{"ok":true,"data":{"evidence_id":"ev_852a8781d5ee2aa63296c0f2ff947823b0eeb153ca3b5410a8dc2f054da7d1d5","subject":{"name":"Tabbit.dll","digest":{"sha256":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c"},"local_path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","format":"unknown","architecture":null},"provider":{"id":"rizin","name":"Rizin","version":null},"analysis_profile":null,"predicate_type":"rea.reverse-engineering.command-observation","operation":"execute_rizin_command","parameters":{"path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","command":"e scr.color=0;pd 25 @ 0x183838550;pd 65 @ 0x18b83ff20","provider_executable":"C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe","command_arguments":["-N","-q","-c","e scr.color=0;pd 25 @ 0x183838550;pd 65 @ 0x18b83ff20","C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"]},"raw_result":{"stdout":" : 0x183838550 mov eax, dword [0xc0626e8f9894c00] ; [0xc0626e8f9894c00:4]=-1\r\n : 0x183838559 add dword [rax-0x73], ecx\r\n : 0x18383855c and al, 0x60 ; 96\r\n : 0x18383855f lea rdx, qword [rsp+0x190]\r\n : 0x183838567 call 0x1842170e0\r\n : 0x18383856c mov ecx, 0x78 ; 'x' ; 120\r\n : 0x183838571 call 0x185f006b8\r\n : 0x183838576 mov qword [rsp+0x48], rax\r\n : 0x18383857b mov qword [rsp+0x58], 0x01\r\n : 0x183838584 test rax, rax\r\n `=< 0x183838587 jz 0x183838256\r\n 0x18383858d lea rbx, qword [rsp+0x60]\r\n 0x183838592 mov rcx, rax\r\n 0x183838595 mov rdx, rbx\r\n 0x183838598 call 0x1842170e0\r\n 0x18383859d lea r15, qword [rsp+0x48]\r\n 0x1838385a2 mov qword [r15+0x08], 0x01\r\n 0x1838385aa mov rcx, rbx\r\n 0x1838385ad call 0x1841c04a0\r\n 0x1838385b2 mov rcx, r14\r\n 0x1838385b5 mov rdx, r15\r\n 0x1838385b8 call 0x18b83ff20\r\n 0x1838385bd cmp dword [0x191de85c0], 0x00 ; [0x191de85c0:4]=0\r\n ,=< 0x1838385c4 jnle 0x1838386be\r\n | 0x1838385ca cmp dword [0x191cd6be0], 0x00 ; [0x191cd6be0:4]=1\r\n 0x18b83ff20 push r14\r\n 0x18b83ff22 push rsi\r\n 0x18b83ff23 push rdi\r\n 0x18b83ff24 push rbx\r\n 0x18b83ff25 sub rsp, 0x48\r\n 0x18b83ff29 mov rdi, rdx\r\n 0x18b83ff2c mov rsi, rcx\r\n 0x18b83ff2f mov rax, qword [0x191c71040] ; [0x191c71040:8]=0x2b992ddfa232\r\n 0x18b83ff36 xor rax, rsp\r\n 0x18b83ff39 mov qword [rsp+0x40], rax\r\n 0x18b83ff3e mov qword [rsp+0x30], 0x18 ; [0x18:8]=-1 ; 24\r\n 0x18b83ff47 mov al, byte [0x191de51e8] ; [0x191de51e8:1]=0\r\n 0x18b83ff4d test al, al\r\n ,=< 0x18b83ff4f jnz 0x18b840011\r\n | 0x18b83ff55 lea rbx, qword [rsi+0x30]\r\n | 0x18b83ff59 mov ecx, 0x50 ; 'P' ; 80\r\n | 0x18b83ff5e call 0x185f006b8\r\n | 0x18b83ff63 mov r14, rax\r\n | 0x18b83ff66 mov dword [rax], 0x01\r\n | 0x18b83ff6c lea rax, qword [0x186278170]\r\n | 0x18b83ff73 mov qword [r14+0x08], rax\r\n | 0x18b83ff77 lea rax, qword [0x18b8443e0]\r\n | 0x18b83ff7e mov qword [r14+0x10], rax\r\n | 0x18b83ff82 lea rax, qword [0x1841d75d0]\r\n | 0x18b83ff89 mov qword [r14+0x18], rax\r\n | 0x18b83ff8d lea rax, qword [0x18b8497e0]\r\n | 0x18b83ff94 mov