{"ok":true,"data":{"evidence_id":"ev_8baa989aaa69eb26b610c0b9a03686c2636f18daa1b05aaefbbfbaf8b18a92d4","subject":{"name":"Tabbit.dll","digest":{"sha256":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c"},"local_path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","format":"unknown","architecture":null},"provider":{"id":"rizin","name":"Rizin","version":null},"analysis_profile":null,"predicate_type":"rea.reverse-engineering.command-observation","operation":"execute_rizin_command","parameters":{"path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","command":"e scr.color=0;af @ 0x1836dbb70;pdgo @ 0x1836dbb70;afij @ 0x1836dbb70","provider_executable":"C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe","command_arguments":["-N","-q","-c","e scr.color=0;af @ 0x1836dbb70;pdgo @ 0x1836dbb70;afij @ 0x1836dbb70","C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"]},"raw_result":{"stdout":" |\r\n 0x1836dbb70 |int64_t fcn.1836dbb70(int64_t arg1, int64_t arg2, int64_t arg3, int64_t arg4, int64_t arg_28h, int64_t arg_48h)\r\n |{\r\n | int32_t *piVar1;\r\n | int32_t iVar2;\r\n | undefined4 uVar3;\r\n | undefined4 uVar4;\r\n | int32_t *piVar5;\r\n | code *pcVar6;\r\n | char cVar7;\r\n | int64_t iVar8;\r\n | undefined4 *puVar9;\r\n | undefined8 uVar10;\r\n | int64_t iVar11;\r\n | int64_t *piVar12;\r\n | int64_t iVar13;\r\n | undefined auStack_e8 [32];\r\n | int64_t var_c8h;\r\n | int64_t var_c0h;\r\n | int64_t var_b0h;\r\n | int64_t var_a8h;\r\n | undefined8 uStack_a0;\r\n | int64_t var_98h;\r\n | int64_t var_90h;\r\n | int64_t var_88h;\r\n | int64_t var_80h;\r\n | int64_t var_78h;\r\n | int64_t var_70h;\r\n | unkbyte5 Stack_68;\r\n | int64_t var_63h;\r\n | undefined uStack_59;\r\n | int64_t var_58h;\r\n | int64_t var_50h;\r\n | int64_t var_48h;\r\n | \r\n 0x1836dbb9a | var_48h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_e8;\r\n 0x1836dbba5 | *(int32_t *)(arg1 + 0x228) = (int32_t)arg3;\r\n 0x1836dbbac | uVar3 = *(undefined4 *)arg4;\r\n 0x1836dbbaf | *(undefined4 *)(arg1 + 0x22c) = uVar3;\r\n 0x1836dbbb5 | uVar4 = *(undefined4 *)(arg4 + 4);\r\n 0x1836dbbb9 | *(undefined4 *)(arg1 + 0x230) = uVar4;\r\n 0x1836dbbc0 | *(undefined4 *)(arg1 + 0x238) = uVar3;\r\n 0x1836dbbca | *(undefined8 *)(arg1 + 0x240) = *(undefined8 *)(arg4 + 8);\r\n 0x1836dbbd1 | *(undefined *)(arg1 + 600) = (undefined)arg_28h;\r\n 0x1836dbbdb | *(undefined8 *)(arg1 + 0x260) = *(undefined8 *)(arg4 + 0x10);\r\n 0x1836dbbe2 | var_a8h = 0;\r\n 0x1836dbbf2 | iVar11 = *(int64_t *)(arg1 + 0x1d0);\r\n 0x1836dbbfc | if (iVar11 == 0) {\r\n 0x1836dbbfe | iVar11 = *(int64_t *)(arg1 + 0x1c8);\r\n | }\r\n 0x1836dbc05 | var_c8h = (int64_t)&var_a8h;\r\n 0x1836dbc0f | var_c0h = 0;\r\n 0x1836dbc1d | cVar7 = func_0x0001814eff10(arg3 & 0xffffffff, iVar11, \r\n 