{"ok":true,"data":{"evidence_id":"ev_8d2181c6b79b3179bbf6c18539f810ad43994984e9cadde775fc0181783a2108","subject":{"name":"Tabbit.dll","digest":{"sha256":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c"},"local_path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","format":"unknown","architecture":null},"provider":{"id":"rizin","name":"Rizin","version":null},"analysis_profile":null,"predicate_type":"rea.reverse-engineering.command-observation","operation":"execute_rizin_command","parameters":{"path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","command":"e scr.color=0;af @ 0x18388a750;pdgo @ 0x18388a750;afij @ 0x18388a750","provider_executable":"C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe","command_arguments":["-N","-q","-c","e scr.color=0;af @ 0x18388a750;pdgo @ 0x18388a750;afij @ 0x18388a750","C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"]},"raw_result":{"stdout":"                   |\r\n    0x18388a750    |void fcn.18388a750(int64_t arg1)\r\n                   |{\r\n                   |    int32_t *piVar1;\r\n                   |    int32_t iVar2;\r\n                   |    int32_t *piVar3;\r\n                   |    char cVar4;\r\n                   |    int64_t iVar5;\r\n                   |    int64_t iVar6;\r\n                   |    undefined8 uVar7;\r\n                   |    undefined4 *puVar8;\r\n                   |    int64_t var_170h;\r\n                   |    undefined4 uStack_168;\r\n                   |    undefined4 uStack_164;\r\n                   |    int64_t var_160h;\r\n                   |    int64_t var_158h;\r\n                   |    int64_t iStack_150;\r\n                   |    int64_t var_118h;\r\n                   |    int64_t var_108h;\r\n                   |    int64_t var_f0h;\r\n                   |    int64_t var_40h;\r\n                   |    undefined8 uStack_38;\r\n                   |    int64_t var_30h;\r\n                   |    undefined8 uStack_28;\r\n                   |    \r\n    0x18388a769    |    if (*(int64_t *)0x191d87838 == 0) {\r\n    0x18388a8d2    |        if (1 < *(int32_t *)0x191de85c0) {\r\n    0x18388a8ca    |            return;\r\n                   |        }\r\n    0x18388a8e5    |        if ((*(int32_t *)0x191cd6be0 == 0) && (*(int64_t *)0x191de85c8 == 0)) {\r\n    0x18388a8ca    |            return;\r\n                   |        }\r\n    0x18388a8ee    |        func_0x00018030d390(&var_170h, 0x190c46e38, 0x26, 1);\r\n    0x18388a91c    |        uVar7 = func_0x000184dcd0d0(&var_160h, 0x190c46e78, 0x29);\r\n    0x18388a931    |        func_0x000184dcd0d0(uVar7, 0x190c46ea8, 0x1d);\r\n    0x18388a93d    |        var_170h = 0x18ff81648;\r\n    0x18388a8ee    |        func_0x00018030e9d0(&var_170h);\r\n    0x18388a957    |        *(undefined8 *)((int64_t)&var_160h + (int64_t)*(int32_t *)(CONCAT44(var_160h._4_4_, (undefined4)var_160h) + 4))\r\n    0x18388a957    |             = 0x18fe1b290;\r\n                   |    } else {\r\n    0x18388a776    |        iVar5 = (*(code *)0x185f59da0)();\r\n    0x18388a77f    |        if (iVar5 != 0) {\r\n    0x18388a793    |            var_30h = 0x190c466d0;\r\n    0x18388a796    |            uStack_28 = 0x2c;\r\n    0x18388a7a1    |            iVar6 = func_0x000185603c00(iVar5);\r\n    0x18388a7a9    |            if (iVar6 != 0) {\r\n    0x18388a7b3    |                var_40h = 0x190c466d0;\r\n    0x18388a7b6    |                uStack_38 = 0x2c;\r\n    0x18388a7c1    |                cVar4 = func_0x000184dc6ec0(iVar5);\r\n    0x18388a7c8    |                if (cVar4 != '\\0') {\r\n    0x18388a994    |                    if ((*(int32_t *)0x191de85c0 < 2) &&\r\n    0x18388a983    |                       ((*(int32_t *)0x191cd6be0 != 0 || (*(int64_t *)0x191de85c8 != 0)))) {\r\n    0x18388a9a1    |                        func_0x00018030d390(&var_170h, 0x190c46e38, 0x34, 1);\r\n    0x18388a9cf    |                        uVar7 = func_0x000184dcd0d0(&var_160h, 0x190c46f00, 0x33);\r\n    0x18388a9db    |                        uVar7 = func_0x000184dd1300(uVar7, *(undefined8 *)(arg1 + 0x68));\r\n    0x18388a9f0    |                        func_0x000184dcd0d0(uVar7, 0x190852d14, 2);\r\n    0x18388a9fc    |                        var_170h = 0x18ff81648;\r\n    0x18388a9a1    |                        