{"ok":true,"data":{"evidence_id":"ev_08e91b503bdec87a91b3d83b632848686209d2b6f632d35bd0e3506e0d911955","subject":{"name":"Tabbit.dll","digest":{"sha256":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c"},"local_path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","format":"unknown","architecture":null},"provider":{"id":"rizin","name":"Rizin","version":null},"analysis_profile":null,"predicate_type":"rea.reverse-engineering.command-observation","operation":"execute_rizin_command","parameters":{"path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","command":"e scr.color=0;s 0x18a0722e0;af;afu 0x18a0724f6;pdg @ 0x18a0722e0;afij @ 0x18a0722e0","provider_executable":"C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe","command_arguments":["-N","-q","-c","e scr.color=0;s 0x18a0722e0;af;afu 0x18a0724f6;pdg @ 0x18a0722e0;afij @ 0x18a0722e0","C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"]},"raw_result":{"stdout":"\r\nint64_t fcn.18a0722e0(int64_t arg1, int64_t arg2, int64_t arg3, int64_t arg4)\r\n{\r\n    uint64_t uVar1;\r\n    code *pcVar2;\r\n    uint64_t uVar3;\r\n    uint64_t uVar4;\r\n    int64_t iVar5;\r\n    undefined auStack_98 [32];\r\n    int64_t var_78h;\r\n    int64_t var_58h;\r\n    int64_t var_40h;\r\n    \r\n    var_40h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_98;\r\n    *(undefined8 *)arg1 = 0x18fc7b5c0;\r\n    *(undefined8 *)(arg1 + 8) = 0x18feed6b0;\r\n    *(undefined8 *)(arg1 + 0x10) = 0x18fc7b640;\r\n    func_0x000184cb8250(arg1 + 0x18);\r\n    *(undefined8 *)(arg1 + 0x20) = 0;\r\n    if ((arg3 & 0xfffffffc00000000U) == *(uint64_t *)0x191cd6d08) {\r\n        func_0x0001841c7180(arg3);\r\n    }\r\n    *(int64_t *)(arg1 + 0x28) = arg3;\r\n    if ((arg4 & 0xfffffffc00000000U) == *(uint64_t *)0x191cd6d08) {\r\n        func_0x0001841c7180(arg4);\r\n    }\r\n    *(int64_t *)(arg1 + 0x30) = arg4;\r\n    func_0x0001858d4af0(arg1 + 0x38);\r\n    *(undefined8 *)(arg1 + 0x60) = 0;\r\n    func_0x000185942da0(&var_58h, arg2);\r\n    func_0x000185942da0(&var_78h, &var_58h);\r\n    func_0x00018a077090(arg1 + 0x68, arg1, &var_78h);\r\n    func_0x0001841fa630(&var_58h);\r\n    func_0x000184339cd0(&var_78h, 0x190b498b8, 0x190b49870, 0x1bb);\r\n    uVar4 = func_0x0001824f0260(arg3);\r\n    if (uVar4 != 0) {\r\n        uVar1 = arg1 + 0x10;\r\n        if ((uVar4 & 0xfffffffc00000000) == *(uint64_t *)0x191cd6d08) {\r\n            func_0x0001841c7180(uVar4);\r\n        }\r\n        uVar3 = *(uint64_t *)0x191cd6d08;\r\n        *(uint64_t *)(arg1 + 0x98) = uVar4;\r\n        if ((uVar1 & 0xfffffffc00000000) == uVar3) {\r\n            func_0x0001841c7180(uVar1);\r\n        }\r\n        *(uint64_t *)(arg1 + 0xa0) = uVar1;\r\n        *(undefined8 *)(arg1 + 0xa8) = 0;\r\n        uVar4 = func_0x000185aa63e0();\r\n        if ((uVar4 & 0xfffffffc00000000) == *(uint64_t *)0x191cd6d08) {\r\n            func_0x0001841c7180(uVar4);\r\n        }\r\n        *(uint64_t *)(arg1 + 0xb0) = uVar4;\r\n        *(undefined *)(arg1 + 0xf0) = 0;\r\n        *(undefined8 *)(arg1 + 0xb8) = 0;\r\n        *(undefined8 *)(arg1 + 0xc0) = 0;\r\n        *(undefined8 *)(arg1 + 200) = 0;\r\n        *(undefined8 *)(arg1 + 0xd0) = 0;\r\n        *(undefined8 *)(arg1 + 0xd8) = 0;\r\n        *(undefined8 *)(arg1 + 0xe0) = 0;\r\n        *(undefined *)(arg1 + 0xe8) = 0;\r\n        *(undefined8 *)(arg1 + 0xf8) = 0;\r\n        *(undefined8 *)(arg1 + 0x100) = 0;\r\n        *(undefined8 *)(arg1 + 0x108) = 0;\r\n        *(undefined8 *)(arg1 + 0x110) = 0;\r\n        *(undefined8 *)(arg1 + 0x118) = 0;\r\n        *(undefined8 *)(arg1 + 0x120) = 0;\r\n        func_0x0001851a4900(arg1 + 0x128, arg1);\r\n        func_0x0001841fa630(arg2);\r\n        if (*(uint64_t *)0x191c71040 == (var_40h ^ (uint64_t)auStack_98)) {\r\n            return arg1;\r\n        }\r\n        func_0x000185f05b40(var_40h ^ (uint64_t)auStack_98);\r\n    }\r\n    pcVar2 = (code *)swi(3);\r\n    iVar5 = (*pcVar2)();\r\n    return iVar5;\r\n}\r\n[{\"offset\":6610690784,\"name\":\"fcn.18a0722e0\",\"size\":531,\"is-pure\":false,\"realsz\":531,\"noreturn\":false,\"stackframe\":152,\"calltype\":\"ms\",\"cost\":170,\"cc\":9,\"loops\":0,\"bits\":64,\"type\":\"fcn\",\"nbbs\":15,\"edges\":20,\"ebbs\":2,\"signature\":\"fcn.18a0722e0(int64_t arg1, int64_t arg2, int64_t arg3, int64_t arg4);\",\"minbound\":6610690784,\"maxbound\":6610691315,\"callrefs\":[{\"from\":6610690872,\"to\":6522896976,\"type\":\"CALL\"},{\"from\":6610690903,\"to\":6511423872,\"type\":\"CALL\"},{\"from\":6610690930,\"to\":6511423872,\"type\":\"CALL\"},{\"from\":6610690943,\"to\":6535596784,\"type\":\"CALL\"},{\"from\":6610690971,\"to\":6536048032,\"type\":\"CALL\"},{\"from\":6610690987,\"to\":6536048032,\"type\":\"CALL\"},{\"from\":6610691001,\"to\":6610710672,\"type\":\"CALL\"},{\"from\":6610691009,\"to\":6511633968,\"type\":\"CALL\"},{\"from\":6610691039,\"to\":6512942288,\"type\":\"CALL\"},{\"from\":6610691047,\"to\":6481183328,\"type\":\"CALL\"},{\"from\":6610691089,\"to\":6511423872,\"type\":\"CALL\"},{\"from\":6610691122,\"to\":6511423872,\"type\":\"CALL\"},{\"from\":6610691145,\"to\":6537503712,\"type\":\"CALL\"},{\"from\":6610691168,\"to\":6511423872,\"type\":\"CALL\"},{\"from\":6610691249,\"to\":6528059648,\"type\":\"CALL\"},{\"from\":6610691257,\"to\":6511633968,\"type\":\"CALL\"},{\"from\":6610691309,\"to\":6542089024,\"type\":\"CALL\"}],\"datarefs\":[{\"from\":6610690811,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6610690836,\"to\":6707197376,\"type\":\"DATA\"},{\"from\":6610690846,\"to\":6709761712,\"type\":\"DATA\"},{\"from\":6610690857,\"to\":6707197504,\"type\":\"DATA\"},{\"from\":6610690891,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6610690918,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6610691014,\"to\":6722721976,\"type\":\"DATA\"},{\"from\":6610691021,\"to\":6722721904,\"type\":\"DATA\"},{\"from\":6610691074,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6610691094,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6610691156,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6610691270,\"to\":6740709440,\"type\":\"DATA\"}],\"indegree\":0,\"outdegree\":17,\"nlocals\":3,\"nargs\":4,\"stackvars\":[{\"name\":\"var_78h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-120}},{\"name\":\"var_58h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-88}},{\"name\":\"var_40h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-64}}],\"regvars\":[{\"name\":\"arg3\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"r8\"}},{\"name\":\"arg4\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"r9\"}},{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"normalized_result":{"stdout":"\r\nint64_t