qword [r14+0x20], rax\r\n | 0x18b83ff98 mov dword [r14+0x28], 0x00\r\n | 0x18b83ffa0 lea rcx, qword [r14+0x30]\r\n | 0x18b83ffa4 mov r8, rbx\r\n | 0x18b83ffa7 mov r9, rdi\r\n | 0x18b83ffaa call 0x18b842fb0\r\n | 0x18b83ffaf lea r8, qword [rsp+0x28]\r\n | 0x18b83ffb4 mov qword [r8], r14\r\n | 0x18b83ffb7 mov rcx, rsi\r\n | 0x18b83ffba call 0x1812bb5e0\r\n | 0x18b83ffbf mov qword [rsp+0x30], 0x18 ; [0x18:8]=-1 ; 24\r\n | 0x18b83ffc8 mov al, byte [0x191de51e8] ; [0x191de51e8:1]=0\r\n | 0x18b83ffce test al, al\r\n ,==< 0x18b83ffd0 jnz 0x18b83fff0\r\n .---> 0x18b83ffd2 mov rax, qword [rsp+0x40]\r\n :|| 0x18b83ffd7 xor rax, rsp\r\n :|| 0x18b83ffda mov rcx, qword [0x191c71040] ; [0x191c71040:8]=0x2b992ddfa232\r\n :|| 0x18b83ffe1 cmp rcx, rax\r\n ,====< 0x18b83ffe4 jnz 0x18b840038\r\n |:|| 0x18b83ffe6 add rsp, 0x48\r\n |:|| 0x18b83ffea pop rbx\r\n |:|| 0x18b83ffeb pop rdi\r\n |:|| 0x18b83ffec pop rsi\r\n |:|| 0x18b83ffed pop r14\r\n |:|| 0x18b83ffef ret\r\n |:`--> 0x18b83fff0 movzx ecx, al\r\n |: | 0x18b83fff3 lea r8, qword [rsp+0x38]\r\n |: | 0x18b83fff8 mov qword [r8], 0x00\r\n |: | 0x18b83ffff lea rdx, qword [rsp+0x30]\r\n |: | 0x18b840004 mov r9d, 0x02\r\n |: | 0x18b84000a call 0x184354510\r\n |`===< 0x18b84000f jmp 0x18b83ffd2\r\n | `-> 0x18b840011 movzx ecx, al\r\n | 0x18b840014 lea rax, qword [0x190fc1d88] ; \"HistoryService::DeleteURLs\"\r\n | 0x18b84001b lea r8, qword [rsp+0x38]\r\n | 0x18b840020 mov qword [r8], rax\r\n | 0x18b840023 lea rdx, qword [rsp+0x30]\r\n | 0x18b840028 mov r9d, 0x01\r\n | 0x18b84002e call 0x184354510\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"normalized_result":{"stdout":" : 0x183838550 mov eax, dword [0xc0626e8f9894c00] ; [0xc0626e8f9894c00:4]=-1\r\n : 0x183838559 add dword [rax-0x73], ecx\r\n : 0x18383855c and al, 0x60 ; 96\r\n : 0x18383855f lea rdx, qword [rsp+0x190]\r\n : 0x183838567 call 0x1842170e0\r\n : 0x18383856c mov ecx, 0x78 ; 'x' ; 120\r\n : 0x183838571 call 0x185f006b8\r\n : 0x183838576 mov qword [rsp+0x48], rax\r\n : 0x18383857b mov qword [rsp+0x58], 0x01\r\n : 0x183838584 test rax, rax\r\n `=< 0x183838587 jz 0x183838256\r\n 0x18383858d lea rbx, qword [rsp+0x60]\r\n 0x183838592 mov rcx, rax\r\n 0x183838595 mov rdx, rbx\r\n 0x183838598 call 0x1842170e0\r\n 0x18383859d lea r15, qword [rsp+0x48]\r\n 0x1838385a2 mov qword [r15+0x08], 0x01\r\n 0x1838385aa mov rcx, rbx\r\n 0x1838385ad call 0x1841c04a0\r\n 0x1838385b2 mov rcx, r14\r\n 0x1838385b5 mov rdx, r15\r\n 0x1838385b8 call 0x18b83ff20\r\n 0x1838385bd cmp dword [0x191de85c0], 0x00 ; [0x191de85c0:4]=0\r\n ,=< 0x1838385c4 jnle 0x1838386be\r\n | 0x1838385ca cmp dword [0x191cd6be0], 0x00 ; [0x191cd6be0:4]=1\r\n 0x18b83ff20 push r14\r\n 0x18b83ff22 push rsi\r\n 0x18b83ff23 push rdi\r\n 0x18b83ff24 push rbx\r\n 0x18b83ff25 sub rsp, 0x48\r\n 0x18b83ff29 mov rdi, rdx\r\n 0x18b83ff2c mov rsi, rcx\r\n 0x18b83ff2f mov rax, qword [0x191c71040] ; [0x191c71040:8]=0x2b992ddfa232\r\n 0x18b83ff36 xor rax, rsp\r\n 0x18b83ff39 mov