar12 = uVar5;\r\n                   |        }\r\n    0x1836d1470    |        if (0x1fffffffffffffe < *(uint64_t *)(arg1 + 0x10)) {\r\n    0x1836d1470    |            uVar12 = 0x3ffffffffffffff;\r\n                   |        }\r\n    0x1836d1474    |        var_68h = 0;\r\n    0x1836d1480    |        if (uVar12 != 0) {\r\n    0x1836d1489    |            if (0x3ffffffffffffff < uVar12) goto code_r0x0001836d1608;\r\n    0x1836d1496    |            var_68h = func_0x000185f006b8(uVar12 << 6);\r\n                   |        }\r\n    0x1836d14a4    |        puVar10 = (undefined8 *)(iVar1 * 0x40 + var_68h);\r\n    0x1836d14b1    |        var_60h = (int64_t)puVar10;\r\n    0x1836d14b1    |        var_50h = uVar12;\r\n    0x1836d14b1    |        if (puVar10 == (undefined8 *)0x0) {\r\n                   |code_r0x0001836d1601:\r\n    0x1836d1601    |    // WARNING: Does not return\r\n    0x1836d1601    |            pcVar4 = (code *)invalidInstructionException();\r\n    0x1836d1601    |            (*pcVar4)();\r\n                   |        }\r\n    0x1836d14c3    |        puVar10[2] = *(undefined8 *)(arg2 + 0x10);\r\n    0x1836d14c7    |        uVar2 = *(undefined8 *)(arg2 + 8);\r\n    0x1836d14ca    |        *puVar10 = *(undefined8 *)arg2;\r\n    0x1836d14ca    |        puVar10[1] = uVar2;\r\n    0x1836d14d0    |        *(undefined8 *)arg2 = 0;\r\n    0x1836d14d0    |        *(undefined8 *)(arg2 + 8) = 0;\r\n    0x1836d14d5    |        *(undefined8 *)(arg2 + 0x10) = 0;\r\n    0x1836d14d9    |        uVar2 = *(undefined8 *)(arg2 + 0x18);\r\n    0x1836d14dd    |        *(undefined8 *)(arg2 + 0x18) = 0;\r\n    0x1836d14e1    |        puVar10[3] = uVar2;\r\n    0x1836d14e5    |        uVar2 = *(undefined8 *)(arg2 + 0x20);\r\n    0x1836d14e9    |        *(undefined8 *)(arg2 + 0x20) = 0;\r\n    0x1836d14ed    |        puVar10[4] = uVar2;\r\n    0x1836d14f1    |        uVar2 = *(undefined8 *)(arg2 + 0x28);\r\n    0x1836d14f5    |        *(undefined8 *)(arg2 + 0x28) = 0;\r\n    0x1836d14f9    |        puVar10[5] = uVar2;\r\n    0x1836d14fd    |        uVar6 = *(undefined4 *)(arg2 + 0x34);\r\n    0x1836d14fd    |        uVar7 = *(undefined4 *)(arg2 + 0x38);\r\n    0x1836d14fd    |        uVar8 = *(undefined4 *)(arg2 + 0x3c);\r\n    0x1836d1501    |        *(undefined4 *)(puVar10 + 6) = *(undefined4 *)(arg2 + 0x30);\r\n    0x1836d1501    |        *(undefined4 *)((int64_t)puVar10 + 0x34) = uVar6;\r\n    0x1836d1501    |        *(undefined4 *)(puVar10 + 7) = uVar7;\r\n    0x1836d1501    |        *(undefined4 *)((int64_t)puVar10 + 0x3c) = uVar8;\r\n    0x1836d150a    |        iStack_58 = 1;\r\n    0x1836d1505    |        func_0x0001836d1620(&var_68h, arg1, arg1 + 8, arg1 + 0x10);\r\n    0x1836d1518    |        iVar1 = var_60h;\r\n    0x1836d1525    |        if (iStack_58 * 0x40 != 0) {\r\n    0x1836d1540    |            iVar14 = iStack_58 * 0x40 + var_60h;\r\n                   |            do {\r\n    0x1836d1561    |                iVar13 = iVar14 + -0x40;\r\n    0x1836d1565    |                if (iVar13 == 0) goto code_r0x0001836d1601;\r\n    0x1836d156b    |                iVar3 = *(int64_t *)(iVar14 + -0x28);\r\n    0x1836d1572    |                if (iVar3 != 0) {\r\n    0x1836d1580    |                    iVar11 = *(int64_t *)(iVar14 + -0x20) << 5;\r\n    0x1836d1587    |                    iVar9 = iVar3;\r\n    0x1836d1587    |                    if (iVar11 != 0) {\r\n                   |                        do {\r\n    0x1836d1589    |                            func_0x000184e58cd0(iVar3 + -0x20 + iVar11);\r\n    0x1836d1599    |                            iVar11 = iVar11 + -0x20;\r\n    0x1836d159d    |                        } while (iVar11 != 0);\r\n    0x1836d159f    |                        iVar9 = *(int64_t *)(iVar14 + -0x28);\r\n                   |                    }\r\n    0x1836d15aa    |                    *(int64_t *)(iVar14 + -0x20) = iVar3 - iVar9 >> 5;\r\n    0x1836d15b6    |                    func_0x0001841dcbe0(iVar9, *(int64_t *)(iVar14 + -0x18) << 5);\r\n                   |                }\r\n    0x1836d1578    |                if (*(char *)(iVar14 + -0x29) < '\\0') {\r\n    0x1836d1550    |                    func_0x0001841dcbe0(*(undefined8 *)(iVar14 + -0x40), \r\n    0x1836d1549    |                                        *(uint64_t *)(iVar14 + -0x30) & 0x7fffffffffffffff);\r\n                   |                }\r\n    0x1836d155f    |                iVar14 = iVar13;\r\n    0x1836d155f    |            } while (iVar1 != iVar13);\r\n                   |        }\r\n    0x1836d15c5    |        if (var_68h != 0) {\r\n    0x1836d15d0    |            func_0x0001841dcbe0(var_68h, var_50h << 6);\r\n                   |        }\r\n    0x1836d15e7    |        if (*(uint64_t *)0x191c71040 == (var_48h ^ (uint64_t)auStack_88)) {\r\n    0x1836d1600    |            return puVar10 + 8;\r\n                   |        }\r\n                   |    } else {\r\n    0x1836d1603    |        func_0x00018628dc40();\r\n                   |code_r0x0001836d1608:\r\n    0x1836d1608    |        func_0x0001860265d0();\r\n                   |    }\r\n    0x1836d1612    |    func_0x000185f05b40(var_48h ^ (uint64_t)auStack_88);\r\n    0x1836d161a    |    pcVar4 = (code *)swi(3);\r\n    0x1836d161a    |    puVar10 = (undefined8 *)(*pcVar4)();\r\n    0x1836d161a    |    return puVar10;\r\n                   |}\r\n[{\"offset\":6499931152,\"name\":\"fcn.1836d1410\",\"size\":523,\"is-pure\":false,\"realsz\":523,\"noreturn\":false,\"stackframe\":136,\"calltype\":\"ms\",\"cost\":177,\"cc\":16,\"loops\":4,\"bits\":64,\"type\":\"fcn\",\"nbbs\":27,\"edges\":37,\"ebbs\":3,\"signature\":\"fcn.1836d1410(int64_t arg1, int64_t arg2, int64_t arg_40h);\",\"minbound\":6499931152,\"maxbound\":6499931675,\"callrefs\":[{\"from\":6499931286,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6499931416,\"to\":6499931680,\"type\":\"CALL\"},{\"from\":6499931456,\"to\":6499931489,\"type\":\"CODE\"},{\"from\":6499931460,\"to\":6499931296,\"type\":\"CODE\"},{\"from\":6499931476,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6499931514,\"to\":6499931465,\"type\":\"CODE\"},{\"from\":6499931540,\"to\":6524603600,\"type\":\"CALL\"},{\"from\":6499931574,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6499931579,\"to\":6499931508,\"type\":\"CODE\"},{\"from\":6499931600,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6499931651,\"to\":6545792064,\"type\":\"CALL\"},{\"from\":6499931656,\"to\":6543271376,\"type\":\"CALL\"},{\"from\":6499931669,\"to\":6542089024,\"type\":\"CALL\"}],\"datarefs\":[{\"from\":6499931168,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6499931613,\"to\":6740709440,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6499931456,\"to\":6499931489,\"type\":\"CODE\"},{\"from\":6499931460,\"to\":6499931296,\"type\":\"CODE\"},{\"from\":6499931514,\"to\":6499931465,\"type\":\"CODE\"},{\"from\":6499931579,\"to\":6499931508,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":4,\"outdegree\":9,\"nlocals\":4,\"nargs\":3,\"stackvars\":[{\"name\":\"var_68h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-104}},{\"name\":\"var_60h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-96}},{\"name\":\"var_50h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-80}},{\"name\":\"var_48h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-72}},{\"name\":\"arg_40h\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":64}}],\"regvars\":[{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"confidence":"observed","authority":"shipped-artifact","environment":null,"limitations":["The executable version and supported formats are reported as unknown because no reliable version probe was performed.","A non-zero process exit is preserved as an observed command result.","Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.","When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call."],"relationship_coverage":null,"locations":[{"kind":"artifact-path","path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"}],"evidence_links":[]},"meta":{"command":"execute-rizin-command","duration":"5081ms"}}