{"ok":true,"data":{"evidence_id":"ev_fedcb9b5839bb10c0e0f33d8cb87022cb4a79bcb008492dde32ba58c5afbb1eb","subject":{"name":"Tabbit.dll","digest":{"sha256":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c"},"local_path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","format":"unknown","architecture":null},"provider":{"id":"rizin","name":"Rizin","version":null},"analysis_profile":null,"predicate_type":"rea.reverse-engineering.command-observation","operation":"execute_rizin_command","parameters":{"path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","command":"e scr.color=0;af @ 0x1836c8430;pdgo @ 0x1836c8430;afij @ 0x1836c8430","provider_executable":"C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe","command_arguments":["-N","-q","-c","e scr.color=0;af @ 0x1836c8430;pdgo @ 0x1836c8430;afij @ 0x1836c8430","C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"]},"raw_result":{"stdout":"                   |\r\n    0x1836c8430    |int64_t fcn.1836c8430(int64_t arg1)\r\n                   |{\r\n                   |    int32_t iVar1;\r\n                   |    code *pcVar2;\r\n                   |    int32_t *piVar3;\r\n                   |    int64_t iVar4;\r\n                   |    \r\n    0x1836c8438    |    fcn.188ac3fa0();\r\n    0x1836c8444    |    *(undefined8 *)(arg1 + 0x228) = 0x18fd8d900;\r\n    0x1836c8452    |    *(undefined8 *)(arg1 + 0x230) = 0x18fd56f48;\r\n    0x1836c845e    |    piVar3 = (int32_t *)fcn.185f006b8(8);\r\n    0x1836c8463    |    *piVar3 = 0;\r\n    0x1836c8469    |    *(undefined *)(piVar3 + 1) = 0;\r\n    0x1836c846d    |    *(int32_t **)(arg1 + 0x238) = piVar3;\r\n    0x1836c8477    |    if (piVar3 != (int32_t *)0x0) {\r\n    0x1836c847e    |        LOCK();\r\n    0x1836c847e    |        iVar1 = *piVar3;\r\n    0x1836c847e    |        *piVar3 = *piVar3 + 1;\r\n    0x1836c847e    |        UNLOCK();\r\n    0x1836c8488    |        if (iVar1 == 0x7fffffff) {\r\n    0x1836c85b2    |            pcVar2 = (code *)swi(3);\r\n    0x1836c85b2    |            iVar4 = (*pcVar2)();\r\n    0x1836c85b2    |            return iVar4;\r\n                   |        }\r\n                   |    }\r\n    0x1836c8495    |    *(int64_t *)(arg1 + 0x240) = arg1 + 0x230;\r\n    0x1836c849e    |    *(undefined8 *)(arg1 + 0x248) = 0;\r\n    0x1836c84a5    |    *(undefined *)(arg1 + 0x280) = 0;\r\n    0x1836c84ab    |    *(undefined *)(arg1 + 0x2f8) = 0;\r\n    0x1836c84b4    |    *(undefined8 *)(arg1 + 0x250) = 0;\r\n    0x1836c84b4    |    *(undefined8 *)(arg1 + 600) = 0;\r\n    0x1836c84bb    |    *(undefined *)(arg1 + 0x260) = 0;\r\n    0x1836c84c1    |    *(undefined8 *)(arg1 + 0x288) = 0;\r\n    0x1836c84c1    |    *(undefined8 *)(arg1 + 0x290) = 0;\r\n    0x1836c84c8    |    *(undefined8 *)(arg1 + 0x298) = 0;\r\n    0x1836c84c8    |    *(undefined8 *)(arg1 + 0x2a0) = 0;\r\n    0x1836c84cf    |    *(undefined8 *)(arg1 + 0x2a8) = 0;\r\n    0x1836c84cf    |    *(undefined8 *)(arg1 + 0x2b0) = 0;\r\n    0x1836c84d6    |    *(undefined *)(arg1 + 0x2b8) = 0;\r\n    0x1836c84dc    |    *(undefined8 *)(arg1 + 0x300) = 0;\r\n    0x1836c84dc    |    *(undefined8 *)(arg1 + 0x308) = 0;\r\n    0x1836c84e3    |    *(undefined8 *)(arg1 + 0x318) = 0;\r\n    0x1836c84e3    |    *(undefined8 *)(arg1 + 800) = 0;\r\n    0x1836c84ea    |    *(undefined8 *)(arg1 + 0x328) = 0;\r\n    0x1836c84f6    |    *(undefined4 *)(arg1 + 0x330) = 0xffffffff;\r\n    0x1836c84fc    |    *(undefined8 *)(arg1 + 0x338) = 0;\r\n    0x1836c84fc    |    *(undefined8 *)(arg1 + 0x340) = 0;\r\n    0x1836c8503    |    *(undefined8 *)(arg1 + 0x348) = 0;\r\n    0x1836c8503    |    *(undefined8 *)(arg1 + 0x350) = 0;\r\n    0x1836c850a    |    *(undefined8 *)(arg1 + 0x358) = 0;\r\n    0x1836c850a    |    *(undefined8 *)(arg1 + 0x360) = 0;\r\n    0x1836c8518    |    *(undefined8 *)(arg1 + 0x310) = 0x18feffbd8;\r\n    0x1836c851f    |    *(undefined8 *)(arg1 + 0x368) = 0;\r\n    0x1836c8526    |    *(undefined8 *)(arg1 + 0x388) = 0;\r\n    0x1836c852d    |    *(undefined8 *)(arg1 + 0x378) = 0;\r\n    0x1836c852d    |    *(undefined8 *)(arg1 + 0x380) = 0;\r\n    0x1836c8534    |    *(undefined4 *)(arg1 + 0x390) = 0xffffffff;\r\n    0x1836c853a    |    *(undefined8 *)(arg1 + 0x3b8) = 0;\r\n    0x1836c853a    |    *(undefined8 *)(arg1 + 0x3c0) = 0;\r\n    0x1836c8541    |    *(undefined8 *)(arg1 + 0x3a8) = 0;\r\n    0x1836c8541    |    *(undefined8 *)(arg1 + 0x3b0) = 0;\r\n    0x1836c8548    |    *(undefined8 *)(arg1 + 0x398) = 0;\r\n    0x1836c8548    |    *(undefined8 *)(arg1 + 0x3a0) = 0;\r\n    0x1836c854f    |    *(undefined8 *)(arg1 + 0x370) = 0x18feffbd8;\r\n    0x1836c8556    |    *(undefined8 *)(arg1 + 0x3f2) = 0;\r\n    0x1836c8556    |    *(undefined8 *)(arg1 + 0x3fa) = 0;\r\n    0x1836c855d    |    *(undefined8 *)(arg1 + 1000) = 0;\r\n    0x1836c855d    |    *(undefined8 *)(arg1 + 0x3f0) = 0;\r\n    0x1836c8564    |    *(undefined8 *)(arg1 + 0x3d8) = 0;\r\n    0x1836c8564    |    *(undefined8 *)(arg1 + 0x3e0) = 0;\r\n    0x1836c856b    |    *(undefined8 *)(arg1 + 0x3c8) = 0;\r\n    0x1836c856b    |    *(undefined8 *)(arg1 + 0x3d0) = 0;\r\n    0x1836c8572    |    *(undefined4 *)(arg1 + 0x404) = 1;\r\n    0x1836c857c    |    *(undefined8 *)(arg1 + 0x408) = 0;\r\n    0x1836c858a    |    *(undefined8 *)arg1 = 0x19006e8a8;\r\n    0x1836c8594    |    *(undefined8 *)(arg1 + 0x228) = 0x18fd295a0;\r\n    0x1836c85a2    |    *(undefined8 *)(arg1 + 0x230) = 0x18fd29600;\r\n    0x1836c85b1    |    return arg1;\r\n                   |}\r\n[{\"offset\":6499894320,\"name\":\"fcn.1836c8430\",\"size\":387,\"is-pure\":false,\"realsz\":387,\"noreturn\":false,\"stackframe\":40,\"calltype\":\"ms\",\"cost\":75,\"cc\":4,\"loops\":0,\"bits\":64,\"type\":\"fcn\",\"nbbs\":4,\"edges\":4,\"ebbs\":2,\"signature\":\"fcn.1836c8430(int64_t arg1);\",\"minbound\":6499894320,\"maxbound\":6499894707,\"callrefs\":[{\"from\":6499894328,\"to\":6587957152,\"type\":\"CALL\"},{\"from\":6499894366,\"to\":6542067384,\"type\":\"CALL\"}],\"datarefs\":[{\"from\":6499894333,\"to\":6708320512,\"type\":\"DATA\"},{\"from\":6499894347,\"to\":6708096840,\"type\":\"DATA\"},{\"from\":6499894545,\"to\":6709836760,\"type\":\"DATA\"},{\"from\":6499894659,\"to\":6711339176,\"type\":\"DATA\"},{\"from\":6499894669,\"to\":6707910048,\"type\":\"DATA\"},{\"from\":6499894683,\"to\":6707910144,\"type\":\"DATA\"}],\"indegree\":0,\"outdegree\":2,\"nlocals\":0,\"nargs\":1,\"stackvars\":[],\"regvars\":[{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"normalized_result":{"stdout":"                   |\r\n    0x1836c8430    |int64_t fcn.1836c8430(int64_t arg1)\r\n                   |{\r\n                   |    int32_t iVar1;\r\n                   |    code *pcVar2;\r\n                   |    int32_t *piVar3;\r\n                   |    int64_t iVar4;\r\n                   |    \r\n    0x1836c8438    |    fcn.188ac3fa0();\r\n    0x1836c8444    |    *(undefined8 *)(arg1 + 0x228) = 0x18fd8d900;\r\n    0x1836c8452    |    *(undefined8 *)(arg1 + 0x230) = 0x18fd56f48;\r\n    0x1836c845e    |    piVar3 = (int32_t *)fcn.185f006b8(8);\r\n    0x1836c8463    |    *piVar3 = 0;\r\n    0x1836c8469    |    *(undefined *)(piVar3 + 1) = 0;\r\n    0x1836c846d    |    *(int32_t **)(arg1 + 0x238) = piVar3;\r\n    0x1836c8477    |    if (piVar3 != (int32_t *)0x0) {\r\n    0x1836c847e    |        LOCK();\r\n    0x1836c847e    |        iVar1 = *piVar3;\r\n    0x1836c847e    |        *piVar3 = *piVar3 + 1;\r\n    0x1836c847e    |        UNLOCK();\r\n    0x1836c8488    |        if (iVar1 == 0x7fffffff) {\r\n    0x1836c85b2    |            pcVar2 = (code *)swi(3);\r\n    0x1836c85b2    |            iVar4 = (*pcVar2)();\r\n    0x1836c85b2    |            return iVar4;\r\n                   |        }\r\n                   |    }\r\n    0x1836c8495    |    *(int64_t *)(arg1 + 0x240) = arg1 + 0x230;\r\n    0x1836c849e    |    *(undefined8 *)(arg1 + 0x248) = 0;\r\n    0x1836c84a5    |    *(undefined *)(arg1 + 0x280) = 0;\r\n    0x1836c84ab    |    *(undefined *)(arg1 + 0x2f8) = 0;\r\n    0x1836c84b4    |    *(undefined8 *)(arg1 + 0x250) = 0;\r\n    0x1836c84b4    |    *(undefined8 *)(arg1 + 600) = 0;\r\n    0x1836c84bb    |    *(undefined *)(arg1 + 0x260) = 0;\r\n    0x1836c84c1    |    *(undefined8 *)(arg1 + 0x288) = 0;\r\n    0x1836c84c1    |    *(undefined8 *)(arg1 + 0x290) = 0;\r\n    0x1836c84c8    |    *(undefined8 *)(arg1 + 0x298) = 0;\r\n    0x1836c84c8    |    *(undefined8 *)(arg1 + 0x2a0) = 0;\r\n    0x1836c84cf    |    *(undefined8 *)(arg1 + 0x2a8) = 0;\r\n    0x1836c84cf    |    *(undefined8 *)(arg1 + 0x2b0) = 0;\r\n    0x1836c84d6    |    *(undefined *)(arg1 + 0x2b8) = 0;\r\n    0x1836c84dc    |    *(undefined8 *)(arg1 + 0x300) = 0;\r\n    0x1836c84dc    |    *(undefined8 *)(arg1 + 0x308) = 0;\r\n    0x1836c84e3    |    *(undefined8 *)(arg1 + 0x318) = 0;\r\n    0x1836c84e3    |    *(undefined8 *)(arg1 + 800) = 0;\r\n    0x1836c84ea    |    *(undefined8 *)(arg1 + 0x328) = 0;\r\n    0x1836c84f6    |    *(undefined4 *)(arg1 + 0x330) = 0xffffffff;\r\n    0x1836c84fc    |    *(undefined8 *)(arg1 + 0x338) = 0;\r\n    0x1836c84fc    |    *(undefined8 *)(arg1 + 0x340) = 0;\r\n    0x1836c8503    |    *(undefined8 *)(arg1 + 0x348) = 0;\r\n    0x1836c8503    |    *(undefined8 *)(arg1 + 0x350) = 0;\r\n    0x1836c850a    |    *(undefined8 *)(arg1 + 0x358) = 0;\r\n    0x1836c850a    |    *(undefined8 *)(arg1 + 0x360) = 0;\r\n    0x1836c8518    |    *(undefined8 *)(arg1 + 0x310) = 0x18feffbd8;\r\n    0x1836c851f    |    *(undefined8 *)(arg1 + 0x368) = 0;\r\n    