0x1836dbbeb | CONCAT31((unkint3)((uint32_t)uVar4 >> 8), *(undefined *)(arg1 + 0x139)), 0);\r\n 0x1836dbc32 | if ((cVar7 == '\\0') || (var_a8h == 0)) {\r\n 0x1836dbe83 | uStack_59 = 0xd;\r\n 0x1836dbea1 | if ((int64_t *)0x190b4c1f8 < &var_63h && &var_70h < (int64_t *)0x190b4c1f9) {\r\n |code_r0x0001836dbfc9:\r\n 0x1836dbfc9 | // WARNING: Does not return\r\n 0x1836dbfc9 | pcVar6 = (code *)invalidInstructionException();\r\n 0x1836dbfc9 | (*pcVar6)();\r\n | }\r\n 0x1836dbeae | piVar12 = &var_70h;\r\n 0x1836dbeb3 | Stack_68 = 0x646e756f66;\r\n 0x1836dbebe | var_70h._0_5_ = 0x6e20626154;\r\n 0x1836dbebe | var_70h._5_3_ = 0x20746f;\r\n 0x1836dbec1 | var_63h._0_1_ = 0;\r\n |code_r0x0001836dbec6:\r\n 0x1836dbecc | func_0x000188ac4940(arg1, arg2, piVar12);\r\n 0x1836dbee8 | var_a8h = 0x188ac5700;\r\n 0x1836dbeeb | uStack_a0 = uStack_a0 & 0xffffffff00000000;\r\n 0x1836dbef9 | var_50h = arg1;\r\n 0x1836dbef9 | uVar10 = func_0x000188ac69e0(0x1861e7020);\r\n 0x1836dbefe | *(undefined8 *)(arg2 + 8) = uVar10;\r\n 0x1836dbf02 | *(undefined *)(arg2 + 0x10) = 1;\r\n | } else {\r\n 0x1836dbc38 | var_58h = (int64_t)&var_50h;\r\n 0x1836dbc40 | var_50h = 0;\r\n 0x1836dbc47 | var_a8h = (int64_t)&var_58h;\r\n 0x1836dbc5e | uStack_a0 = 0x182d26640;\r\n 0x1836dbc6f | (*(code *)0x185f59da0)();\r\n 0x1836dbc6f | iVar11 = var_50h;\r\n 0x1836dbc7b | if (var_50h == 0) {\r\n 0x1836dbf10 | var_88h = func_0x000185f006b8(0x30);\r\n 0x1836dbf1a | var_80h = 0x2d;\r\n 0x1836dbf31 | var_78h = -0x7fffffffffffffd0;\r\n 0x1836dbf5a | if (((undefined4 *)(var_88h + 0x2d) < (uint64_t)var_88h) ||\r\n 0x1836dbf54 | ((undefined4 *)0x190c149e0 < (undefined4 *)(var_88h + 0x2d) &&\r\n 0x1836dbf4d | (uint64_t)var_88h < (undefined4 *)0x190c149e1)) goto code_r0x0001836dbfc9;\r\n 0x1836dbf63 | *(undefined8 *)(var_88h + 0x1d) = 0x20464450206d7569;\r\n 0x1836dbf63 | *(undefined8 *)(var_88h + 0x25) = 0x746e656d75636f64;\r\n 0x1836dbf6e | *(undefined8 *)(var_88h + 0x10) = 0x206120676e697961;\r\n 0x1836dbf6e | *(undefined8 *)(var_88h + 0x18) = 0x6d75696d6f726843;\r\n 0x1836dbf79 | *(undefined4 *)var_88h = 0x20626154;\r\n 0x1836dbf79 | *(undefined4 *)(var_88h + 4) = 0x6e207369;\r\n 0x1836dbf79 | *(undefined4 *)(var_88h + 8) = 0x6420746f;\r\n 0x1836dbf79 | *(undefined4 *)(var_88h + 0xc) = 0x6c707369;\r\n 0x1836dbf7c | *(undefined *)(var_88h + 0x2d) = 0;\r\n 0x1836dbf80 | piVar12 = &var_88h;\r\n 0x1836dbf85 | goto code_r0x0001836dbec6;\r\n | }\r\n 0x1836dbc88 | if (*(char *)(arg1 + 600) == '\\x01') {\r\n 0x1836dbc8e | iVar8 = *(int64_t *)(arg1 + 0x260);\r\n | } else {\r\n 0x1836dbc8a | iVar8 = 0;\r\n | }\r\n 0x1836dbcb6 | iVar13 = 0x7fffffffffffffff;\r\n 0x1836dbcb6 | if (!SCARRY8(iVar8, 30000000)) {\r\n 0x1836dbcb6 | iVar13 = iVar8 + 30000000;\r\n | }\r\n 0x1836dbcbe | if (iVar8 + 0x8000000000000001U < 2) {\r\n 0x1836dbcbe | iVar13 = iVar8;\r\n | }\r\n 0x1836dbcc5 | if (arg1 != 0) {\r\n 0x1836dbccc | LOCK();\r\n 0x1836dbccc | piVar1 = (int32_t *)(arg1 + 8);\r\n 0x1836dbccc | iVar2 = *piVar1;\r\n 0x1836dbccc | *piVar1 = *piVar1 + 1;\r\n 0x1836dbccc | UNLOCK();\r\n 0x1836dbcd6 | if (iVar2 == 0x7fffffff) goto code_r0x0001836dbfc6;\r\n | }\r\n 0x1836dbce8 | puVar9 = (undefined4 *)func_0x000185f006b8(0x38);\r\n 0x1836dbcf0 | *puVar9 = 1;\r\n 0x1836dbcfd | *(undefined8 *)(puVar9 + 2) = 0x18183fc50;\r\n 0x1836dbd09 | *(undefined8 *)(puVar9 + 4) = 0x18333c920;\r\n 0x1836dbd15 | *(undefined8 *)(puVar9 + 6) = 0x1841d75d0;\r\n 0x1836dbd21 | *(undefined8 *)(puVar9 + 8) = 0x1836dbfd0;\r\n 0x1836dbd26 | puVar9[10] = 0;\r\n 0x1836dbd2f | *(int64_t *)(puVar9 + 0xc) = arg1;\r\n 0x1836dbd42 | func_0x000184339cd0(&var_a8h, 0x190c14a10, 0x190c143c0, 0x3ee);\r\n 0x1836dbd52 | piVar1 = *(int32_t **)(arg1 + 0x310);\r\n 0x1836dbd59 | *(undefined4 **)(arg1 + 0x310) = puVar9;\r\n 0x1836dbd63 | if (piVar1 != (int32_t *)0x0) {\r\n 0x1836dbde0 | LOCK();\r\n 0x1836dbde0 | *piVar1 = *piVar1 + -1;\r\n 0x1836dbde0 | UNLOCK();\r\n 0x1836dbde4 | if (*piVar1 == 0) {\r\n 0x1836dbdf8 | if (*(int64_t *)(piVar1 + 4) == 0x182bf38a0) {\r\n 0x1836dbf8a | piVar5 = *(int32_t **)(piVar1 + 0xc);\r\n 0x1836dbf91 | if (piVar5 != (int32_t *)0x0) {\r\n 0x1836dbfa5 | LOCK();\r\n 0x1836dbfa5 | *piVar5 = *piVar5 + -1;\r\n 0x1836dbfa5 | UNLOCK();\r\n 0x1836dbfa8 | if (*piVar5 == 0) {\r\n 0x1836dbfaf | func_0x0001841dcbe0(piVar5, 8);\r\n | }\r\n | }\r\n 0x1836dbf9b | func_0x0001841dcbe0(piVar1, 0x48);\r\n | } else {\r\n 0x1836dbe01 | (*(code *)0x185f59da0)(piVar1);\r\n | }\r\n | }\r\n | }\r\n 0x1836dbd69 | *(undefined4 *)(arg1 + 0x2d8) = (undefined4)var_98h;\r\n 0x1836dbd74 | *(undefined4 *)(arg1 + 0x2c8) = (undefined4)var_a8h;\r\n 0x1836dbd74 | *(undefined4 *)(arg1 + 0x2cc) = var_a8h._4_4_;\r\n 0x1836dbd74 | *(undefined4 *)(arg1 + 0x2d0) = (undefined4)uStack_a0;\r\n 0x1836dbd74 | *(undefined4 *)(arg1 + 0x2d4) = uStack_a0._4_4_;\r\n 0x1836dbd80 | *(int64_t *)(arg1 + 0x2e0) = var_90h;\r\n 0x1836dbd87 | *(int64_t *)(arg1 + 0x2f8) = iVar13;\r\n 0x1836dbcdc | func_0x00018477a0a0(arg1 + 0x2b8);\r\n 0x1836dbd9d | if (*(char *)(iVar11 + 0x131) == '\\x01') {\r\n 0x1836dbda2 | func_0x0001836dc0e0(arg1);\r\n | } else {\r\n 0x1836dbe0f | if (arg1 != 0) {\r\n 0x1836dbe16 | LOCK();\r\n 0x1836dbe16 | piVar1 = (int32_t *)(arg1 + 8);\r\n 0x1836dbe16 | iVar2 = *piVar1;\r\n 0x1836dbe16 | *piVar1 = *piVar1 + 1;\r\n 0x1836dbe16 | UNLOCK();\r\n 0x1836dbe20 | if (iVar2 == 0x7fffffff) {\r\n 0x1836dbfcb | pcVar6 = (code *)swi(3);\r\n 0x1836dbfcb | iVar11 = (*pcVar6)();\r\n 0x1836dbfcb | return iVar11;\r\n | }\r\n | }\r\n 0x1836dbe2b | var_b0h = func_0x000185f006b8(0x38);\r\n 0x1836dbe30 | *(undefined4 *)var_b0h = 1;\r\n 0x1836dbe3d | *(undefined8 *)(var_b0h + 8) = 0x18183fc50;\r\n 0x1836dbe48 | *(undefined8 *)(var_b0h + 0x10) = 0x18333c920;\r\n 0x1836dbe4c | *(undefined8 *)(var_b0h + 0x18) = 0x1841d75d0;\r\n 0x1836dbe57 | *(undefined8 *)(var_b0h + 0x20) = 0x1836dc0e0;\r\n 0x1836dbe5b | *(undefined4 *)(var_b0h + 0x28) = 0;\r\n 0x1836dbe62 | *(int64_t *)(var_b0h + 0x30) = arg1;\r\n 0x1836dbe71 | func_0x000189047c90(iVar11);\r\n | }\r\n 0x1836dbda9 | *(undefined *)arg2 = 0;\r\n 0x1836dbdab | *(undefined *)(arg2 + 0x10) = 0;\r\n | }\r\n 0x1836dbdc3 | if (*(uint64_t *)0x191c71040 == (var_48h ^ (uint64_t)auStack_e8)) {\r\n 0x1836dbddf | return arg2;\r\n | }\r\n 0x1836dbfbe | func_0x000185f05b40(var_48h ^ (uint64_t)auStack_e8);\r\n |code_r0x0001836dbfc6:\r\n 0x1836dbfc6 | pcVar6 = (code *)swi(3);\r\n 0x1836dbfc6 | iVar11 = (*pcVar6)();\r\n 0x1836dbfc6 | return iVar11;\r\n |}\r\n[{\"offset\":6499974000,\"name\":\"fcn.1836dbb70\",\"size\":1116,\"is-pure\":false,\"realsz\":1114,\"noreturn\":false,\"stackframe\":232,\"calltype\":\"ms\",\"cost\":299,\"cc\":23,\"loops\":8,\"bits\":64,\"type\":\"fcn\",\"nbbs\":36,\"edges\":51,\"ebbs\":4,\"signature\":\"fcn.1836dbb70(int64_t arg1, int64_t arg2, int64_t arg3, int64_t arg4, int64_t arg_28h, int64_t arg_48h);\",\"minbound\":6499974000,\"maxbound\":6499975116,\"callrefs\":[{\"from\":6499974173,\"to\":6464405264,\"type\":\"CALL\"},{\"from\":6499974255,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6499974284,\"to\":6499974293,\"type\":\"CODE\"},{\"from\":6499974376,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6499974477,\"to\":6512942288,\"type\":\"CALL\"},{\"from\":6499974545,\"to\":6517399712,\"type\":\"CALL\"},{\"from\":6499974562,\"to\":6499975392,\"type\":\"CALL\"},{\"from\":6499974657,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6499974663,\"to\":6499974501,\"type\":\"CODE\"},{\"from\":6499974699,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6499974769,\"to\":6593739920,\"type\":\"CALL\"},{\"from\":6499974774,\"to\":6499974567,\"type\":\"CODE\"},{\"from\":6499974860,\"to\":6587959616,\"type\":\"CALL\"},{\"from\":6499974905,\"to\":6587967968,\"type\":\"CALL\"},{\"from\":6499974918,\"to\":6499974574,\"type\":\"CODE\"},{\"from\":6499974928,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6499975045,\"to\":6499974854,\"type\":\"CODE\"},{\"from\":6499975067,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6499975072,\"to\":6499974501,\"type\":\"CODE\"},{\"from\":6499975087,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6499975092,\"to\":6499975059,\"type\":\"CODE\"},{\"from\":6499975105,\"to\":6542089024,\"type\":\"CALL\"}],\"datarefs\":[{\"from\":6499974035,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6499974226,\"to\":6489794112,\"type\