{"ok":true,"data":{"evidence_id":"ev_53906d383d86011b8b42cb5831b4760ad4d9a89c4a22fca4092cea78cd74866e","subject":{"name":"Tabbit.dll","digest":{"sha256":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c"},"local_path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","format":"unknown","architecture":null},"provider":{"id":"rizin","name":"Rizin","version":null},"analysis_profile":null,"predicate_type":"rea.reverse-engineering.command-observation","operation":"execute_rizin_command","parameters":{"path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","command":"e scr.color=0;af @ 0x183887d90;pdgo @ 0x183887d90;afij @ 0x183887d90","provider_executable":"C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe","command_arguments":["-N","-q","-c","e scr.color=0;af @ 0x183887d90;pdgo @ 0x183887d90;afij @ 0x183887d90","C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"]},"raw_result":{"stdout":"                   |\r\n    0x183887d90    |void fcn.183887d90(int64_t arg1)\r\n                   |{\r\n                   |    int32_t *piVar1;\r\n                   |    uint64_t uVar2;\r\n                   |    int64_t iVar3;\r\n                   |    int32_t iVar4;\r\n                   |    int64_t iVar5;\r\n                   |    undefined8 uVar6;\r\n                   |    int64_t var_178h;\r\n                   |    int64_t var_168h;\r\n                   |    int64_t var_158h;\r\n                   |    int64_t var_148h;\r\n                   |    int64_t var_140h;\r\n                   |    int64_t iStack_138;\r\n                   |    int64_t var_100h;\r\n                   |    int64_t var_f0h;\r\n                   |    int64_t var_d8h;\r\n                   |    \r\n    0x183887da5    |    if (*(char *)(arg1 + 200) == '\\0') {\r\n    0x183887dae    |        *(undefined *)(arg1 + 200) = 1;\r\n    0x183887dd3    |        if ((*(int32_t *)0x191de85c0 < 2) && ((*(int32_t *)0x191cd6be0 != 0 || (*(int64_t *)0x191de85c8 != 0)))) {\r\n    0x183887de0    |            func_0x00018030d390(&var_158h, 0x190c46778, 0x8d, 1);\r\n    0x183887df9    |            func_0x000184dcd0d0(&var_148h, 0x190c467b8, 0x1c);\r\n    0x183887e1a    |            var_158h = 0x18ff81648;\r\n    0x183887de0    |            func_0x00018030e9d0(&var_158h);\r\n    0x183887e34    |            *(undefined8 *)((int64_t)&var_148h + (int64_t)*(int32_t *)(var_148h + 4)) = 0x18fe1b290;\r\n    0x183887e40    |            var_140h = 0x18fe20d40;\r\n    0x183887e48    |            if (var_f0h._7_1_ < '\\0') {\r\n    0x183887e64    |                func_0x0001841dcbe0(var_100h, CONCAT17(var_f0h._7_1_, (unkbyte7)var_f0h) & 0x7fffffffffffffff);\r\n                   |            }\r\n    0x183887e75    |            var_140h = 0x18fe20db0;\r\n    0x183887e86    |            if (iStack_138 != 0x191de1450) {\r\n    0x18388804c    |                LOCK();\r\n    0x18388804c    |                piVar1 = (int32_t *)(iStack_138 + 8);\r\n    0x18388804c    |                iVar4 = *piVar1;\r\n    0x18388804c    |                *piVar1 = *piVar1 + -1;\r\n    0x18388804c    |                UNLOCK();\r\n    0x183888053    |                if (iVar4 == 0) {\r\n    0x183888060    |                    (*(code *)0x185f59da0)();\r\n                   |                }\r\n                   |            }\r\n    0x183887e69    |            func_0x00018424db70(&var_140h);\r\n    0x183887e8c    |            