func_0x00018030e9d0(&var_170h);\r\n    0x18388aa16    |                        *(undefined8 *)\r\n    0x18388aa16    |                         ((int64_t)&var_160h + (int64_t)*(int32_t *)(CONCAT44(var_160h._4_4_, (undefined4)var_160h) + 4)\r\n    0x18388aa16    |                         ) = 0x18fe1b290;\r\n    0x18388aa22    |                        var_158h = 0x18fe20d40;\r\n    0x18388aa2a    |                        if (var_108h._7_1_ < '\\0') {\r\n    0x18388aa46    |                            func_0x0001841dcbe0(var_118h, \r\n    0x18388aa36    |                                                CONCAT17(var_108h._7_1_, (unkbyte7)var_108h) & 0x7fffffffffffffff);\r\n                   |                        }\r\n    0x18388aa57    |                        var_158h = 0x18fe20db0;\r\n    0x18388aa68    |                        if (iStack_150 != 0x191de1450) {\r\n    0x18388abb6    |                            LOCK();\r\n    0x18388abb6    |                            piVar1 = (int32_t *)(iStack_150 + 8);\r\n    0x18388abb6    |                            iVar2 = *piVar1;\r\n    0x18388abb6    |                            *piVar1 = *piVar1 + -1;\r\n    0x18388abb6    |                            UNLOCK();\r\n    0x18388abbd    |                            if (iVar2 == 0) {\r\n    0x18388abca    |                                (*(code *)0x185f59da0)();\r\n                   |                            }\r\n                   |                        }\r\n    0x18388aa4b    |                        func_0x00018424db70(&var_158h);\r\n    0x18388aa6e    |                        func_0x0001848f8b80(&var_f0h);\r\n                   |                    }\r\n    0x18388aa9a    |                    if ((arg1 & 0xfffffffc00000000U) == *(uint64_t *)0x191cd6d08) {\r\n    0x18388aa9f    |                        func_0x0001841c7180(arg1);\r\n                   |                    }\r\n    0x18388aaad    |                    puVar8 = (undefined4 *)func_0x000185f006b8(0x30);\r\n    0x18388aab5    |                    *puVar8 = 1;\r\n    0x18388aac2    |                    *(undefined8 *)(puVar8 + 2) = 0x1803915b0;\r\n    0x18388aacd    |                    *(undefined8 *)(puVar8 + 4) = 0x182bee630;\r\n    0x18388aad8    |                    *(undefined8 *)(puVar8 + 6) = 0x1841d75d0;\r\n    0x18388aae3    |                    *(undefined8 *)(puVar8 + 8) = 0x18388abe0;\r\n    0x18388aae7    |                    *(int64_t *)(puVar8 + 10) = arg1;\r\n    0x18388aaf9    |                    func_0x000184339cd0(&var_170h, 0x190151058, 0x190c46e38, 0x37);\r\n    0x18388ab09    |                    piVar1 = *(int32_t **)(arg1 + 0x60);\r\n    0x18388ab0d    |                    *(undefined4 **)(arg1 + 0x60) = puVar8;\r\n    0x18388ab14    |                    if (piVar1 != (int32_t *)0x0) {\r\n    0x18388ab44    |                        LOCK();\r\n    0x18388ab44    |                        *piVar1 = *piVar1 + -1;\r\n    0x18388ab44    |                        UNLOCK();\r\n    0x18388ab47    |                        if (*piVar1 == 0) {\r\n    0x18388ab57    |                            if (*(int64_t *)(piVar1 + 4) == 0x182bf38a0) {\r\n    0x18388ab64    |                                piVar3 = *(int32_t **)(piVar1 + 0xc);\r\n    0x18388ab6b    |                                if (piVar3 != (int32_t *)0x0) {\r\n    0x18388ab7c    |                                    LOCK();\r\n    0x18388ab7c    |                                    *piVar3 = *piVar3 + -1;\r\n    0x18388ab7c    |                                    UNLOCK();\r\n    0x18388ab7f    |                                    if (*piVar3 == 0) {\r\n    0x18388ab86    |                                        func_0x0001841dcbe0(piVar3, 8);\r\n                   |                                    }\r\n                   |                                }\r\n    0x18388ab75    |                                func_0x0001841dcbe0(piVar1, 0x48);\r\n                   |                            } else {\r\n    0x18388ab5c    |                                (*(code *)0x185f59da0)(piVar1);\r\n                   |                            }\r\n                   |                        }\r\n                   |                    }\r\n    0x18388ab1a    |                    *(undefined4 *)(arg1 + 