{"ok":true,"data":{"evidence_id":"ev_61dc6e7ff7aa4248bd95f40cc2b7c4f0d9b1ce7c8143050fa8024ef9736d6681","subject":{"name":"Tabbit.dll","digest":{"sha256":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c"},"local_path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","format":"unknown","architecture":null},"provider":{"id":"rizin","name":"Rizin","version":null},"analysis_profile":null,"predicate_type":"rea.reverse-engineering.command-observation","operation":"execute_rizin_command","parameters":{"path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","command":"e scr.color=0;af @ 0x1834270f0;pdgo @ 0x1834270f0;afij @ 0x1834270f0","provider_executable":"C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe","command_arguments":["-N","-q","-c","e scr.color=0;af @ 0x1834270f0;pdgo @ 0x1834270f0;afij @ 0x1834270f0","C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"]},"raw_result":{"stdout":" |\r\n 0x1834270f0 |void fcn.1834270f0(int64_t arg1)\r\n |{\r\n | int32_t *piVar1;\r\n | undefined4 *puVar2;\r\n | int32_t *unaff_RBX;\r\n | uint64_t unaff_RSI;\r\n | uint64_t unaff_RDI;\r\n | undefined auStack_68 [40];\r\n | int64_t var_40h;\r\n | undefined4 uStack_38;\r\n | undefined4 uStack_34;\r\n | int64_t var_30h;\r\n | int64_t var_28h;\r\n | int64_t var_20h;\r\n | \r\n 0x1834270fe | var_20h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_68;\r\n 0x18342710a | if (*(char *)(arg1 + 0x40) != '\\0') goto code_r0x000183427252;\r\n 0x183427113 | unaff_RDI = *(uint64_t *)(arg1 + 0x30);\r\n 0x18342711a | unaff_RSI = arg1;\r\n 0x18342711a | if (unaff_RDI == 0) goto code_r0x000183427252;\r\n 0x183427120 | unaff_RBX = (int32_t *)0xfffffffc00000000;\r\n 0x18342712a | *(undefined *)(arg1 + 0x40) = 1;\r\n 0x18342713b | if ((unaff_RDI & 0xfffffffc00000000) == *(uint64_t *)0x191cd6d08) {\r\n 0x183427140 | func_0x0001841c7180(unaff_RDI);\r\n | }\r\n 0x183427159 | if ((*(uint64_t *)(arg1 + 0x118) & 0xfffffffc00000000) == *(uint64_t *)0x191cd6d08) goto code_r0x0001834272c7;\r\n 0x183427264 | while( true ) {\r\n 0x18342715f | *(uint64_t *)(unaff_RSI + 0x118) = unaff_RDI;\r\n 0x18342716d | func_0x0001856b7ff0(unaff_RDI + 200, *(undefined8 *)(unaff_RSI + 0x110));\r\n 0x18342717f | func_0x0001834272e0(unaff_RSI);\r\n 0x183427192 | func_0x000184339cd0(&var_40h, 0x190151058, 0x1908fe390, 0x2f);\r\n 0x1834271ac | if (((uint64_t)unaff_RBX & unaff_RSI) == *(uint64_t *)0x191cd6d08) {\r\n 0x1834271b1 | func_0x0001841c7180(unaff_RSI);\r\n | }\r\n 0x1834271b6 | unaff_RDI = unaff_RSI + 0xb0;\r\n 0x1834271c2 | puVar2 = (undefined4 *)func_0x000185f006b8(0x38);\r\n 0x1834271c7 | *puVar2 = 1;\r\n 0x1834271d4 | *(undefined8 *)(puVar2 + 2) = 0x18085c2f0;\r\n 0x1834271df | *(undefined8 *)(puVar2 + 4) = 0x182bf3920;\r\n 0x1834271ea | *(undefined8 *)(puVar2 + 6) = 0x1841d75d0;\r\n 0x1834271f5 | *(undefined8 *)(puVar2 + 8) = 0x183427a00;\r\n 0x1834271f9 | puVar2[10] = 0;\r\n 0x183427200 | *(uint64_t *)(puVar2 + 0xc) = unaff_RSI;\r\n 0x183427204 | unaff_RBX = *(int32_t **)(unaff_RSI + 0x108);\r\n 0x18342720b | *(undefined4 **)(unaff_RSI + 0x108) = puVar2;\r\n 0x183427215 | if (unaff_RBX != (int32_t *)0x0) {\r\n 0x18342726e | LOCK();\r\n 0x18342726e | *unaff_RBX = *unaff_RBX + -1;\r\n 0x18342726e | UNLOCK();\r\n 0x183427271 | if (*unaff_RBX == 0) {\r\n 0x183427281 | if (*(int64_t *)(unaff_RBX + 4) == 0x182bf38a0) {\r\n 0x18342728e | piVar1 = *(int32_t **)(unaff_RBX + 0xc);\r\n 0x183427295 | if (piVar1 != (int32_t *)0x0) {\r\n 0x1834272a9 | LOCK();\r\n 0x1834272a9 | *piVar1 = *piVar1 + -1;\r\n 0x1834272a9 | UNLOCK();\r\n 0x1834272ac | if (*piVar1 == 0) {\r\n 0x1834272b3 | func_0x0001841dcbe0(piVar1, 8);\r\n | }\r\n | }\r\n 0x18342729f | func_0x0001841dcbe0(unaff_RBX, 0x48);\r\n | } else {\r\n 0x183427286 | (*(code *)0x185f59da0)(unaff_RBX);\r\n | }\r\n | }\r\n | }\r\n 0x18342721b | *(undefined4 *)(unaff_RSI + 0xd0) = (undefined4)var_30h;\r\n 0x183427226 | *(undefined4 *)(unaff_RSI + 0xc0) = (undefined4)var_40h;\r\n 0x183427226 | *(undefined4 *)(unaff_RSI + 0xc4) = var_40h._4_4_;\r\n 0x183427226 | *(undefined4 *)(unaff_RSI + 200) = uStack_38;\r\n 0x183427226 | *(undefined4 *)(unaff_RSI + 0xcc) = uStack_34;\r\n 0x183427232 | *(int64_t *)(unaff_RSI + 0xd8) = var_28h;\r\n 0x183427243 | *(undefined8 *)(unaff_RSI + 0xf0) = 86400000000;\r\n 0x18342724d | func_0x00018477a0a0(unaff_RDI);\r\n |code_r0x000183427252:\r\n 0x183427264 | if (*(uint64_t *)0x191c71040 == (var_20h ^ (uint64_t)auStack_68)) break;\r\n 0x1834272bf | func_0x000185f05b40(var_20h ^ (uint64_t)auStack_68);\r\n |code_r0x0001834272c7:\r\n 0x1834272c7 | func_0x00018005f390();\r\n | }\r\n 0x18342726d | return;\r\n |}\r\n[{\"offset\":6497136880,\"name\":\"fcn.1834270f0\",\"size\":481,\"is-pure\":false,\"realsz\":481,\"noreturn\":false,\"stackframe\":104,\"calltype\":\"ms\",\"cost\":149,\"cc\":12,\"loops\":6,\"bits\":64,\"type\":\"fcn\",\"nbbs\":20,\"edges\":30,\"ebbs\":1,\"signature\":\"fcn.1834270f0(int64_t arg1);\",\"minbound\":6497136880,\"maxbound\":6497137361,\"callrefs\":[{\"from\":6497136960,\"to\":6511423872,\"type\":\"CALL\"},{\"from\":6497137015,\"to\":6533382128,\"type\":\"CALL\"},{\"from\":6497137023,\"to\":6497137376,\"type\":\"CALL\"},{\"from\":6497137053,\"to\":6512942288,\"type\":\"CALL\"},{\"from\":6497137073,\"to\":6511423872,\"type\":\"CALL\"},{\"from\":6497137090,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6497137229,\"to\":6517399712,\"type\":\"CALL\"},{\"from\":6497137286,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6497137292,\"to\":6497137175,\"type\":\"CODE\"},{\"from\":6497137311,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6497137316,\"to\":6497137175,\"type\":\"CODE\"},{\"from\":6497137331,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6497137336,\"to\":6497137303,\"type\":\"CODE\"},{\"from\":6497137346,\"to\":6542089024,\"type\":\"CALL\"},{\"from\":6497137351,\"to\":6442840976,\"type\":\"CALL\"},{\"from\":6497137356,\"to\":6497136991,\"type\":\"CODE\"}],\"datarefs\":[{\"from\":6497136887,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6497136948,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6497136978,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6497137028,\"to\":6712266840,\"type\":\"DATA\"},{\"from\":6497137035,\"to\":6720316304,\"type\":\"DATA\"},{\"from\":6497137061,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6497137101,\"to\":6451217136,\"type\":\"DATA\"},{\"from\":6497137112,\"to\":6488537376,\"type\":\"DATA\"},{\"from\":6497137123,\"to\":6511490512,\"type\":\"DATA\"},{\"from\":6497137134,\"to\":6497139200,\"type\":\"DATA\"},{\"from\":6497137242,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6497137271,\"to\":6488537248,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6497137292,\"to\":6497137175,\"type\":\"CODE\"},{\"from\":6497137316,\"to\":6497137175,\"type\":\"CODE\"},{\"from\":6497137336,\"to\":6497137303,\"type\":\"CODE\"},{\"from\":6497137356,\"to\":6497136991,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":4,\"outdegree\":12,\"nlocals\":4,\"nargs\":1,\"stackvars\":[{\"name\":\"var_40h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-64}},{\"name\":\"var_30h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-48}},{\"name\":\"var_28h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-40}},{\"name\":\"var_20h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-32}}],\"regvars\":[{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"normalized_result":{"stdout":" |\r\n 