func_0x0001848f8b80(&var_d8h);\r\n                   |        }\r\n    0x183887ea4    |        func_0x00018387e610(*(undefined8 *)(arg1 + 0x70));\r\n    0x183887ead    |        iVar3 = *(int64_t *)(arg1 + 0x70);\r\n    0x183887ece    |        iVar4 = func_0x000185603510(*(undefined8 *)(iVar3 + 8));\r\n    0x183887ede    |        var_158h = CONCAT44(var_158h._4_4_, iVar4 + 1);\r\n    0x183887ee1    |        var_140h = CONCAT71(var_140h._1_7_, 2);\r\n    0x183887ed3    |        func_0x000180542f00(*(undefined8 *)(iVar3 + 8));\r\n    0x183887efc    |        func_0x000183888070(arg1, 0);\r\n    0x183887f08    |        if (*(char *)(arg1 + 0xca) == '\\0') {\r\n    0x183887f0e    |            func_0x000183885600(*(undefined8 *)(arg1 + 0x78));\r\n    0x183887f17    |            iVar3 = *(int64_t *)(arg1 + 0x88);\r\n    0x183887f2f    |            iVar5 = (*(code *)0x185f59da0)();\r\n    0x183887f38    |            uVar2 = iVar5 + 0xa8;\r\n    0x183887f56    |            if ((uVar2 & 0xfffffffc00000000) == *(uint64_t *)0x191cd6d08) {\r\n    0x183887f5b    |                func_0x0001841c7180(uVar2);\r\n                   |            }\r\n    0x183887f6e    |            if ((*(uint64_t *)(iVar3 + 8) & 0xfffffffc00000000) == *(uint64_t *)0x191cd6d08) {\r\n    0x183887f70    |                func_0x00018005f390();\r\n                   |            }\r\n    0x183887f75    |            *(uint64_t *)(iVar3 + 8) = uVar2;\r\n    0x183887f7c    |            if (uVar2 != 0) {\r\n    0x183887f7e    |                func_0x000180e25690(iVar5 + 0x180, iVar3);\r\n                   |            }\r\n    0x183887f90    |            func_0x00018388a750(*(undefined8 *)(arg1 + 0x90));\r\n    0x183887f9c    |            func_0x00018387e2f0(*(undefined8 *)(arg1 + 0x98));\r\n    0x183887fa8    |            iVar3 = *(int64_t *)(arg1 + 0xb0);\r\n    0x183887fb4    |            if (*(int64_t *)(iVar3 + 0x20) == 0) {\r\n    0x183887fbb    |                uVar6 = func_0x000185f006b8(0x20);\r\n    0x183887fd1    |                func_0x000180377930(uVar6, 0xc9, iVar3, 0);\r\n    0x183887fd6    |                iVar5 = *(int64_t *)(iVar3 + 0x20);\r\n    0x183887fda    |                *(undefined8 *)(iVar3 + 0x20) = uVar6;\r\n    0x183887fe1    |                if (iVar5 != 0) {\r\n    0x183887fe6    |                    func_0x00018171b3f0(iVar5);\r\n    0x183887ff3    |                    func_0x0001841dcbe0(iVar5, 0x20);\r\n                   |                }\r\n    0x183887ffb    |                *(undefined4 *)(iVar3 + 0x28) = *(undefined4 *)(iVar3 + 0x18);\r\n                   |            }\r\n    0x18388803a    |            if ((*(int64_t *)(*(int64_t *)(arg1 + 0xb8) + 0x18) == 0) && (*(int64_t *)0x191e06f48 != 0)) {\r\n    0x183887ffe    |                func_0x000183884ce0(*(int64_t *)(arg1 + 0xb8), *(int64_t *)0x191e06f48 + 8);\r\n                   |            }\r\n    0x18388800c    |            func_0x00018387f7b0(*(undefined8 *)(arg1 + 0xc0));\r\n                   |        }\r\n    0x18388801b    |        func_0x000183888370(arg1);\r\n                   |    }\r\n    0x18388802f    |    return;\r\n                   |}\r\n[{\"offset\":6501727632,\"name\":\"fcn.183887d90\",\"size\":731,\"is-pure\":false,\"realsz\":731,\"noreturn\":false,\"stackframe\":408,\"calltype\":\"ms\",\"cost\":233,\"cc\":16,\"loops\":4,\"bits\":64,\"type\":\"fcn\",\"nbbs\":27,\"edges\":41,\"ebbs\":1,\"signature\":\"fcn.183887d90(int64_t