fcn.18a0722e0(int64_t arg1, int64_t arg2, int64_t arg3, int64_t arg4)\r\n{\r\n    uint64_t uVar1;\r\n    code *pcVar2;\r\n    uint64_t uVar3;\r\n    uint64_t uVar4;\r\n    int64_t iVar5;\r\n    undefined auStack_98 [32];\r\n    int64_t var_78h;\r\n    int64_t var_58h;\r\n    int64_t var_40h;\r\n    \r\n    var_40h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_98;\r\n    *(undefined8 *)arg1 = 0x18fc7b5c0;\r\n    *(undefined8 *)(arg1 + 8) = 0x18feed6b0;\r\n    *(undefined8 *)(arg1 + 0x10) = 0x18fc7b640;\r\n    func_0x000184cb8250(arg1 + 0x18);\r\n    *(undefined8 *)(arg1 + 0x20) = 0;\r\n    if ((arg3 & 0xfffffffc00000000U) == *(uint64_t *)0x191cd6d08) {\r\n        func_0x0001841c7180(arg3);\r\n    }\r\n    *(int64_t *)(arg1 + 0x28) = arg3;\r\n    if ((arg4 & 0xfffffffc00000000U) == *(uint64_t *)0x191cd6d08) {\r\n        func_0x0001841c7180(arg4);\r\n    }\r\n    *(int64_t *)(arg1 + 0x30) = arg4;\r\n    func_0x0001858d4af0(arg1 + 0x38);\r\n    *(undefined8 *)(arg1 + 0x60) = 0;\r\n    func_0x000185942da0(&var_58h, arg2);\r\n    func_0x000185942da0(&var_78h, &var_58h);\r\n    func_0x00018a077090(arg1 + 0x68, arg1, &var_78h);\r\n    func_0x0001841fa630(&var_58h);\r\n    func_0x000184339cd0(&var_78h, 0x190b498b8, 0x190b49870, 0x1bb);\r\n    uVar4 = func_0x0001824f0260(arg3);\r\n    if (uVar4 != 0) {\r\n        uVar1 = arg1 + 0x10;\r\n        if ((uVar4 & 0xfffffffc00000000) == *(uint64_t *)0x191cd6d08) {\r\n            func_0x0001841c7180(uVar4);\r\n        }\r\n        uVar3 = *(uint64_t *)0x191cd6d08;\r\n        *(uint64_t *)(arg1 + 0x98) = uVar4;\r\n        if ((uVar1 & 0xfffffffc00000000) == uVar3) {\r\n            func_0x0001841c7180(uVar1);\r\n        }\r\n        *(uint64_t *)(arg1 + 0xa0) = uVar1;\r\n        *(undefined8 *)(arg1 + 0xa8) = 0;\r\n        uVar4 = func_0x000185aa63e0();\r\n        if ((uVar4 & 0xfffffffc00000000) == *(uint64_t *)0x191cd6d08) {\r\n            func_0x0001841c7180(uVar4);\r\n        }\r\n        *(uint64_t *)(arg1 + 0xb0) = uVar4;\r\n        *(undefined *)(arg1 + 0xf0) = 0;\r\n        *(undefined8 *)(arg1 + 0xb8) = 0;\r\n        *(undefined8 *)(arg1 + 0xc0) = 0;\r\n        *(undefined8 *)(arg1 + 200) = 0;\r\n        *(undefined8 *)(arg1 + 0xd0) = 0;\r\n        *(undefined8 *)(arg1 + 0xd8) = 0;\r\n        *(undefined8 *)(arg1 + 0xe0) = 0;\r\n        *(undefined *)(arg1 + 0xe8) = 0;\r\n        *(undefined8 *)(arg1 + 0xf8) = 0;\r\n        *(undefined8 *)(arg1 + 0x100) = 0;\r\n        *(undefined8 *)(arg1 + 0x108) = 0;\r\n        *(undefined8 *)(arg1 + 0x110) = 0;\r\n        *(undefined8 *)(arg1 + 0x118) = 0;\r\n        *(undefined8 *)(arg1 + 0x120) = 0;\r\n        func_0x0001851a4900(arg1 + 0x128, arg1);\r\n        func_0x0001841fa630(arg2);\r\n        if (*(uint64_t *)0x191c71040 == (var_40h ^ (uint64_t)auStack_98)) {\r\n            return arg1;\r\n        }\r\n        func_0x000185f05b40(var_40h ^ (uint64_t)auStack_98);\r\n    }\r\n    pcVar2 = (code *)swi(3);\r\n    iVar5 = (*pcVar2)();\r\n    return