{"ok":true,"data":{"evidence_id":"ev_457b094dd22db015826d259b484067e3c973ca79b1ac9d78243752267f77f73f","subject":{"name":"Tabbit.dll","digest":{"sha256":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c"},"local_path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","format":"unknown","architecture":null},"provider":{"id":"rizin","name":"Rizin","version":null},"analysis_profile":null,"predicate_type":"rea.reverse-engineering.command-observation","operation":"execute_rizin_command","parameters":{"path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","command":"e scr.color=0;af @ 0x188ac3fa0;pdgo @ 0x188ac3fa0;afij @ 0x188ac3fa0","provider_executable":"C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe","command_arguments":["-N","-q","-c","e scr.color=0;af @ 0x188ac3fa0;pdgo @ 0x188ac3fa0;afij @ 0x188ac3fa0","C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"]},"raw_result":{"stdout":"    0x188ac3fa0    |\r\n    0x188ac3fa0    |// WARNING: Variable defined which should be unmapped: var_28h\r\n                   |\r\n    0x188ac3fa0    |int64_t fcn.188ac3fa0(int64_t arg1)\r\n                   |{\r\n                   |    undefined4 unaff_XMM6_Da;\r\n                   |    undefined4 unaff_XMM6_Db;\r\n                   |    int64_t var_28h;\r\n                   |    \r\n    0x188ac3fb0    |    *(undefined4 *)(arg1 + 8) = 0;\r\n    0x188ac3fba    |    *(undefined8 *)arg1 = 0x19005dd38;\r\n    0x188ac3fbd    |    *(undefined *)(arg1 + 0xc) = 0;\r\n    0x188ac3fc1    |    *(undefined8 *)(arg1 + 0x10) = 0;\r\n    0x188ac3fc5    |    *(undefined *)(arg1 + 0x18) = 0;\r\n    0x188ac3fc9    |    *(undefined *)(arg1 + 0x30) = 0;\r\n    0x188ac3fcd    |    *(undefined *)(arg1 + 0x38) = 0;\r\n    0x188ac3fd1    |    *(undefined *)(arg1 + 0x50) = 0;\r\n    0x188ac3fd9    |    fcn.184768050(CONCAT44(unaff_XMM6_Db, unaff_XMM6_Da));\r\n    0x188ac3fde    |    *(undefined *)(arg1 + 0x60) = 0;\r\n    0x188ac3fe2    |    *(undefined *)(arg1 + 0x78) = 0;\r\n    0x188ac3ff0    |    *(undefined8 *)(arg1 + 0x80) = 0;\r\n    0x188ac3ff0    |    *(undefined8 *)(arg1 + 0x88) = 0;\r\n    0x188ac3ff7    |    *(undefined8 *)(arg1 + 0x90) = 0;\r\n    0x188ac3ff7    |    *(undefined8 *)(arg1 + 0x98) = 0;\r\n    0x188ac3fe6    |    fcn.182048900(arg1 + 0xa0);\r\n    0x188ac4003    |    *(undefined8 *)(arg1 + 0xb8) = 0;\r\n    0x188ac400a    |    fcn.1859cfc50(arg1 + 0xc0);\r\n    0x188ac4016    |    *(undefined4 *)(arg1 + 0x138) = 0;\r\n    0x188ac401c    |    *(undefined2 *)(arg1 + 0x13c) = 0;\r\n    0x188ac402c    |    *(undefined4 *)(arg1 + 0x140) = 0;\r\n    0x188ac402c    |    *(undefined4 *)(arg1 + 0x144) = 9;\r\n    0x188ac402c    |    *(undefined4 *)(arg1 + 0x148) = 0xffffffff;\r\n    0x188ac402c    |    *(undefined4 *)(arg1 + 0x14c) = 0xffffffff;\r\n    0x188ac4033    |    *(undefined *)(arg1 + 0x150) = 0;\r\n    0x188ac403a    |    *(undefined *)(arg1 + 0x198) = 0;\r\n    0x188ac4048    |    *(undefined8 *)(arg1 + 0x1a0) = 0;\r\n    0x188ac4048    |    *(undefined8 *)(arg1 + 0x1a8) = 0;\r\n    0x188ac404f    |    *(undefined *)(arg1 + 0x1b0) = 0;\r\n    0x188ac4041    |    fcn.184cb8250(arg1 + 0x1b8);\r\n    0x188ac4062    |    *(undefined8 *)(arg1 + 0x1c0) = 0;\r\n    0x188ac4062    |    *(undefined8 *)(arg1 + 0x1c8) = 0;\r\n    0x188ac4069    |    *(undefined8 *)(arg1 + 0x1d0) = 0;\r\n    0x188ac405b    |    fcn.184cb8250(arg1 + 0x1d8);\r\n    0x188ac4075    |    *(undefined *)(arg1 + 0x220) = 0;\r\n    0x188ac407c    |    *(undefined8 *)(arg1 + 0x1e0) = 0;\r\n    0x188ac407c    |    *(undefined8 *)(arg1 + 0x1e8) = 0;\r\n    0x188ac4083    |    *(undefined8 *)(arg1 + 0x1f0) = 0;\r\n    0x188ac4083    |    *(undefined8 *)(arg1 + 0x1f8) = 0;\r\n    0x188ac408a    |    *(undefined8 *)(arg1 + 0x1f9) = 0;\r\n    0x188ac408a    |    *(undefined8 *)(arg1 + 0x201) = 0;\r\n    0x188ac4091    |    fcn.188ac45d0();\r\n    0x188ac40a4    |    return arg1;\r\n                   |}\r\n[{\"offset\":6587957152,\"name\":\"fcn.188ac3fa0\",\"size\":261,\"is-pure\":false,\"realsz\":261,\"noreturn\":false,\"stackframe\":72,\"calltype\":\"ms\",\"cost\":66,\"cc\":1,\"loops\":0,\"bits\":64,\"type\":\"fcn\",\"nbbs\":1,\"edges\":0,\"ebbs\":1,\"signature\":\"fcn.188ac3fa0(int64_t arg1);\",\"minbound\":6587957152,\"maxbound\":6587957413,\"callrefs\":[{\"from\":6587957209,\"to\":6517325904,\"type\":\"CALL\"},{\"from\":6587957246,\"to\":6476302592,\"type\":\"CALL\"},{\"from\":6587957265,\"to\":6536625232,\"type\":\"CALL\"},{\"from\":6587957334,\"to\":6522896976,\"type\":\"CALL\"},{\"from\":6587957360,\"to\":6522896976,\"type\":\"CALL\"},{\"from\":6587957393,\"to\":6587958736,\"type\":\"CALL\"}],\"datarefs\":[{\"from\":6587957171,\"to\":6711270712,\"type\":\"DATA\"},{\"from\":6587957285,\"to\":6718011216,\"type\":\"DATA\"}],\"indegree\":0,\"outdegree\":6,\"nlocals\":1,\"nargs\":1,\"stackvars\":[{\"name\":\"var_28h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-40}}],\"regvars\":[{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"normalized_result":{"stdout":"    0x188ac3fa0    |\r\n    0x188ac3fa0    |// WARNING: Variable defined which should be unmapped: var_28h\r\n                   |\r\n    0x188ac3fa0    |int64_t fcn.188ac3fa0(int64_t arg1)\r\n                   |{\r\n                   |    undefined4 unaff_XMM6_Da;\r\n                   |    undefined4 unaff_XMM6_Db;\r\n                   |    int64_t var_28h;\r\n                   |    \r\n    0x188ac3fb0    |    *(undefined4 *)(arg1 + 8) = 0;\r\n    0x188ac3fba    |    *(undefined8 *)arg1 = 0x19005dd38;\r\n    0x188ac3fbd    |    *(undefined *)(arg1 + 0xc) = 0;\r\n    0x188ac3fc1    |    *(undefined8 *)(arg1 + 0x10) = 0;\r\n    0x188ac3fc5    |    *(undefined *)(arg1 + 0x18) = 0;\r\n    0x188ac3fc9    |    *(undefined *)(arg1 + 0x30) = 0;\r\n    0x188ac3fcd    |    *(undefined *)(arg1 + 0x38) = 0;\r\n    0x188ac3fd1    |    *(undefined *)(arg1 + 0x50) = 0;\r\n    0x188ac3fd9    |    fcn.184768050(CONCAT44(unaff_XMM6_Db, unaff_XMM6_Da));\r\n    0x188ac3fde    |    *(undefined *)(arg1 + 0x60) = 0;\r\n    0x188ac3fe2    |    *(undefined *)(arg1 + 0x78) = 0;\r\n    0x188ac3ff0    |    *(undefined8 *)(arg1 + 0x80) = 0;\r\n    0x188ac3ff0    |    *(undefined8 *)(arg1 + 0x88) = 0;\r\n    0x188ac3ff7    |    *(undefined8 *)(arg1 + 0x90) = 0;\r\n    0x188ac3ff7    |    *(undefined8 *)(arg1 + 0x98) = 0;\r\n    0x188ac3fe6    |    fcn.182048900(arg1 + 0xa0);\r\n    0x188ac4003    |    *(undefined8 *)(arg1 + 0xb8) = 0;\r\n    0x188ac400a    |    fcn.1859cfc50(arg1 + 0xc0);\r\n    0x188ac4016    |    *(undefined4 *)(arg1 + 0x138) = 0;\r\n    0x188ac401c    |    *(undefined2 *)(arg1 + 0x13c) = 0;\r\n    0x188ac402c    |    *(undefined4 *)(arg1 + 0x140) = 0;\r\n    0x188ac402c    |    *(undefined4 *)(arg1 + 0x144) = 9;\r\n    0x188ac402c    |    *(undefined4 *)(arg1 + 0x148) = 0xffffffff;\r\n    0x188ac402c    |    *(undefined4 *)(arg1 + 0x14c) = 0xffffffff;\r\n    0x188ac4033    |    *(undefined *)(arg1 + 0x150) = 0;\r\n    0x188ac403a    |    *(undefined *)(arg1 + 0x198) = 0;\r\n    0x188ac4048    |    *(undefined8 *)(arg1 + 0x1a0) = 0;\r\n    0x188ac4048    |    *(undefined8 *)(arg1 + 0x1a8) = 0;\r\n    0x188ac404f    |    *(undefined *)(arg1 + 0x1b0) = 0;\r\n    0x188ac4041    |    fcn.184cb8250(arg1 + 0x1b8);\r\n    0x188ac4062    |    *(undefined8 *)(arg1 + 0x1c0) = 0;\r\n    0x188ac4062    |    *(undefined8 *)(arg1 + 0x1c8) = 0;\r\n    0x188ac4069    |    *(undefined8 *)(arg1 + 0x1d0) = 0;\r\n    0x188ac405b    |    fcn.184cb8250(arg1 + 0x1d8);\r\n    0x188ac4075    |    *(undefined *)(arg1 + 0x220) = 0;\r\n    0x188ac407c    |    *(undefined8 *)(arg1 + 0x1e0) = 0;\r\n    0x188ac407c    |    *(undefined8 *)(arg1 + 0x1e8) = 0;\r\n    0x188ac4083    |    *(undefined8 *)(arg1 + 0x1f0) = 0;\r\n    0x188ac4083    |    *(undefined8 *)(arg1 + 0x1f8) = 0;\r\n    0x188ac408a    |    *(undefined8 *)(arg1 + 0x1f9) = 0;\r\n    0x188ac408a    |    *(undefined8 *)(arg1 + 0x201) = 0;\r\n    0x188ac4091    |    fcn.188ac45d0();\r\n    0x188ac40a4    |    return arg1;\r\n                   |}\r\n[{\"offset\":6587957152,\"name\":\"fcn.188ac3fa0\",\"size\":261,\"is-pure\":false,\"realsz\":261,\"noreturn\":false,\"stackframe\":72,\"calltype\":\"ms\",\"cost\":66,\"cc\":1,\"loops\":0,\"bits\":64,\"type\":\"fcn\",\"nbbs\":1,\"edges\":0,\"ebbs\":1,\"signature\":\"fcn.188ac3fa0(int64_t arg1);\",\"minbound\":6587957152,\"maxbound\":6587957413,\"callrefs\":[{\"from\":6587957209,\"to\":6517325904,\"type\":\"CALL\"},{\"from\":6587957246,\"to\":6476302592,\"type\":\"CALL\"},{\"from\":6587957265,\"to\":6536625232,\"type\":\"CALL\"},{\"from\":6587957334,\"to\":6522896976,\"type\":\"CALL\"},{\"from\":6587957360,\"to\":6522896976,\"type\":\"CALL\"},{\"from\":6587957393,\"to\":6587958736,\"type\":\"CALL\"}],\"datarefs\":[{\"from\":6587957171,\"to\":6711270712,\"type\":\"DATA\"},{\"from\":6587957285,\"to\":6718011216,\"type\":\"DATA\"}],\"indegree\":0,\"outdegree\":6,\"nlocals\":1,\"nargs\":1,\"stackvars\":[{\"name\":\"var_28h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-40}}],\"regvars\":[{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"confidence":"observed","authority":"shipped-artifact","environment":null,"limitations":["The executable version and supported formats are reported as unknown because no reliable version probe was performed.","A non-zero process exit is preserved as an observed command result.","Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.","When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call."],"relationship_coverage":null,"locations":[{"kind":"artifact-path","path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"}],"evidence_links":[]},"meta":{"command":"execute-rizin-command","duration":"4944ms"}}