arg1);\",\"minbound\":6501727632,\"maxbound\":6501728363,\"callrefs\":[{\"from\":6501727732,\"to\":6445650832,\"type\":\"CALL\"},{\"from\":6501727758,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6501727777,\"to\":6445656528,\"type\":\"CALL\"},{\"from\":6501727844,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6501727895,\"to\":6511975280,\"type\":\"CALL\"},{\"from\":6501727903,\"to\":6518967168,\"type\":\"CALL\"},{\"from\":6501727912,\"to\":6501688848,\"type\":\"CALL\"},{\"from\":6501727950,\"to\":6532642064,\"type\":\"CALL\"},{\"from\":6501727986,\"to\":6447968000,\"type\":\"CALL\"},{\"from\":6501727996,\"to\":6501728368,\"type\":\"CALL\"},{\"from\":6501728018,\"to\":6501717504,\"type\":\"CALL\"},{\"from\":6501728047,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6501728091,\"to\":6511423872,\"type\":\"CALL\"},{\"from\":6501728112,\"to\":6442840976,\"type\":\"CALL\"},{\"from\":6501728139,\"to\":6457284240,\"type\":\"CALL\"},{\"from\":6501728151,\"to\":6501738320,\"type\":\"CALL\"},{\"from\":6501728163,\"to\":6501688048,\"type\":\"CALL\"},{\"from\":6501728187,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6501728209,\"to\":6446086448,\"type\":\"CALL\"},{\"from\":6501728230,\"to\":6466679792,\"type\":\"CALL\"},{\"from\":6501728243,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6501728275,\"to\":6501693360,\"type\":\"CALL\"},{\"from\":6501728283,\"to\":6501729136,\"type\":\"CALL\"},{\"from\":6501728320,\"to\":6501715168,\"type\":\"CALL\"},{\"from\":6501728325,\"to\":6501728268,\"type\":\"CODE\"},{\"from\":6501728352,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6501728358,\"to\":6501727884,\"type\":\"CODE\"}],\"datarefs\":[{\"from\":6501727669,\"to\":6742246848,\"type\":\"DATA\"},{\"from\":6501727682,\"to\":6741126112,\"type\":\"DATA\"},{\"from\":6501727691,\"to\":6742246856,\"type\":\"DATA\"},{\"from\":6501727705,\"to\":6723757944,\"type\":\"DATA\"},{\"from\":6501727742,\"to\":6723758008,\"type\":\"DATA\"},{\"from\":6501727763,\"to\":6710367816,\"type\":\"DATA\"},{\"from\":6501727789,\"to\":6708900496,\"type\":\"DATA\"},{\"from\":6501727801,\"to\":6708923712,\"type\":\"DATA\"},{\"from\":6501727854,\"to\":6708923824,\"type\":\"DATA\"},{\"from\":6501727868,\"to\":6742217808,\"type\":\"DATA\"},{\"from\":6501727925,\"to\":6723756320,\"type\":\"DATA\"},{\"from\":6501728030,\"to\":6741850168,\"type\":\"DATA\"},{\"from\":6501728079,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6501728103,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6501728304,\"to\":6742372168,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6501728325,\"to\":6501728268,\"type\":\"CODE\"},{\"from\":6501728358,\"to\":6501727884,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":2,\"outdegree\":25,\"nlocals\":8,\"nargs\":1,\"stackvars\":[{\"name\":\"var_178h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-376}},{\"name\":\"var_168h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-360}},{\"name\":\"var_158h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-344}},{\"name\":\"var_148h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-328}},{\"name\":\"var_140h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-320}},{\"name\":\"var_100h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-256}},{\"name\":\"var_f0h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-240}},{\"name\":\"var_d8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-216}}],\"regvars\":[{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"normalized_result":{"stdout":"                   |\r\n    0x183887d90    |void fcn.183887d90(int64_t arg1)\r\n                   |{\r\n                   |    int32_t *piVar1;\r\n                   |    uint64_t uVar2;\r\n                   |    int64_t iVar3;\r\n                   |    int32_t iVar4;\r\n                   |    int64_t iVar5;\r\n                   |    undefined8 uVar6;\r\n                   |    int64_t var_178h;\r\n                   |    int64_t var_168h;\r\n                   |    int64_t var_158h;\r\n                   |    int64_t var_148h;\r\n                   |    int64_t var_140h;\r\n                   |    int64_t iStack_138;\r\n                   |    int64_t var_100h;\r\n                   |    int64_t var_f0h;\r\n                   |    int64_t var_d8h;\r\n                   |    \r\n    0x183887da5    |    if (*(char *)(arg1 + 200) == '\\0') {\r\n    0x183887dae    |        *(undefined *)(arg1 + 200) = 1;\r\n    0x183887dd3    |        if ((*(int32_t *)0x191de85c0 < 2) && ((*(int32_t *)0x191cd6be0 != 0 || (*(int64_t *)0x191de85c8 != 0)))) {\r\n    0x183887de0    |            func_0x00018030d390(&var_158h, 0x190c46778, 0x8d, 1);\r\n    0x183887df9    |            func_0x000184dcd0d0(&var_148h, 0x190c467b8, 0x1c);\r\n    0x183887e1a    |            var_158h = 0x18ff81648;\r\n    0x183887de0    |            func_0x00018030e9d0(&var_158h);\r\n    0x183887e34    |            *(undefined8 *)((int64_t)&var_148h + (int64_t)*(int32_t *)(var_148h + 4)) = 0x18fe1b290;\r\n    0x183887e40    |            var_140h = 0x18fe20d40;\r\n    0x183887e48    |            if (var_f0h._7_1_ < '\\0') {\r\n    0x183887e64    |                func_0x0001841dcbe0(var_100h, CONCAT17(var_f0h._7_1_, (unkbyte7)var_f0h) & 0x7fffffffffffffff);\r\n                   |            }\r\n    0x183887e75    |            var_140h = 0x18fe20db0;\r\n    0x183887e86    |            if (iStack_138 != 0x191de1450) {\r\n    0x18388804c    |                LOCK();\r\n    0x18388804c    |                piVar1 = (int32_t *)(iStack_138 + 8);\r\n    0x18388804c    |                iVar4 = *piVar1;\r\n    0x18388804c    |                *piVar1 = *piVar1 + -1;\r\n    0x18388804c    |                UNLOCK();\r\n    0x183888053    |                if (iVar4 == 0) {\r\n    0x183888060    |                    (*(code *)0x185f59da0)();\r\n                   |                }\r\n                   |            }\r\n    0x183887e69    |            func_0x00018424db70(&var_140h);\r\n    0x183887e8c    |            func_0x0001848f8b80(&var_d8h);\r\n                   |        }\r\n    0x183887ea4    |        func_0x00018387e610(*(undefined8 *)(arg1 + 0x70));\r\n    0x183887ead    |        iVar3 = *(int64_t *)(arg1 + 0x70);\r\n    0x183887ece    |        iVar4 = func_0x000185603510(*(undefined8 *)(iVar3 + 8));\r\n    0x183887ede    |        var_158h = CONCAT44(var_158h._4_4_, iVar4 + 1);\r\n    0x183887ee1    |        var_140h = CONCAT71(var_140h._1_7_, 2);\r\n    0x183887ed3    |        func_0x000180542f00(*(undefined8 *)(iVar3 + 8));\r\n    0x183887efc    |        func_0x000183888070(arg1, 0);\r\n    0x183887f08    |        if (*(char *)(arg1 + 0xca) == '\\0') {\r\n    0x183887f0e    |            func_0x000183885600(*(undefined8 *)(arg1 + 0x78));\r\n    