0x1836c8526    |    *(undefined8 *)(arg1 + 0x388) = 0;\r\n    0x1836c852d    |    *(undefined8 *)(arg1 + 0x378) = 0;\r\n    0x1836c852d    |    *(undefined8 *)(arg1 + 0x380) = 0;\r\n    0x1836c8534    |    *(undefined4 *)(arg1 + 0x390) = 0xffffffff;\r\n    0x1836c853a    |    *(undefined8 *)(arg1 + 0x3b8) = 0;\r\n    0x1836c853a    |    *(undefined8 *)(arg1 + 0x3c0) = 0;\r\n    0x1836c8541    |    *(undefined8 *)(arg1 + 0x3a8) = 0;\r\n    0x1836c8541    |    *(undefined8 *)(arg1 + 0x3b0) = 0;\r\n    0x1836c8548    |    *(undefined8 *)(arg1 + 0x398) = 0;\r\n    0x1836c8548    |    *(undefined8 *)(arg1 + 0x3a0) = 0;\r\n    0x1836c854f    |    *(undefined8 *)(arg1 + 0x370) = 0x18feffbd8;\r\n    0x1836c8556    |    *(undefined8 *)(arg1 + 0x3f2) = 0;\r\n    0x1836c8556    |    *(undefined8 *)(arg1 + 0x3fa) = 0;\r\n    0x1836c855d    |    *(undefined8 *)(arg1 + 1000) = 0;\r\n    0x1836c855d    |    *(undefined8 *)(arg1 + 0x3f0) = 0;\r\n    0x1836c8564    |    *(undefined8 *)(arg1 + 0x3d8) = 0;\r\n    0x1836c8564    |    *(undefined8 *)(arg1 + 0x3e0) = 0;\r\n    0x1836c856b    |    *(undefined8 *)(arg1 + 0x3c8) = 0;\r\n    0x1836c856b    |    *(undefined8 *)(arg1 + 0x3d0) = 0;\r\n    0x1836c8572    |    *(undefined4 *)(arg1 + 0x404) = 1;\r\n    0x1836c857c    |    *(undefined8 *)(arg1 + 0x408) = 0;\r\n    0x1836c858a    |    *(undefined8 *)arg1 = 0x19006e8a8;\r\n    0x1836c8594    |    *(undefined8 *)(arg1 + 0x228) = 0x18fd295a0;\r\n    0x1836c85a2    |    *(undefined8 *)(arg1 + 0x230) = 0x18fd29600;\r\n    0x1836c85b1    |    return arg1;\r\n                   |}\r\n[{\"offset\":6499894320,\"name\":\"fcn.1836c8430\",\"size\":387,\"is-pure\":false,\"realsz\":387,\"noreturn\":false,\"stackframe\":40,\"calltype\":\"ms\",\"cost\":75,\"cc\":4,\"loops\":0,\"bits\":64,\"type\":\"fcn\",\"nbbs\":4,\"edges\":4,\"ebbs\":2,\"signature\":\"fcn.1836c8430(int64_t arg1);\",\"minbound\":6499894320,\"maxbound\":6499894707,\"callrefs\":[{\"from\":6499894328,\"to\":6587957152,\"type\":\"CALL\"},{\"from\":6499894366,\"to\":6542067384,\"type\":\"CALL\"}],\"datarefs\":[{\"from\":6499894333,\"to\":6708320512,\"type\":\"DATA\"},{\"from\":6499894347,\"to\":6708096840,\"type\":\"DATA\"},{\"from\":6499894545,\"to\":6709836760,\"type\":\"DATA\"},{\"from\":6499894659,\"to\":6711339176,\"type\":\"DATA\"},{\"from\":6499894669,\"to\":6707910048,\"type\":\"DATA\"},{\"from\":6499894683,\"to\":6707910144,\"type\":\"DATA\"}],\"indegree\":0,\"outdegree\":2,\"nlocals\":0,\"nargs\":1,\"stackvars\":[],\"regvars\":[{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"confidence":"observed","authority":"shipped-artifact","environment":null,"limitations":["The executable version and supported formats are reported as unknown because no reliable version probe was performed.","A non-zero process exit is preserved as an observed command result.","Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.","When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call."],"relationship_coverage":null,"locations":[{"kind":"artifact-path","path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"}],"evidence_links":[]},"meta":{"command":"execute-rizin-command","duration":"5037ms"}}