0x28) = (undefined4)var_160h;\r\n    0x18388ab22    |                    *(undefined4 *)(arg1 + 0x18) = (undefined4)var_170h;\r\n    0x18388ab22    |                    *(undefined4 *)(arg1 + 0x1c) = var_170h._4_4_;\r\n    0x18388ab22    |                    *(undefined4 *)(arg1 + 0x20) = uStack_168;\r\n    0x18388ab22    |                    *(undefined4 *)(arg1 + 0x24) = uStack_164;\r\n    0x18388ab2b    |                    *(int64_t *)(arg1 + 0x30) = var_158h;\r\n    0x18388ab2f    |                    *(undefined8 *)(arg1 + 0x48) = 60000000;\r\n    0x18388aaa4    |                    func_0x00018477a0a0(arg1 + 8);\r\n    0x18388a8ca    |                    return;\r\n                   |                }\r\n                   |            }\r\n                   |        }\r\n    0x18388a7d5    |        if (1 < *(int32_t *)0x191de85c0) {\r\n    0x18388a8ca    |            return;\r\n                   |        }\r\n    0x18388a7ec    |        if ((*(int32_t *)0x191cd6be0 == 0) && (*(int64_t *)0x191de85c8 == 0)) {\r\n    0x18388a8ca    |            return;\r\n                   |        }\r\n    0x18388a7f9    |        func_0x00018030d390(&var_170h, 0x190c46e38, 0x30, 1);\r\n    0x18388a812    |        func_0x000184dcd0d0(&var_160h, 0x190c46ec8, 0x33);\r\n    0x18388a833    |        var_170h = 0x18ff81648;\r\n    0x18388a7f9    |        func_0x00018030e9d0(&var_170h);\r\n    0x18388a84d    |        *(undefined8 *)((int64_t)&var_160h + (int64_t)*(int32_t *)(CONCAT44(var_160h._4_4_, (undefined4)var_160h) + 4))\r\n    0x18388a84d    |             = 0x18fe1b290;\r\n                   |    }\r\n    0x18388a96b    |    if (var_108h._7_1_ < '\\0') {\r\n    0x18388a863    |        var_158h = 0x18fe20d40;\r\n    0x18388a87d    |        func_0x0001841dcbe0(var_118h, CONCAT17(var_108h._7_1_, (unkbyte7)var_108h) & 0x7fffffffffffffff);\r\n                   |    }\r\n    0x18388a88e    |    var_158h = 0x18fe20db0;\r\n    0x18388a89f    |    if (iStack_150 != 0x191de1450) {\r\n    0x18388ab92    |        LOCK();\r\n    0x18388ab92    |        piVar1 = (int32_t *)(iStack_150 + 8);\r\n    0x18388ab92    |        iVar2 = *piVar1;\r\n    0x18388ab92    |        *piVar1 = *piVar1 + -1;\r\n    0x18388ab92    |        UNLOCK();\r\n    0x18388ab99    |        if (iVar2 == 0) {\r\n    0x18388aba6    |            (*(code *)0x185f59da0)();\r\n                   |        }\r\n                   |    }\r\n    0x18388a882    |    func_0x00018424db70(&var_158h);\r\n    0x18388a8a5    |    func_0x0001848f8b80(&var_f0h);\r\n    0x18388a8ca    |    return;\r\n                   |}\r\n[{\"offset\":6501738320,\"name\":\"fcn.18388a750\",\"size\":1157,\"is-pure\":false,\"realsz\":1157,\"noreturn\":false,\"stackframe\":408,\"calltype\":\"ms\",\"cost\":343,\"cc\":27,\"loops\":14,\"bits\":64,\"type\":\"fcn\",\"nbbs\":39,\"edges\":64,\"ebbs\":1,\"signature\":\"fcn.18388a750(int64_t arg1);\",\"minbound\":6501738320,\"maxbound\":6501739477,\"callrefs\":[{\"from\":6501738358,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6501738401,\"to\":6532643840,\"type\":\"CALL\"},{\"from\":6501738433,\"to\":6524006080,\"type\":\"CALL\"},{\"from\":6501738509,\"to\":6445650832,\"type\":\"CALL\"},{\"from\":6501738535,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6501738554,\"to\":6445656528,\"type\":\"CALL\"},{\"from\":6501738621,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6501738672,\"to\":6511975280,\"type\":\"CALL\"},{\"from\":6501738680,\"to\":6518967168,\"type\":\"CALL\"},{\"from\":6501738754,\"to\":6445650832,\"type\":\"CALL\"},{\"from\":6501738780,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6501738801,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6501738820,\"to\":6445656528,\"type\":\"CALL\"},{\"from\":6501738865,\"to\":6501738626,\"type\":\"CODE\"},{\"from\":6501738933,\"to\":6445650832,\"type\":\"CALL\"},{\"from\":6501738959,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6501738971,\"to\":6524048128,\"type\":\"CALL\"},{\"from\":6501738992,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6501739011,\"to\":6445656528,\"type\":\"CALL\"},{\"from\":6501739078,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6501739129,\"to\":6511975280,\"type\":\"CALL\"},{\"from\":6501739137,\"to\":6518967168,\"type\":\"CALL\"},{\"from\":6501739167,\"to