qword [rsp+0x40], rax\r\n 0x18b83ff3e mov qword [rsp+0x30], 0x18 ; [0x18:8]=-1 ; 24\r\n 0x18b83ff47 mov al, byte [0x191de51e8] ; [0x191de51e8:1]=0\r\n 0x18b83ff4d test al, al\r\n ,=< 0x18b83ff4f jnz 0x18b840011\r\n | 0x18b83ff55 lea rbx, qword [rsi+0x30]\r\n | 0x18b83ff59 mov ecx, 0x50 ; 'P' ; 80\r\n | 0x18b83ff5e call 0x185f006b8\r\n | 0x18b83ff63 mov r14, rax\r\n | 0x18b83ff66 mov dword [rax], 0x01\r\n | 0x18b83ff6c lea rax, qword [0x186278170]\r\n | 0x18b83ff73 mov qword [r14+0x08], rax\r\n | 0x18b83ff77 lea rax, qword [0x18b8443e0]\r\n | 0x18b83ff7e mov qword [r14+0x10], rax\r\n | 0x18b83ff82 lea rax, qword [0x1841d75d0]\r\n | 0x18b83ff89 mov qword [r14+0x18], rax\r\n | 0x18b83ff8d lea rax, qword [0x18b8497e0]\r\n | 0x18b83ff94 mov qword [r14+0x20], rax\r\n | 0x18b83ff98 mov dword [r14+0x28], 0x00\r\n | 0x18b83ffa0 lea rcx, qword [r14+0x30]\r\n | 0x18b83ffa4 mov r8, rbx\r\n | 0x18b83ffa7 mov r9, rdi\r\n | 0x18b83ffaa call 0x18b842fb0\r\n | 0x18b83ffaf lea r8, qword [rsp+0x28]\r\n | 0x18b83ffb4 mov qword [r8], r14\r\n | 0x18b83ffb7 mov rcx, rsi\r\n | 0x18b83ffba call 0x1812bb5e0\r\n | 0x18b83ffbf mov qword [rsp+0x30], 0x18 ; [0x18:8]=-1 ; 24\r\n | 0x18b83ffc8 mov al, byte [0x191de51e8] ; [0x191de51e8:1]=0\r\n | 0x18b83ffce test al, al\r\n ,==< 0x18b83ffd0 jnz 0x18b83fff0\r\n .---> 0x18b83ffd2 mov rax, qword [rsp+0x40]\r\n :|| 0x18b83ffd7 xor rax, rsp\r\n :|| 0x18b83ffda mov rcx, qword [0x191c71040] ; [0x191c71040:8]=0x2b992ddfa232\r\n :|| 0x18b83ffe1 cmp rcx, rax\r\n ,====< 0x18b83ffe4 jnz 0x18b840038\r\n |:|| 0x18b83ffe6 add rsp, 0x48\r\n |:|| 0x18b83ffea pop rbx\r\n |:|| 0x18b83ffeb pop rdi\r\n |:|| 0x18b83ffec pop rsi\r\n |:|| 0x18b83ffed pop r14\r\n |:|| 0x18b83ffef ret\r\n |:`--> 0x18b83fff0 movzx ecx, al\r\n |: | 0x18b83fff3 lea r8, qword [rsp+0x38]\r\n |: | 0x18b83fff8 mov qword [r8], 0x00\r\n |: | 0x18b83ffff lea rdx, qword [rsp+0x30]\r\n |: | 0x18b840004 mov r9d, 0x02\r\n |: | 0x18b84000a call 0x184354510\r\n |`===< 0x18b84000f jmp 0x18b83ffd2\r\n | `-> 0x18b840011 movzx ecx, al\r\n | 0x18b840014 lea rax, qword [0x190fc1d88] ; \"HistoryService::DeleteURLs\"\r\n | 0x18b84001b lea r8, qword [rsp+0x38]\r\n | 0x18b840020 mov qword [r8], rax\r\n | 0x18b840023 lea rdx, qword [rsp+0x30]\r\n | 0x18b840028 mov r9d, 0x01\r\n | 0x18b84002e call 0x184354510\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"confidence":"observed","authority":"shipped-artifact","environment":null,"limitations":["The executable version and supported formats are reported as unknown because no reliable version probe was performed.","A non-zero process exit is preserved as an observed command result.","Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.","When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call."],"relationship_coverage":null,"locations":[{"kind":"artifact-path","path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"}],"evidence_links":[]},"meta":{"command":"execute-rizin-command","duration":"5456ms"}}