iVar5;\r\n}\r\n[{\"offset\":6610690784,\"name\":\"fcn.18a0722e0\",\"size\":531,\"is-pure\":false,\"realsz\":531,\"noreturn\":false,\"stackframe\":152,\"calltype\":\"ms\",\"cost\":170,\"cc\":9,\"loops\":0,\"bits\":64,\"type\":\"fcn\",\"nbbs\":15,\"edges\":20,\"ebbs\":2,\"signature\":\"fcn.18a0722e0(int64_t arg1, int64_t arg2, int64_t arg3, int64_t arg4);\",\"minbound\":6610690784,\"maxbound\":6610691315,\"callrefs\":[{\"from\":6610690872,\"to\":6522896976,\"type\":\"CALL\"},{\"from\":6610690903,\"to\":6511423872,\"type\":\"CALL\"},{\"from\":6610690930,\"to\":6511423872,\"type\":\"CALL\"},{\"from\":6610690943,\"to\":6535596784,\"type\":\"CALL\"},{\"from\":6610690971,\"to\":6536048032,\"type\":\"CALL\"},{\"from\":6610690987,\"to\":6536048032,\"type\":\"CALL\"},{\"from\":6610691001,\"to\":6610710672,\"type\":\"CALL\"},{\"from\":6610691009,\"to\":6511633968,\"type\":\"CALL\"},{\"from\":6610691039,\"to\":6512942288,\"type\":\"CALL\"},{\"from\":6610691047,\"to\":6481183328,\"type\":\"CALL\"},{\"from\":6610691089,\"to\":6511423872,\"type\":\"CALL\"},{\"from\":6610691122,\"to\":6511423872,\"type\":\"CALL\"},{\"from\":6610691145,\"to\":6537503712,\"type\":\"CALL\"},{\"from\":6610691168,\"to\":6511423872,\"type\":\"CALL\"},{\"from\":6610691249,\"to\":6528059648,\"type\":\"CALL\"},{\"from\":6610691257,\"to\":6511633968,\"type\":\"CALL\"},{\"from\":6610691309,\"to\":6542089024,\"type\":\"CALL\"}],\"datarefs\":[{\"from\":6610690811,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6610690836,\"to\":6707197376,\"type\":\"DATA\"},{\"from\":6610690846,\"to\":6709761712,\"type\":\"DATA\"},{\"from\":6610690857,\"to\":6707197504,\"type\":\"DATA\"},{\"from\":6610690891,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6610690918,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6610691014,\"to\":6722721976,\"type\":\"DATA\"},{\"from\":6610691021,\"to\":6722721904,\"type\":\"DATA\"},{\"from\":6610691074,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6610691094,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6610691156,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6610691270,\"to\":6740709440,\"type\":\"DATA\"}],\"indegree\":0,\"outdegree\":17,\"nlocals\":3,\"nargs\":4,\"stackvars\":[{\"name\":\"var_78h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-120}},{\"name\":\"var_58h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-88}},{\"name\":\"var_40h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-64}}],\"regvars\":[{\"name\":\"arg3\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"r8\"}},{\"name\":\"arg4\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"r9\"}},{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"confidence":"observed","authority":"shipped-artifact","environment":null,"limitations":["The executable version and supported formats are reported as unknown because no reliable version probe was performed.","A non-zero process exit is preserved as an observed command result.","Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.","When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call."],"relationship_coverage":null,"locations":[{"kind":"artifact-path","path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"}],"evidence_links":[]},"meta":{"command":"execute-rizin-command","duration":"5057ms"}}