0x183887f17    |            iVar3 = *(int64_t *)(arg1 + 0x88);\r\n    0x183887f2f    |            iVar5 = (*(code *)0x185f59da0)();\r\n    0x183887f38    |            uVar2 = iVar5 + 0xa8;\r\n    0x183887f56    |            if ((uVar2 & 0xfffffffc00000000) == *(uint64_t *)0x191cd6d08) {\r\n    0x183887f5b    |                func_0x0001841c7180(uVar2);\r\n                   |            }\r\n    0x183887f6e    |            if ((*(uint64_t *)(iVar3 + 8) & 0xfffffffc00000000) == *(uint64_t *)0x191cd6d08) {\r\n    0x183887f70    |                func_0x00018005f390();\r\n                   |            }\r\n    0x183887f75    |            *(uint64_t *)(iVar3 + 8) = uVar2;\r\n    0x183887f7c    |            if (uVar2 != 0) {\r\n    0x183887f7e    |                func_0x000180e25690(iVar5 + 0x180, iVar3);\r\n                   |            }\r\n    0x183887f90    |            func_0x00018388a750(*(undefined8 *)(arg1 + 0x90));\r\n    0x183887f9c    |            func_0x00018387e2f0(*(undefined8 *)(arg1 + 0x98));\r\n    0x183887fa8    |            iVar3 = *(int64_t *)(arg1 + 0xb0);\r\n    0x183887fb4    |            if (*(int64_t *)(iVar3 + 0x20) == 0) {\r\n    0x183887fbb    |                uVar6 = func_0x000185f006b8(0x20);\r\n    0x183887fd1    |                func_0x000180377930(uVar6, 0xc9, iVar3, 0);\r\n    0x183887fd6    |                iVar5 = *(int64_t *)(iVar3 + 0x20);\r\n    0x183887fda    |                *(undefined8 *)(iVar3 + 0x20) = uVar6;\r\n    0x183887fe1    |                if (iVar5 != 0) {\r\n    0x183887fe6    |                    func_0x00018171b3f0(iVar5);\r\n    0x183887ff3    |                    func_0x0001841dcbe0(iVar5, 0x20);\r\n                   |                }\r\n    0x183887ffb    |                *(undefined4 *)(iVar3 + 0x28) = *(undefined4 *)(iVar3 + 0x18);\r\n                   |            }\r\n    0x18388803a    |            if ((*(int64_t *)(*(int64_t *)(arg1 + 0xb8) + 0x18) == 0) && (*(int64_t *)0x191e06f48 != 0)) {\r\n    0x183887ffe    |                func_0x000183884ce0(*(int64_t *)(arg1 + 0xb8), *(int64_t *)0x191e06f48 + 8);\r\n                   |            }\r\n    0x18388800c    |            func_0x00018387f7b0(*(undefined8 *)(arg1 + 0xc0));\r\n                   |        }\r\n    0x18388801b    |        func_0x000183888370(arg1);\r\n                   |    }\r\n    0x18388802f    |    return;\r\n                   |}\r\n[{\"offset\":6501727632,\"name\":\"fcn.183887d90\",\"size\":731,\"is-pure\":false,\"realsz\":731,\"noreturn\":false,\"stackframe\":408,\"calltype\":\"ms\",\"cost\":233,\"cc\":16,\"loops\":4,\"bits\":64,\"type\":\"fcn\",\"nbbs\":27,\"edges\":41,\"ebbs\":1,\"signature\":\"fcn.183887d90(int64_t arg1);\",\"minbound\":6501727632,\"maxbound\":6501728363,\"callrefs\":[{\"from\":6501727732,\"to\":6445650832,\"type\":\"CALL\"},{\"from\":6501727758,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6501727777,\"to\":6445656528,\"type\":\"CALL\"},{\"from\":6501727844,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6501727895,\"to\":6511975280,\"type\":\"CALL\"},{\"from\":6501727903,\"to\":6518967168,\"type\":\"CALL\"},{\"from\":6501727912,\"to\":6501688848,\"type\":\"CALL\"},{\"from\":6501727950,\"to\":6532642064,\"type\":\"CALL\"},{\"from\":6501727986,\"to\":6447968000,\"type\":\"CALL\"},{\"from\":6501727996,\"to\":6501728368,\"type\":\"CALL\"},{\"from\":6501728018,\"to\":6501717504,\"type