":\"DATA\"},{\"from\":6499974390,\"to\":6467877968,\"type\":\"DATA\"},{\"from\":6499974402,\"to\":6496176416,\"type\":\"DATA\"},{\"from\":6499974414,\"to\":6511490512,\"type\":\"DATA\"},{\"from\":6499974426,\"to\":6499975120,\"type\":\"DATA\"},{\"from\":6499974452,\"to\":6723553808,\"type\":\"DATA\"},{\"from\":6499974459,\"to\":6723552192,\"type\":\"DATA\"},{\"from\":6499974585,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6499974638,\"to\":6488537248,\"type\":\"DATA\"},{\"from\":6499974710,\"to\":6467877968,\"type\":\"DATA\"},{\"from\":6499974721,\"to\":6496176416,\"type\":\"DATA\"},{\"from\":6499974736,\"to\":6499975392,\"type\":\"DATA\"},{\"from\":6499974791,\"to\":6722732536,\"type\":\"DATA\"},{\"from\":6499974823,\"to\":6722732541,\"type\":\"DATA\"},{\"from\":6499974839,\"to\":6722732536,\"type\":\"DATA\"},{\"from\":6499974876,\"to\":6587963136,\"type\":\"DATA\"},{\"from\":6499974898,\"to\":6545109024,\"type\":\"DATA\"},{\"from\":6499974979,\"to\":6723553760,\"type\":\"DATA\"},{\"from\":6499975004,\"to\":6723553789,\"type\":\"DATA\"},{\"from\":6499975015,\"to\":6723553776,\"type\":\"DATA\"},{\"from\":6499975026,\"to\":6723553760,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6499974284,\"to\":6499974293,\"type\":\"CODE\"},{\"from\":6499974663,\"to\":6499974501,\"type\":\"CODE\"},{\"from\":6499974774,\"to\":6499974567,\"type\":\"CODE\"},{\"from\":6499974918,\"to\":6499974574,\"type\":\"CODE\"},{\"from\":6499975045,\"to\":6499974854,\"type\":\"CODE\"},{\"from\":6499975072,\"to\":6499974501,\"type\":\"CODE\"},{\"from\":6499975092,\"to\":6499975059,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":7,\"outdegree\":15,\"nlocals\":14,\"nargs\":6,\"stackvars\":[{\"name\":\"var_c8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-200}},{\"name\":\"var_c0h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-192}},{\"name\":\"var_b0h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-176}},{\"name\":\"var_a8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-168}},{\"name\":\"var_98h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-152}},{\"name\":\"var_90h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-144}},{\"name\":\"var_88h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-136}},{\"name\":\"var_80h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-128}},{\"name\":\"var_78h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-120}},{\"name\":\"var_70h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-112}},{\"name\":\"var_63h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-99}},{\"name\":\"var_58h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-88}},{\"name\":\"var_50h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-80}},{\"name\":\"var_48h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