0x1834270f0 |void fcn.1834270f0(int64_t arg1)\r\n |{\r\n | int32_t *piVar1;\r\n | undefined4 *puVar2;\r\n | int32_t *unaff_RBX;\r\n | uint64_t unaff_RSI;\r\n | uint64_t unaff_RDI;\r\n | undefined auStack_68 [40];\r\n | int64_t var_40h;\r\n | undefined4 uStack_38;\r\n | undefined4 uStack_34;\r\n | int64_t var_30h;\r\n | int64_t var_28h;\r\n | int64_t var_20h;\r\n | \r\n 0x1834270fe | var_20h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_68;\r\n 0x18342710a | if (*(char *)(arg1 + 0x40) != '\\0') goto code_r0x000183427252;\r\n 0x183427113 | unaff_RDI = *(uint64_t *)(arg1 + 0x30);\r\n 0x18342711a | unaff_RSI = arg1;\r\n 0x18342711a | if (unaff_RDI == 0) goto code_r0x000183427252;\r\n 0x183427120 | unaff_RBX = (int32_t *)0xfffffffc00000000;\r\n 0x18342712a | *(undefined *)(arg1 + 0x40) = 1;\r\n 0x18342713b | if ((unaff_RDI & 0xfffffffc00000000) == *(uint64_t *)0x191cd6d08) {\r\n 0x183427140 | func_0x0001841c7180(unaff_RDI);\r\n | }\r\n 0x183427159 | if ((*(uint64_t *)(arg1 + 0x118) & 0xfffffffc00000000) == *(uint64_t *)0x191cd6d08) goto code_r0x0001834272c7;\r\n 0x183427264 | while( true ) {\r\n 0x18342715f | *(uint64_t *)(unaff_RSI + 0x118) = unaff_RDI;\r\n 0x18342716d | func_0x0001856b7ff0(unaff_RDI + 200, *(undefined8 *)(unaff_RSI + 0x110));\r\n 0x18342717f | func_0x0001834272e0(unaff_RSI);\r\n 0x183427192 | func_0x000184339cd0(&var_40h, 0x190151058, 0x1908fe390, 0x2f);\r\n 0x1834271ac | if (((uint64_t)unaff_RBX & unaff_RSI) == *(uint64_t *)0x191cd6d08) {\r\n 0x1834271b1 | func_0x0001841c7180(unaff_RSI);\r\n | }\r\n 0x1834271b6 | unaff_RDI = unaff_RSI + 0xb0;\r\n 0x1834271c2 | puVar2 = (undefined4 *)func_0x000185f006b8(0x38);\r\n 0x1834271c7 | *puVar2 = 1;\r\n 0x1834271d4 | *(undefined8 *)(puVar2 + 2) = 0x18085c2f0;\r\n 0x1834271df | *(undefined8 *)(puVar2 + 4) = 0x182bf3920;\r\n 0x1834271ea | *(undefined8 *)(puVar2 + 6) = 0x1841d75d0;\r\n 0x1834271f5 | *(undefined8 *)(puVar2 + 8) = 0x183427a00;\r\n 0x1834271f9 | puVar2[10] = 0;\r\n 0x183427200 | *(uint64_t *)(puVar2 + 0xc) = unaff_RSI;\r\n 0x183427204 | unaff_RBX = *(int32_t **)(unaff_RSI + 0x108);\r\n 0x18342720b | *(undefined4 **)(unaff_RSI + 0x108) = puVar2;\r\n 0x183427215 | if (unaff_RBX != (int32_t *)0x0) {\r\n 0x18342726e | LOCK();\r\n 0x18342726e | *unaff_RBX = *unaff_RBX + -1;\r\n 0x18342726e | UNLOCK();\r\n 0x183427271 | if (*unaff_RBX == 0) {\r\n 0x183427281 | if (*(int64_t *)(unaff_RBX + 4) == 0x182bf38a0) {\r\n 0x18342728e | piVar1 = *(int32_t **)(unaff_RBX + 0xc);\r\n 0x183427295 | if (piVar1 != (int32_t *)0x0) {\r\n 0x1834272a9 | LOCK();\r\n 0x1834272a9 | *piVar1 = *piVar1 + -1;\r\n 0x1834272a9 | UNLOCK();\r\n 0x1834272ac | if (*piVar1 == 0) {\r\n 0x1834272b3 | func_0x0001841dcbe0(piVar1, 8);\r\n | }\r\n | }\r\n 0x18342729f | func_0x0001841dcbe0(unaff_RBX, 0x48);\r\n | } else {\r\n 0x183427286 | (*(code *)0x185f59da0)(unaff_RBX);\r\n | }\r\n | }\r\n | }\r\n 0x18342721b | *(undefined4 *)(unaff_RSI + 0xd0) = (undefined4)var_30h;\r\n 0x183427226 | *(undefined4 *)(unaff_RSI + 0xc0) = (undefined4)var_40h;\r\n 0x183427226 | *(undefined4 *)(unaff_RSI + 0xc4) = var_40h._4_4_;\r\n 0x183427226 | *(undefined4 *)(unaff_RSI + 200) = uStack_38;\r\n 0x183427226 | *(undefined4 *)(unaff_RSI + 0xcc) = uStack_34;\r\n 0x183427232 | *(int64_t *)(unaff_RSI + 0xd8) = var_28h;\r\n 0x183427243 | *(undefined8 *)(unaff_RSI + 0xf0) = 86400000000;\r\n 0x18342724d | func_0x00018477a0a0(unaff_RDI);\r\n |code_r0x000183427252:\r\n 0x183427264 | if (*(uint64_t *)0x191c71040 == (var_20h ^ (uint64_t)auStack_68)) break;\r\n 0x1834272bf | func_0x000185f05b40(var_20h ^ (uint64_t)auStack_68);\r\n |code_r0x0001834272c7:\r\n 0x1834272c7 | func_0x00018005f390();\r\n | }\r\n 0x18342726d | return;\r\n |}\r\n[{\"offset\":6497136880,\"name\":\"fcn.1834270f0\",\"size\":481,\"is-pure\":false,\"realsz\":481,\"noreturn\":false,\"stackframe\":104,\"calltype\":\"ms\",\"cost\":149,\"cc\":12,\"loops\":6,\"bits\":64,\"type\":\"fcn\",\"nbbs\":20,\"edges\":30,\"ebbs\":1,\"signature\":\"fcn.1834270f0(int64_t arg1);\",\"minbound\":6497136880,\"maxbound\":6497137361,\"callrefs\":[{\"from\":6497136960,\"to\":6511423872,\"type\":\"CALL\"},{\"from\":6497137015,\"to\":6533382128,\"type\":\"CALL\"},{\"from\":6497137023,\"to\":6497137376,\"type\":\"CALL\"},{\"from\":6497137053,\"to\":6512942288,\"type\":\"CALL\"},{\"from\":6497137073,\"to\":6511423872,\"type\":\"CALL\"},{\"from\":6497137090,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6497137229,\"to\":6517399712,\"type\":\"CALL\"},{\"from\":6497137286,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6497137292,\"to\":6497137175,\"type\":\"CODE\"},{\"from\":6497137311,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6497137316,\"to\":6497137175,\"type\":\"CODE\"},{\"from\":6497137331,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6497137336,\"to\":6497137303,\"type\":\"CODE\"},{\"from\":6497137346,\"to\":6542089024,\"type\":\"CALL\"},{\"from\":6497137351,\"to\":6442840976,\"type\":\"CALL\"},{\"from\":6497137356,\"to\":6497136991,\"type\":\"CODE\"}],\"datarefs\":[{\"from\":6497136887,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6497136948,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6497136978,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6497137028,\"to\":6712266840,\"type\":\"DATA\"},{\"from\":6497137035,\"to\":6720316304,\"type\":\"DATA\"},{\"from\":6497137061,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6497137101,\"to\":6451217136,\"type\":\"DATA\"},{\"from\":6497137112,\"to\":6488537376,\"type\":\"DATA\"},{\"from\":6497137123,\"to\":6511490512,\"type\":\"DATA\"},{\"from\":6497137134,\"to\":6497139200,\"type\":\"DATA\"},{\"from\":6497137242,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6497137271,\"to\":6488537248,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6497137292,\"to\":6497137175,\"type\":\"CODE\"},{\"from\":6497137316,\"to\":6497137175,\"type\":\"CODE\"},{\"from\":6497137336,\"to\":6497137303,\"type\":\"CODE\"},{\"from\":6497137356,\"to\":6497136991,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":4,\"outdegree\":12,\"nlocals\":4,\"nargs\":1,\"stackvars\":[{\"name\":\"var_40h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-64}},{\"name\":\"var_30h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-48}},{\"name\":\"var_28h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-40}},{\"name\":\"var_20h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-32}}],\"regvars\":[{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"confidence":"observed","authority":"shipped-artifact","environment":null,"limitations":["The executable version and supported formats are reported as unknown because no reliable version probe was performed.","A non-zero process exit is preserved as an observed command result.","Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.","When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call."],"relationship_coverage":null,"locations":[{"kind":"artifact-path","path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"}],"evidence_links":[]},"meta":{"command":"execute-rizin-command","duration":"5940ms"}}