{"ok":true,"data":{"evidence_id":"ev_a60c1f40e6c970fa97d15fa596a87a50fcb610935254e7ac44a057d1b504cf30","subject":{"name":"Tabbit.dll","digest":{"sha256":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c"},"local_path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","format":"unknown","architecture":null},"provider":{"id":"rizin","name":"Rizin","version":null},"analysis_profile":null,"predicate_type":"rea.reverse-engineering.command-observation","operation":"execute_rizin_command","parameters":{"path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","command":"e scr.color=0;af @ 0x18b8497e0;pdgo @ 0x18b8497e0;afij @ 0x18b8497e0","provider_executable":"C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe","command_arguments":["-N","-q","-c","e scr.color=0;af @ 0x18b8497e0;pdgo @ 0x18b8497e0;afij @ 0x18b8497e0","C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"]},"raw_result":{"stdout":"                   |\r\n    0x18b8497e0    |void fcn.18b8497e0(int64_t arg1, int64_t arg2)\r\n                   |{\r\n                   |    code *pcVar1;\r\n                   |    undefined auStack_58 [32];\r\n                   |    int64_t var_38h;\r\n                   |    undefined4 uStack_30;\r\n                   |    undefined4 uStack_2c;\r\n                   |    int64_t var_28h;\r\n                   |    int64_t var_20h;\r\n                   |    int64_t var_18h;\r\n                   |    \r\n    0x18b8497ed    |    var_18h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_58;\r\n    0x18b8497fa    |    if (*(int64_t *)(arg1 + 0x40) != 0) {\r\n    0x18b849802    |        var_28h = 0x18;\r\n    0x18b849813    |        if (*(char *)0x191de51e8 != '\\0') {\r\n    0x18b8498b4    |            var_20h = 0x190fc2688;\r\n    0x18b8498c2    |            func_0x000184354510(*(char *)0x191de51e8, &var_28h, &var_20h, 1);\r\n                   |        }\r\n    0x18b849820    |        var_38h._0_4_ = *(undefined4 *)arg2;\r\n    0x18b849820    |        var_38h._4_4_ = *(undefined4 *)(arg2 + 4);\r\n    0x18b849820    |        uStack_30 = *(undefined4 *)(arg2 + 8);\r\n    0x18b849820    |        uStack_2c = *(undefined4 *)(arg2 + 0xc);\r\n    0x18b849819    |        func_0x00018c761bd0(arg1 + 0x148, &var_38h, 0x7fffffffffffffff);\r\n    0x18b84983a    |        func_0x0001824a6b40(*(int64_t *)(arg1 + 0x40) + 0x30, arg1 + 0xc0);\r\n    0x18b849851    |        func_0x00018086adb0(arg1);\r\n    0x18b849856    |        var_28h = 0x18;\r\n    0x18b849867    |        if (*(char *)0x191de51e8 != '\\0') {\r\n    0x18b84988c    |            var_20h = 0;\r\n    0x18b84989e    |            func_0x000184354510(*(char *)0x191de51e8, &var_28h, &var_20h, 2);\r\n                   |        }\r\n                   |    }\r\n    0x18b84987b    |    if (*(uint64_t *)0x191c71040 == (var_18h ^ (uint64_t)auStack_58)) {\r\n    0x18b849883    |        return;\r\n                   |    }\r\n    0x18b8498d1    |    func_0x000185f05b40(var_18h ^ (uint64_t)auStack_58);\r\n    0x18b8498d9    |    pcVar1 = (code *)swi(3);\r\n    0x18b8498d9    |    (*pcVar1)();\r\n    0x18b8498d9    |    return;\r\n                   |}\r\n[{\"offset\":6635689952,\"name\":\"fcn.18b8497e0\",\"size\":250,\"is-pure\":false,\"realsz\":250,\"noreturn\":false,\"stackframe\":88,\"calltype\":\"ms\",\"cost\":78,\"cc\":6,\"loops\":2,\"bits\":64,\"type\":\"fcn\",\"nbbs\":8,\"edges\":10,\"ebbs\":2,\"signature\":\"fcn.18b8497e0(int64_t arg1, int64_t arg2);\",\"minbound\":6635689952,\"maxbound\":6635690202,\"callrefs\":[{\"from\":6635690037,\"to\":6651517904,\"type\":\"CALL\"},{\"from\":6635690057,\"to\":6480882496,\"type\":\"CALL\"},{\"from\":6635690065,\"to\":6451277232,\"type\":\"CALL\"},{\"from\":6635690142,\"to\":6513050896,\"type\":\"CALL\"},{\"from\":6635690147,\"to\":6635690089,\"type\":\"CODE\"},{\"from\":6635690178,\"to\":6513050896,\"type\":\"CALL\"},{\"from\":6635690183,\"to\":6635690009,\"type\":\"CODE\"},{\"from\":6635690196,\"to\":6542089024,\"type\":\"CALL\"}],\"datarefs\":[{\"from\":6635689958,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6635689995,\"to\":6742233576,\"type\":\"DATA\"},{\"from\":6635690079,\"to\":6742233576,\"type\":\"DATA\"},{\"from\":6635690097,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6635690152,\"to\":6727411336,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6635690147,\"to\":6635690089,\"type\":\"CODE\"},{\"from\":6635690183,\"to\":6635690009,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":2,\"outdegree\":6,\"nlocals\":4,\"nargs\":2,\"stackvars\":[{\"name\":\"var_38h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-56}},{\"name\":\"var_28h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-40}},{\"name\":\"var_20h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-32}},{\"name\":\"var_18h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-24}}],\"regvars\":[{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"normalized_result":{"stdout":"                   |\r\n    0x18b8497e0    |void fcn.18b8497e0(int64_t arg1, int64_t arg2)\r\n                   |{\r\n                   |    code *pcVar1;\r\n                   |    undefined auStack_58 [32];\r\n                   |    int64_t var_38h;\r\n                   |    undefined4 uStack_30;\r\n                   |    undefined4 uStack_2c;\r\n                   |    int64_t var_28h;\r\n                   |    int64_t var_20h;\r\n                   |    int64_t var_18h;\r\n                   |    \r\n    0x18b8497ed    |    var_18h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_58;\r\n    0x18b8497fa    |    if (*(int64_t *)(arg1 + 0x40) != 0) {\r\n    0x18b849802    |        var_28h = 0x18;\r\n    0x18b849813    |        if (*(char *)0x191de51e8 != '\\0') {\r\n    0x18b8498b4    |            var_20h = 0x190fc2688;\r\n    0x18b8498c2    |            func_0x000184354510(*(char *)0x191de51e8, &var_28h, &var_20h, 1);\r\n                   |        }\r\n    0x18b849820    |        var_38h._0_4_ = *(undefined4 *)arg2;\r\n    0x18b849820    |        var_38h._4_4_ = *(undefined4 *)(arg2 + 4);\r\n    0x18b849820    |        uStack_30 = *(undefined4 *)(arg2 + 8);\r\n    0x18b849820    |        uStack_2c = *(undefined4 *)(arg2 + 0xc);\r\n    0x18b849819    |        func_0x00018c761bd0(arg1 + 0x148, &var_38h, 0x7fffffffffffffff);\r\n    0x18b84983a    |        func_0x0001824a6b40(*(int64_t *)(arg1 + 0x40) + 0x30, arg1 + 0xc0);\r\n    0x18b849851    |        func_0x00018086adb0(arg1);\r\n    0x18b849856    |        var_28h = 0x18;\r\n    0x18b849867    |        if (*(char *)0x191de51e8 != '\\0') {\r\n    0x18b84988c    |            var_20h = 0;\r\n    0x18b84989e    |            func_0x000184354510(*(char *)0x191de51e8, &var_28h, &var_20h, 2);\r\n                   |        }\r\n                   |    }\r\n    0x18b84987b    |    if (*(uint64_t *)0x191c71040 == (var_18h ^ (uint64_t)auStack_58)) {\r\n    0x18b849883    |        return;\r\n                   |    }\r\n    0x18b8498d1    |    func_0x000185f05b40(var_18h ^ (uint64_t)auStack_58);\r\n    0x18b8498d9    |    pcVar1 = (code *)swi(3);\r\n    0x18b8498d9    |    (*pcVar1)();\r\n    0x18b8498d9    |    return;\r\n                   |}\r\n[{\"offset\":6635689952,\"name\":\"fcn.18b8497e0\",\"size\":250,\"is-pure\":false,\"realsz\":250,\"noreturn\":false,\"stackframe\":88,\"calltype\":\"ms\",\"cost\":78,\"cc\":6,\"loops\":2,\"bits\":64,\"type\":\"fcn\",\"nbbs\":8,\"edges\":10,\"ebbs\":2,\"signature\":\"fcn.18b8497e0(int64_t arg1, int64_t arg2);\",\"minbound\":6635689952,\"maxbound\":6635690202,\"callrefs\":[{\"from\":6635690037,\"to\":6651517904,\"type\":\"CALL\"},{\"from\":6635690057,\"to\":6480882496,\"type\":\"CALL\"},{\"from\":6635690065,\"to\":6451277232,\"type\":\"CALL\"},{\"from\":6635690142,\"to\":6513050896,\"type\":\"CALL\"},{\"from\":6635690147,\"to\":6635690089,\"type\":\"CODE\"},{\"from\":6635690178,\"to\":6513050896,\"type\":\"CALL\"},{\"from\":6635690183,\"to\":6635690009,\"type\":\"CODE\"},{\"from\":6635690196,\"to\":6542089024,\"type\":\"CALL\"}],\"datarefs\":[{\"from\":6635689958,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6635689995,\"to\":6742233576,\"type\":\"DATA\"},{\"from\":6635690079,\"to\":6742233576,\"type\":\"DATA\"},{\"from\":6635690097,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6635690152,\"to\":6727411336,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6635690147,\"to\":6635690089,\"type\":\"CODE\"},{\"from\":6635690183,\"to\":6635690009,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":2,\"outdegree\":6,\"nlocals\":4,\"nargs\":2,\"stackvars\":[{\"name\":\"var_38h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-56}},{\"name\":\"var_28h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-40}},{\"name\":\"var_20h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-32}},{\"name\":\"var_18h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-24}}],\"regvars\":[{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"confidence":"observed","authority":"shipped-artifact","environment":null,"limitations":["The executable version and supported formats are reported as unknown because no reliable version probe was performed.","A non-zero process exit is preserved as an observed command result.","Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.","When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call."],"relationship_coverage":null,"locations":[{"kind":"artifact-path","path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"}],"evidence_links":[]},"meta":{"command":"execute-rizin-command","duration":"5500ms"}}