\":6511423872,\"type\":\"CALL\"},{\"from\":6501739181,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6501739268,\"to\":6512942288,\"type\":\"CALL\"},{\"from\":6501739322,\"to\":6517399712,\"type\":\"CALL\"},{\"from\":6501739327,\"to\":6501738686,\"type\":\"CODE\"},{\"from\":6501739356,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6501739362,\"to\":6501739286,\"type\":\"CODE\"},{\"from\":6501739381,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6501739386,\"to\":6501739286,\"type\":\"CODE\"},{\"from\":6501739398,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6501739403,\"to\":6501739373,\"type\":\"CODE\"},{\"from\":6501739430,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6501739436,\"to\":6501738661,\"type\":\"CODE\"},{\"from\":6501739466,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6501739472,\"to\":6501739118,\"type\":\"CODE\"}],\"datarefs\":[{\"from\":6501738335,\"to\":6741850168,\"type\":\"DATA\"},{\"from\":6501738372,\"to\":6723757776,\"type\":\"DATA\"},{\"from\":6501738446,\"to\":6742246848,\"type\":\"DATA\"},{\"from\":6501738459,\"to\":6741126112,\"type\":\"DATA\"},{\"from\":6501738468,\"to\":6742246856,\"type\":\"DATA\"},{\"from\":6501738482,\"to\":6723759672,\"type\":\"DATA\"},{\"from\":6501738519,\"to\":6723759816,\"type\":\"DATA\"},{\"from\":6501738540,\"to\":6710367816,\"type\":\"DATA\"},{\"from\":6501738566,\"to\":6708900496,\"type\":\"DATA\"},{\"from\":6501738578,\"to\":6708923712,\"type\":\"DATA\"},{\"from\":6501738631,\"to\":6708923824,\"type\":\"DATA\"},{\"from\":6501738645,\"to\":6742217808,\"type\":\"DATA\"},{\"from\":6501738699,\"to\":6742246848,\"type\":\"DATA\"},{\"from\":6501738708,\"to\":6741126112,\"type\":\"DATA\"},{\"from\":6501738717,\"to\":6742246856,\"type\":\"DATA\"},{\"from\":6501738727,\"to\":6723759672,\"type\":\"DATA\"},{\"from\":6501738764,\"to\":6723759736,\"type\":\"DATA\"},{\"from\":6501738785,\"to\":6723759784,\"type\":\"DATA\"},{\"from\":6501738806,\"to\":6710367816,\"type\":\"DATA\"},{\"from\":6501738832,\"to\":6708900496,\"type\":\"DATA\"},{\"from\":6501738844,\"to\":6708923712,\"type\":\"DATA\"},{\"from\":6501738870,\"to\":6742246848,\"type\":\"DATA\"},{\"from\":6501738883,\"to\":6741126112,\"type\":\"DATA\"},{\"from\":6501738892,\"to\":6742246856,\"type\":\"DATA\"},{\"from\":6501738906,\"to\":6723759672,\"type\":\"DATA\"},{\"from\":6501738943,\"to\":6723759872,\"type\":\"DATA\"},{\"from\":6501738976,\"to\":6719614228,\"type\":\"DATA\"},{\"from\":6501738997,\"to\":6710367816,\"type\":\"DATA\"},{\"from\":6501739023,\"to\":6708900496,\"type\":\"DATA\"},{\"from\":6501739035,\"to\":6708923712,\"type\":\"DATA\"},{\"from\":6501739088,\"to\":6708923824,\"type\":\"DATA\"},{\"from\":6501739102,\"to\":6742217808,\"type\":\"DATA\"},{\"from\":6501739155,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6501739195,\"to\":6446192048,\"type\":\"DATA\"},{\"from\":6501739206,\"to\":6488516144,\"type\":\"DATA\"},{\"from\":6501739217,\"to\":6511490512,\"type\":\"DATA\"},{\"from\":6501739228,\"to\":6501739488,\"type\":\"DATA\"},{\"from\":6501739243,\"to\":6712266840,\"type\":\"DATA\"},{\"from\":6501739250,\"to\":6723759672,\"type\":\"DATA\"},{\"from\":6501739341,\"to\":6488537248,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6501738865,\"to\":6501738626,\"type\":\"CODE\"},{\"from\":6501739327,\"to\":6501738686,\"type\":\"CODE\"},{\"from\":6501739362,\"to\":6501739286,\"type\":\"CODE\"},{\"from\":6501739386,\"to\":6501739286,\"type\":\"CODE\"},{\"from\":6501739403,\"to\":6501739373,\"type\":\"CODE\"},{\"from\":6501739436,\"to\":6501738661,\"type\":\"CODE\"},{\"from\":6501739472,\"to\":6501739118,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":7,\"outdegree\":30,\"nlocals\":8,\"nargs\":1,\"stackvars\":[{\"name\":\"var_170h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-368}},{\"name\":\"var_160h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-352}},{\"name\":\"var_158h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-344}},{\"name\":\"var_118h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-280}},{\"name\":\"var_108h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-264}},{\"name\":\"var_f0h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-240}},{\"name\":\"var_40h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-64}},{\"name\":\"var_30h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-48}}],\"regvars\":[{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"normalized_result":{"stdout":"                   |\r\n    0x18388a750    |void fcn.18388a750(int64_t arg1)\r\n                   |{\r\n                   |    int32_t *piVar1;\r\n                   |    int32_t iVar2;\r\n                   |    int32_t *piVar3;\r\n                   |    char cVar4;\r\n                   |    int64_t iVar5;\r\n                   |    int64_t iVar6;\r\n                   |    undefined8 uVar7;\r\n                   |    undefined4 *puVar8;\r\n                   |    int64_t var_170h;\r\n                   |    undefined4 uStack_168;\r\n                   |    undefined4 uStack_164;\r\n                   |    int64_t var_160h;\r\n                   |    int64_t var_158h;\r\n                   |    int64_t iStack_150;\r\n                   |    int64_t var_118h;\r\n                   |    int64_t var_108h;\r\n                   |    int64_t var_f0h;\r\n                   |    int64_t var_40h;\r\n                   |    undefined8 uStack_38;\r\n                   |    int64_t var_30h;\r\n                   |    undefined8 uStack_28;\r\n                   |    \r\n    0x18388a769    |    if (*(int64_t *)0x191d87838 == 0) {\r\n    0x18388a8d2    |        if (1 < *(int32_t *)0x191de85c0) {\r\n    0x18388a8ca    |            return;\r\n                   |        }\r\n    0x18388a8e5    |        if ((*(int32_t *)0x191cd6be0 == 0) && (*(int64_t *)0x191de85c8 == 0)) {\r\n    0x18388a8ca    |            return;\r\n                   |        }\r\n    0x18388a8ee    |        func_0x00018030d390(&var_170h, 0x190c46e38, 0x26, 1);\r\n    0x18388a91c    |        uVar7 = func_0x000184dcd0d0(&var_160h, 0x190c46e78, 0x29);\r\n    0x18388a931    |        func_0x000184dcd0d0(uVar7, 0x190c46ea8, 0x1d);\r\n    0x18388a93d    |        var_170h = 0x18ff81648;\r\n    0x18388a8ee    |        func_0x00018030e9d0(&var_170h);\r\n    0x18388a957    |        *(undefined8 *)((int64_t)&var_160h + (int64_t)*(int32_t *)(CONCAT44(var_160h._4_4_, (undefined4)var_160h) + 4))\r\n    0x18388a957    |             = 0x18fe1b290;\r\n                   |    } else {\r\n    0x18388a776    |        iVar5 = (*(code *)0x185f59da0)();\r\n    0x18388a77f    |        if (iVar5 != 0) {\r\n    0x18388a793    |            var_30h = 0x190c466d0;\r\n    0x18388a796    |            uStack_28 = 0x2c;\r\n    0x18388a7a1    |            iVar6 = func_0x000185603c00(iVar5);\r\n    0x18388a7a9    |            if (iVar6 != 0) {\r\n    0x18388a7b3    |                var_40h = 0x190c466d0;\r\n    0x18388a7b6    |                uStack_38 = 0x2c;\r\n    0x18388a7c1    |                cVar4 = func_0x000184dc6ec0(iVar5);\r\n    0x18388a7c8    |                if (cVar4 != '\\0') {\r\n    0x18388a994    |                    if ((*(int32_t *)0x191de85c0 < 2) &&\r\n    0x18388a983    |                       ((*(int32_t *)0x191cd6be0 != 0 || (*(int64_t *)0x191de85c8 != 0)))) {\r\n    0x18388a9a1    |                        func_0x00018030d390(&var_170h, 0x190c46e38, 0x34, 1);\r\n    0x18388a9cf    |                        uVar7 = func_0x000184dcd0d0(&var_160h, 0x190c46f00, 0x33);\r\n    0x18388a9db    |                        uVar7 = func_0x000184dd1300(uVar7, *(undefined8 *)(arg1 + 0x68));\r\n    0x18388a9f0    |                        func_0x000184dcd0d0(uVar7, 0x190852d14, 2);\r\n    0x18388a9fc    |                        var_170h = 0x18ff81648;\r\n    0x18388a9a1    |                        func_0x00018030e9d0(&var_170h);\r\n    0x18388aa16    |                        *(undefined8 *)\r\n    0x18388aa16    |                         ((int64_t)&var_160h + (int64_t)*(int32_t *)(CONCAT44(var_160h._4_4_, (undefined4)var_160h) + 4)\r\n    0x18388aa16    |                         ) = 0x18fe1b290;\r\n    0x18388aa22    |                        var_158h = 0x18fe20d40;\r\n    0x18388aa2a    |                        if (var_108h._7_1_ < '\\0') {\r\n    0x18388aa46    |                            func_0x0001841dcbe0(var_118h, \r\n    0x18388aa36    |                                                CONCAT17(var_108h._7_1_, (unkbyte7)var_108h) & 0x7fffffffffffffff);\r\n                   |                        }\r\n    0x18388aa57    |                        var_158h = 0x18fe20db0;\r\n    0x18388aa68    |                        if (iStack_150 != 0x191de1450) {\r\n    0x18388abb6    |                            LOCK();\r\n    0x18388abb6    |                            piVar1 = (int32_t *)(iStack_150 + 8);\r\n    0x18388abb6    |                            iVar2 = *piVar1;\r\n    0x18388abb6    |                            *piVar1 = *piVar1 + -1;\r\n    0x18388abb6    |                            UNLOCK();\r\n    0x18388abbd    |                            if (iVar2 == 0) {\r\n    0x18388abca    |                                (*(code *)0x185f59da0)();\r\n                   |                            }\r\n                   |                        }\r\n    0x18388aa4b    |                        func_0x00018424db70(&var_158h);\r\n    0x18388aa6e    |                        func_0x0001848f8b80(&var_f0h);\r\n                   |                    }\r\n    0x18388aa9a    |                    if ((arg1 & 0xfffffffc00000000U) == *(uint64_t *)0x191cd6d08) {\r\n    0x18388aa9f    |                        func_0x0001841c7180(arg1);\r\n                   |                    }\r\n    0x18388aaad    |                    puVar8 = (undefined4 *)func_0x000185f006b8(0x30);\r\n    0x18388aab5    |                    *puVar8 = 1;\r\n    0x18388aac2    |                    *(undefined8 *)(puVar8 + 2) = 0x1803915b0;\r\n    0x18388aacd    |                    *(undefined8 *)(puVar8 + 4) = 0x182bee630;\r\n    0x18388aad8    |                    *(undefined8 *)(puVar8 + 6) = 0x1841d75d0;\r\n    0x18388aae3    |                    *(undefined8 *)(puVar8 + 8) = 0x18388abe0;\r\n    0x18388aae7    |                    *(int64_t *)(puVar8 + 10) = arg1;\r\n    0x18388aaf9    |                    func_0x000184339cd0(&var_170h, 0x190151058, 0x190c46e38, 0x37);\r\n    0x18388ab09    |                    piVar1 = *(int32_t **)(arg1 + 0x60);\r\n    0x18388ab0d    |                    *(undefined4 **)(arg1 + 0x60) = puVar8;\r\n    0x18388ab14    |                    if (piVar1 != (int32_t *)0x0) {\r\n    0x18388ab44    |                        LOCK();\r\n    0x18388ab44    |                        *piVar1 = *piVar1 + -1;\r\n    0x18388ab44    |                        UNLOCK();\r\n    0x18388ab47    |                        if (*piVar1 == 0) {\r\n    0x18388ab57    |                            if (*(int64_t *)(piVar1 + 4) == 0x182bf38a0) {\r\n    0x18388ab64    |                                piVar3 = *(int32_t **)(piVar1 + 0xc);\r\n    0x18388ab6b    |                                if (piVar3 != (int32_t *)0x0) {\r\n    0x18388ab7c    |                                    LOCK();\r\n    0x18388ab7c    |                                    *piVar3 = *piVar3 + -1;\r\n    0x18388ab7c    |                                    UNLOCK();\r\n    0x18388ab7f    |                                    if (*piVar3 == 0) {\r\n    0x18388ab86    |                                        func_0x0001841dcbe0(piVar3, 8);\r\n                   |                                    }\r\n                   |                                }\r\n    0x18388ab75    |                                func_0x0001841dcbe0(piVar1, 0x48);\r\n                   |                            } else {\r\n    0x18388ab5c    |                                (*(code *)0x185f59da0)(piVar1);\r\n                   |                            }\r\n                   |                        }\r\n                   |                    }\r\n    0x18388ab1a    |                    *(undefined4 *)(arg1 + 0x28) = (undefined4)var_160h;\r\n    0x18388ab22    |                    *(undefined4 *)(arg1 + 0x18) = (undefined4)var_170h;\r\n    0x18388ab22    |                    *(undefined4 *)(arg1 + 0x1c) = var_170h._4_4_;\r\n    0x18388ab22    |                    *(undefined4 *)(arg1 + 0x20) = uStack_168;\r\n    0x18388ab22    |                    *(undefined4 *)(arg1 + 0x24) = uStack_164;\r\n    0x18388ab2b    |                    *(int64_t *)(arg1 + 0x30) = var_158h;\r\n    0x18388ab2f    |                    *(undefined8 *)(arg1 + 0x48) = 60000000;\r\n    0x18388aaa4    |                    func_0x00018477a0a0(arg1 + 8);\r\n    0x18388a8ca    |                    return;\r\n                   |                }\r\n                   |            }\r\n                   |        }\r\n    0x18388a7d5    |        if (1 < *(int32_t *)0x191de85c0) {\r\n    0x18388a8ca    |            return;\r\n                   |        }\r\n    0x18388a7ec    |        if ((*(int32_t *)0x191cd6be0 == 0) && (*(int64_t *)0x191de85c8 == 0)) {\r\n    0x18388a8ca    |            return;\r\n                   |        }\r\n    0x18388a7f9    |        func_0x00018030d390(&var_170h, 0x190c46e38, 0x30, 1);\r\n    0x18388a812    |        func_0x000184dcd0d0(&var_160h, 0x190c46ec8, 0x33);\r\n    0x18388a833    |        var_170h = 0x18ff81648;\r\n    0x18388a7f9    |        func_0x00018030e9d0(&var_170h);\r\n    0x18388a84d    |        *(undefined8 *)((int64_t)&var_160h + (int64_t)*(int32_t *)(CONCAT44(var_160h._4_4_, (undefined4)var_160h) + 4))\r\n    0x18388a84d    |             = 0x18fe1b290;\r\n                   |    }\r\n    0x18388a96b    |    if (var_108h._7_1_ < '\\0') {\r\n    0x18388a863    |        var_158h = 0x18fe20d40;\r\n    0x18388a87d    |        func_0x0001841dcbe0(var_118h, CONCAT17(var_108h._7_1_, (unkbyte7)var_108h) & 0x7fffffffffffffff);\r\n                   |    }\r\n    0x18388a88e    |    var_158h = 0x18fe20db0;\r\n    0x18388a89f    |    if (iStack_150 != 0x191de1450) {\r\n    0x18388ab92    |        LOCK();\r\n    0x18388ab92    |        piVar1 = (int32_t *)(iStack_150 + 8);\r\n    0x18388ab92    |        iVar2 = *piVar1;\r\n    0x18388ab92    |        *piVar1 = *piVar1 + -1;\r\n    0x18388ab92    |        UNLOCK();\r\n    0x18388ab99    |        if (iVar2 == 0) {\r\n    0x18388aba6    |            (*(code *)0x185f59da0)();\r\n                   |        }\r\n                   |    }\r\n    0x18388a882    |    func_0x00018424db70(&var_158h);\r\n    0x18388a8a5    |    func_0x0001848f8b80(&var_f0h);\r\n    0x18388a8ca    |    return;\r\n                   |}\r\n[{\"offset\":6501738320,\"name\":\"fcn.18388a750\",\"size\":1157,\"is-pure\":false,\"realsz\":1157,\"noreturn\":false,\"stackframe\":408,\"calltype\":\"ms\",\"cost\":343,\"cc\":27,\"loops\":14,\"bits\":64,\"type\":\"fcn\",\"nbbs\":39,\"edges\":64,\"ebbs\":1,\"signature\":\"fcn.18388a750(int64_t arg1);\",\"minbound\":6501738320,\"maxbound\":6501739477,\"callrefs\":[{\"from\":6501738358,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6501738401,\"to\":6532643840,\"type\":\"CALL\"},{\"from\":6501738433,\"to\":6524006080,\"type\":\"CALL\"},{\"from\":6501738509,\"to\":6445650832,\"type\":\"CALL\"},{\"from\":6501738535,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6501738554,\"to\":6445656528,\"type\":\"CALL\"},{\"from\":6501738621,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6501738672,\"to\":6511975280,\"type\":\"CALL\"},{\"from\":6501738680,\"to\":6518967168,\"type\":\"CALL\"},{\"from\":6501738754,\"to\":6445650832,\"type\":\"CALL\"},{\"from\":6501738780,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6501738801,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6501738820,\"to\":6445656528,\"type\":\"CALL\"},{\"from\":6501738865,\"to\":6501738626,\"type\":\"CODE\"},{\"from\":6501738933,\"to\":6445650832,\"type\":\"CALL\"},{\"from\":6501738959,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6501738971,\"to\":6524048128,\"type\":\"CALL\"},{\"from\":6501738992,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6501739011,\"to\":6445656528,\"type\":\"CALL\"},{\"from\":6501739078,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6501739129,\"to\":6511975280,\"type\":\"CALL\"},{\"from\":6501739137,\"to\":6518967168,\"type\":\"CALL\"},{\"from\":6501739167,\"to\":6511423872,\"type\":\"CALL\"},{\"from\":6501739181,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6501739268,\"to\":6512942288,\"type\":\"CALL\"},{\"from\":6501739322,\"to\":6517399712,\"type\":\"CALL\"},{\"from\":6501739327,\"to\":6501738686,\"type\":\"CODE\"},{\"from\":6501739356,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6501739362,\"to\":6501739286,\"type\":\"CODE\"},{\"from\":6501739381,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6501739386,\"to\":6501739286,\"type\":\"CODE\"},{\"from\":6501739398,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6501739403,\"to\":6501739373,\"type\":\"CODE\"},{\"from\":6501739430,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6501739436,\"to\":6501738661,\"type\":\"CODE\"},{\"from\":6501739466,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6501739472,\"to\":6501739118,\"type\":\"CODE\"}],\"datarefs\":[{\"from\":6501738335,\"to\":6741850168,\"type\":\"DATA\"},{\"from\":6501738372,\"to\":6723757776,\"type\":\"DATA\"},{\"from\":6501738446,\"to\":6742246848,\"type\":\"DATA\"},{\"from\":6501738459,\"to\":6741126112,\"type\":\"DATA\"},{\"from\":6501738468,\"to\":6742246856,\"type\":\"DATA\"},{\"from\":6501738482,\"to\":6723759672,\"type\":\"DATA\"},{\"from\":6501738519,\"to\":6723759816,\"type\":\"DATA\"},{\"from\":6501738540,\"to\":6710367816,\"type\":\"DATA\"},{\"from\":6501738566,\"to\":6708900496,\"type\":\"DATA\"},{\"from\":6501738578,\"to\":6708923712,\"type\":\"DATA\"},{\"from\":6501738631,\"to\":6708923824,\"type\":\"DATA\"},{\"from\":6501738645,\"to\":6742217808,\"type\":\"DATA\"},{\"from\":6501738699,\"to\":6742246848,\"type\":\"DATA\"},{\"from\":6501738708,\"to\":6741126112,\"type\":\"DATA\"},{\"from\":6501738717,\"to\":6742246856,\"type\":\"DATA\"},{\"from\":6501738727,\"to\":6723759672,\"type\":\"DATA\"},{\"from\":6501738764,\"to\":6723759736,\"type\":\"DATA\"},{\"from\":6501738785,\"to\":6723759784,\"type\":\"DATA\"},{\"from\":6501738806,\"to\":6710367816,\"type\":\"DATA\"},{\"from\":6501738832,\"to\":6708900496,\"type\":\"DATA\"},{\"from\":6501738844,\"to\":6708923712,\"type\":\"DATA\"},{\"from\":6501738870,\"to\":6742246848,\"type\":\"DATA\"},{\"from\":6501738883,\"to\":6741126112,\"type\":\"DATA\"},{\"from\":6501738892,\"to\":6742246856,\"type\":\"DATA\"},{\"from\":6501738906,\"to\":6723759672,\"type\":\"DATA\"},{\"from\":6501738943,\"to\":6723759872,\"type\":\"DATA\"},{\"from\":6501738976,\"to\":6719614228,\"type\":\"DATA\"},{\"from\":6501738997,\"to\":6710367816,\"type\":\"DATA\"},{\"from\":6501739023,\"to\":6708900496,\"type\":\"DATA\"},{\"from\":6501739035,\"to\":6708923712,\"type\":\"DATA\"},{\"from\":6501739088,\"to\":6708923824,\"type\":\"DATA\"},{\"from\":6501739102,\"to\":6742217808,\"type\":\"DATA\"},{\"from\":6501739155,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6501739195,\"to\":6446192048,\"type\":\"DATA\"},{\"from\":6501739206,\"to\":6488516144,\"type\":\"DATA\"},{\"from\":6501739217,\"to\":6511490512,\"type\":\"DATA\"},{\"from\":6501739228,\"to\":6501739488,\"type\":\"DATA\"},{\"from\":6501739243,\"to\":6712266840,\"type\":\"DATA\"},{\"from\":6501739250,\"to\":6723759672,\"type\":\"DATA\"},{\"from\":6501739341,\"to\":6488537248,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6501738865,\"to\":6501738626,\"type\":\"CODE\"},{\"from\":6501739327,\"to\":6501738686,\"type\":\"CODE\"},{\"from\":6501739362,\"to\":6501739286,\"type\":\"CODE\"},{\"from\":6501739386,\"to\":6501739286,\"type\":\"CODE\"},{\"from\":6501739403,\"to\":6501739373,\"type\":\"CODE\"},{\"from\":6501739436,\"to\":6501738661,\"type\":\"CODE\"},{\"from\":6501739472,\"to\":6501739118,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":7,\"outdegree\":30,\"nlocals\":8,\"nargs\":1,\"stackvars\":[{\"name\":\"var_170h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-368}},{\"name\":\"var_160h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-352}},{\"name\":\"var_158h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-344}},{\"name\":\"var_118h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-280}},{\"name\":\"var_108h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-264}},{\"name\":\"var_f0h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-240}},{\"name\":\"var_40h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-64}},{\"name\":\"var_30h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-48}}],\"regvars\":[{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"confidence":"observed","authority":"shipped-artifact","environment":null,"limitations":["The executable version and supported formats are reported as unknown because no reliable version probe was performed.","A non-zero process exit is preserved as an observed command result.","Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.","When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call."],"relationship_coverage":null,"locations":[{"kind":"artifact-path","path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"}],"evidence_links":[]},"meta":{"command":"execute-rizin-command","duration":"5069ms"}}