\":\"CALL\"},{\"from\":6501728047,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6501728091,\"to\":6511423872,\"type\":\"CALL\"},{\"from\":6501728112,\"to\":6442840976,\"type\":\"CALL\"},{\"from\":6501728139,\"to\":6457284240,\"type\":\"CALL\"},{\"from\":6501728151,\"to\":6501738320,\"type\":\"CALL\"},{\"from\":6501728163,\"to\":6501688048,\"type\":\"CALL\"},{\"from\":6501728187,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6501728209,\"to\":6446086448,\"type\":\"CALL\"},{\"from\":6501728230,\"to\":6466679792,\"type\":\"CALL\"},{\"from\":6501728243,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6501728275,\"to\":6501693360,\"type\":\"CALL\"},{\"from\":6501728283,\"to\":6501729136,\"type\":\"CALL\"},{\"from\":6501728320,\"to\":6501715168,\"type\":\"CALL\"},{\"from\":6501728325,\"to\":6501728268,\"type\":\"CODE\"},{\"from\":6501728352,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6501728358,\"to\":6501727884,\"type\":\"CODE\"}],\"datarefs\":[{\"from\":6501727669,\"to\":6742246848,\"type\":\"DATA\"},{\"from\":6501727682,\"to\":6741126112,\"type\":\"DATA\"},{\"from\":6501727691,\"to\":6742246856,\"type\":\"DATA\"},{\"from\":6501727705,\"to\":6723757944,\"type\":\"DATA\"},{\"from\":6501727742,\"to\":6723758008,\"type\":\"DATA\"},{\"from\":6501727763,\"to\":6710367816,\"type\":\"DATA\"},{\"from\":6501727789,\"to\":6708900496,\"type\":\"DATA\"},{\"from\":6501727801,\"to\":6708923712,\"type\":\"DATA\"},{\"from\":6501727854,\"to\":6708923824,\"type\":\"DATA\"},{\"from\":6501727868,\"to\":6742217808,\"type\":\"DATA\"},{\"from\":6501727925,\"to\":6723756320,\"type\":\"DATA\"},{\"from\":6501728030,\"to\":6741850168,\"type\":\"DATA\"},{\"from\":6501728079,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6501728103,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6501728304,\"to\":6742372168,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6501728325,\"to\":6501728268,\"type\":\"CODE\"},{\"from\":6501728358,\"to\":6501727884,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":2,\"outdegree\":25,\"nlocals\":8,\"nargs\":1,\"stackvars\":[{\"name\":\"var_178h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-376}},{\"name\":\"var_168h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-360}},{\"name\":\"var_158h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-344}},{\"name\":\"var_148h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-328}},{\"name\":\"var_140h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-320}},{\"name\":\"var_100h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-256}},{\"name\":\"var_f0h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-240}},{\"name\":\"var_d8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-216}}],\"regvars\":[{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"confidence":"observed","authority":"shipped-artifact","environment":null,"limitations":["The executable version and supported formats are reported as unknown because no reliable version probe was performed.","A non-zero process exit is preserved as an observed command result.","Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.","When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call."],"relationship_coverage":null,"locations":[{"kind":"artifact-path","path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"}],"evidence_links":[]},"meta":{"command":"execute-rizin-command","duration":"5050ms"}}