-72}},{\"name\":\"arg_28h\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":40}},{\"name\":\"arg_48h\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":72}}],\"regvars\":[{\"name\":\"arg3\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"r8\"}},{\"name\":\"arg4\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"r9\"}},{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"normalized_result":{"stdout":" |\r\n 0x1836dbb70 |int64_t fcn.1836dbb70(int64_t arg1, int64_t arg2, int64_t arg3, int64_t arg4, int64_t arg_28h, int64_t arg_48h)\r\n |{\r\n | int32_t *piVar1;\r\n | int32_t iVar2;\r\n | undefined4 uVar3;\r\n | undefined4 uVar4;\r\n | int32_t *piVar5;\r\n | code *pcVar6;\r\n | char cVar7;\r\n | int64_t iVar8;\r\n | undefined4 *puVar9;\r\n | undefined8 uVar10;\r\n | int64_t iVar11;\r\n | int64_t *piVar12;\r\n | int64_t iVar13;\r\n | undefined auStack_e8 [32];\r\n | int64_t var_c8h;\r\n | int64_t var_c0h;\r\n | int64_t var_b0h;\r\n | int64_t var_a8h;\r\n | undefined8 uStack_a0;\r\n | int64_t var_98h;\r\n | int64_t var_90h;\r\n | int64_t var_88h;\r\n | int64_t var_80h;\r\n | int64_t var_78h;\r\n | int64_t var_70h;\r\n | unkbyte5 Stack_68;\r\n | int64_t var_63h;\r\n | undefined uStack_59;\r\n | int64_t var_58h;\r\n | int64_t var_50h;\r\n | int64_t var_48h;\r\n | \r\n 0x1836dbb9a | var_48h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_e8;\r\n 0x1836dbba5 | *(int32_t *)(arg1 + 0x228) = (int32_t)arg3;\r\n 0x1836dbbac | uVar3 = *(undefined4 *)arg4;\r\n 0x1836dbbaf | *(undefined4 *)(arg1 + 0x22c) = uVar3;\r\n 0x1836dbbb5 | uVar4 = *(undefined4 *)(arg4 + 4);\r\n 0x1836dbbb9 | *(undefined4 *)(arg1 + 0x230) = uVar4;\r\n 0x1836dbbc0 | *(undefined4 *)(arg1 + 0x238) = uVar3;\r\n 0x1836dbbca | *(undefined8 *)(arg1 + 0x240) = *(undefined8 *)(arg4 + 8);\r\n 0x1836dbbd1 | *(undefined *)(arg1 + 600) = (undefined)arg_28h;\r\n 0x1836dbbdb | *(undefined8 *)(arg1 + 0x260) = *(undefined8 *)(arg4 + 0x10);\r\n 0x1836dbbe2 | var_a8h = 0;\r\n 0x1836dbbf2 | iVar11 = *(int64_t *)(arg1 + 0x1d0);\r\n 0x1836dbbfc | if (iVar11 == 0) {\r\n 0x1836dbbfe | iVar11 = *(int64_t *)(arg1 + 0x1c8);\r\n | }\r\n 0x1836dbc05 | var_c8h = (int64_t)&var_a8h;\r\n 0x1836dbc0f | var_c0h = 0;\r\n 0x1836dbc1d | cVar7 = func_0x0001814eff10(arg3 & 0xffffffff, iVar11, \r\n 0x1836dbbeb | CONCAT31((unkint3)((uint32_t)uVar4 >> 8), *(undefined *)(arg1 + 0x139)), 0);\r\n 0x1836dbc32 | if ((cVar7 == '\\0') || (var_a8h == 0)) {\r\n 0x1836dbe83 | uStack_59 = 0xd;\r\n 0x1836dbea1 | if ((int64_t *)0x190b4c1f8 < &var_63h && &var_70h < (int64_t *)0x190b4c1f9) {\r\n |code_r0x0001836dbfc9:\r\n 0x1836dbfc9 | // WARNING: Does not return\r\n 0x1836dbfc9 | pcVar6 = (code *)invalidInstructionException();\r\n 0x1836dbfc9 | (*pcVar6)();\r\n | }\r\n 0x1836dbeae | piVar12 = &var_70h;\r\n 0x1836dbeb3 | Stack_68 = 0x646e756f66;\r\n 0x1836dbebe | var_70h._0_5_ = 0x6e20626154;\r\n 0x1836dbebe | var_70h._5_3_ = 0x20746f;\r\n 0x1836dbec1 | var_63h._0_1_ = 0;\r\n |code_r0x0001836dbec6:\r\n 0x1836dbecc | func_0x000188ac4940(arg1, arg2, piVar12);\r\n 0x1836dbee8 | var_a8h = 0x188ac5700;\r\n 0x1836dbeeb | uStack_a0 = uStack_a0 & 0xffffffff00000000;\r\n 0x1836dbef9 | var_50h = arg1;\r\n 0x1836dbef9 | uVar10 = func_0x000188ac69e0(0x1861e7020);\r\n 0x1836dbefe | *(undefined8 *)(arg2 + 8) = uVar10;\r\n 0x1836dbf02 | *(undefined *)(arg2 + 0x10) = 1;\r\n | } else {\r\n 0x1836dbc38 | var_58h = (int64_t)&var_50h;\r\n 0x1836dbc40 | var_50h = 0;\r\n 0x1836dbc47 | var_a8h = (int64_t)&var_58h;\r\n 0x1836dbc5e | uStack_a0 = 0x182d26640;\r\n 0x1836dbc6f | (*(code *)0x185f59da0)();\r\n 0x1836dbc6f | iVar11 = var_50h;\r\n 0x1836dbc7b | if (var_50h == 0) {\r\n 0x1836dbf10 | var_88h = func_0x000185f006b8(0x30);\r\n 0x1836dbf1a | var_80h = 0x2d;\r\n 0x1836dbf31 | var_78h = -0x7fffffffffffffd0;\r\n 0x1836dbf5a | if (((undefined4 *)(var_88h + 0x2d) < (uint64_t)var_88h) ||\r\n 0x1836dbf54 | ((undefined4 *)0x190c149e0 < (undefined4 *)(var_88h + 0x2d) &&\r\n 0x1836dbf4d | (uint64_t)var_88h < (undefined4 *)0x190c149e1)) goto code_r0x0001836dbfc9;\r\n 0x1836dbf63 | *(undefined8 *)(var_88h + 0x1d) = 0x20464450206d7569;\r\n 0x1836dbf63 | *(undefined8 *)(var_88h + 0x25) = 0x746e656d75636f64;\r\n 0x1836dbf6e | *(undefined8 *)(var_88h + 0x10) = 0x206120676e697961;\r\n 0x1836dbf6e | *(undefined8 *)(var_88h + 0x18) = 0x6d75696d6f726843;\r\n 0x1836dbf79 | *(undefined4 *)var_88h = 0x20626154;\r\n 0x1836dbf79 | *(undefined4 *)(var_88h + 4) = 0x6e207369;\r\n 0x1836dbf79 | *(undefined4 *)(var_88h + 8) = 0x6420746f;\r\n 0x1836dbf79 | *(undefined4 *)(var_88h + 0xc) = 0x6c707369;\r\n 0x1836dbf7c | *(undefined *)(var_88h + 0x2d) = 0;\r\n 0x1836dbf80 | piVar12 = &var_88h;\r\n 0x1836dbf85 | goto code_r0x0001836dbec6;\r\n | }\r\n 0x1836dbc88 | if (*(char *)(arg1 + 600) == '\\x01') {\r\n 0x1836dbc8e | iVar8 = *(int64_t *)(arg1 + 0x260);\r\n | } else {\r\n 0x1836dbc8a | iVar8 = 0;\r\n | }\r\n 0x1836dbcb6 | iVar13 = 0x7fffffffffffffff;\r\n 0x1836dbcb6 | if (!SCARRY8(iVar8, 30000000)) {\r\n 0x1836dbcb6 | iVar13 = iVar8 + 30000000;\r\n | }\r\n 0x1836dbcbe | if (iVar8 + 0x8000000000000001U < 2) {\r\n 0x1836dbcbe | iVar13 = iVar8;\r\n | }\r\n 0x1836dbcc5 | if (arg1 != 0) {\r\n 0x1836dbccc | LOCK();\r\n 0x1836dbccc | piVar1 = (int32_t *)(arg1 + 8);\r\n 0x1836dbccc | iVar2 = *piVar1;\r\n 0x1836dbccc | *piVar1 = *piVar1 + 1;\r\n 0x1836dbccc | UNLOCK();\r\n 0x1836dbcd6 | if (iVar2 == 0x7fffffff) goto code_r0x0001836dbfc6;\r\n | }\r\n 0x1836dbce8 | puVar9 = (undefined4 *)func_0x000185f006b8(0x38);\r\n 0x1836dbcf0 | *puVar9 = 1;\r\n 0x1836dbcfd | *(undefined8 *)(puVar9 + 2) = 0x18183fc50;\r\n 0x1836dbd09 | *(undefined8 *)(puVar9 + 4) = 0x18333c920;\r\n 0x1836dbd15 | *(undefined8 *)(puVar9 + 6) = 0x1841d75d0;\r\n 0x1836dbd21 | *(undefined8 *)(puVar9 + 8) = 0x1836dbfd0;\r\n 0x1836dbd26 | puVar9[10] = 0;\r\n 0x1836dbd2f | *(int64_t *)(puVar9 + 0xc) = arg1;\r\n 0x1836dbd42 | func_0x000184339cd0(&var_a8h, 0x190c14a10, 0x190c143c0, 0x3ee);\r\n 0x1836dbd52 | piVar1 = *(int32_t **)(arg1 + 0x310);\r\n 0x1836dbd59 | *(undefined4 **)(arg1 + 0x310) = puVar9;\r\n 0x1836dbd63 | if (piVar1 != (int32_t *)0x0) {\r\n 0x1836dbde0 | LOCK();\r\n 0x1836dbde0 | *piVar1 = *piVar1 + -1;\r\n 0x1836dbde0 | UNLOCK();\r\n 0x1836dbde4 | if (*piVar1 == 0) {\r\n 0x1836dbdf8 | if (*(int64_t *)(piVar1 + 4) == 0x182bf38a0) {\r\n 0x1836dbf8a | piVar5 = *(int32_t **)(piVar1 + 0xc);\r\n 0x1836dbf91 | if (piVar5 != (int32_t *)0x0) {\r\n 0x1836dbfa5 | LOCK();\r\n 0x1836dbfa5 | *piVar5 = *piVar5 + -1;\r\n 0x1836dbfa5 | UNLOCK();\r\n 0x1836dbfa8 | if (*piVar5 == 0) {\r\n 0x1836dbfaf | func_0x0001841dcbe0(piVar5, 8);\r\n | }\r\n | }\r\n 0x1836dbf9b | func_0x0001841dcbe0(piVar1, 0x48);\r\n | } else {\r\n 0x1836dbe01 | (*(code *)0x185f59da0)(piVar1);\r\n | }\r\n | }\r\n | }\r\n 0x1836dbd69 | *(undefined4 *)(arg1 + 0x2d8) = (undefined4)var_98h;\r\n 0x1836dbd74 | *(undefined4 *)(arg1 + 0x2c8) = (undefined4)var_a8h;\r\n 0x1836dbd74 | *(undefined4 *)(arg1 + 0x2cc) = var_a8h._4_4_;\r\n 0x1836dbd74 | *(undefined4 *)(arg1 + 0x2d0) = (undefined4)uStack_a0;\r\n 0x1836dbd74 | *(undefined4 *)(arg1 + 0x2d4) = uStack_a0._4_4_;\r\n 0x1836dbd80 | *(int64_t *)(arg1 + 0x2e0) = var_90h;\r\n 0x1836dbd87 | *(int64_t *)(arg1 + 0x2f8) = iVar13;\r\n 0x1836dbcdc | func_0x00018477a0a0(arg1 + 0x2b8);\r\n 0x1836dbd9d | if (*(char *)(iVar11 + 0x131) == '\\x01') {\r\n 0x1836dbda2 | func_0x0001836dc0e0(arg1);\r\n | } else {\r\n 0x1836dbe0f | if (arg1 != 0) {\r\n 0x1836dbe16 | LOCK();\r\n 0x1836dbe16 | piVar1 = (int32_t *)(arg1 + 8);\r\n 0x1836dbe16 | iVar2 = *piVar1;\r\n 0x1836dbe16 | *piVar1 = *piVar1 + 1;\r\n 0x1836dbe16 | UNLOCK();\r\n 0x1836dbe20 | if (iVar2 == 0x7fffffff) {\r\n 0x1836dbfcb | pcVar6 = (code *)swi(3);\r\n 0x1836dbfcb | iVar11 = (*pcVar6)();\r\n 0x1836dbfcb | return iVar11;\r\n | }\r\n | }\r\n 0x1836dbe2b | var_b0h = func_0x000185f006b8(0x38);\r\n 0x1836dbe30 | *(undefined4 *)var_b0h = 1;\r\n 0x1836dbe3d | *(undefined8 *)(var_b0h + 8) = 0x18183fc50;\r\n 0x1836dbe48 | *(undefined8 *)(var_b0h + 0x10) = 0x18333c920;\r\n 0x1836dbe4c | *(undefined8 *)(var_b0h + 0x18) = 0x1841d75d0;\r\n 0x1836dbe57 | *(undefined8 *)(var_b0h + 0x20) = 0x1836dc0e0;\r\n 0x1836dbe5b | *(undefined4 *)(var_b0h + 0x28) = 0;\r\n 0x1836dbe62 | *(int64_t *)(var_b0h + 0x30) = arg1;\r\n 0x1836dbe71 | func_0x000189047c90(iVar11);\r\n | }\r\n 0x1836dbda9 | *(undefined *)arg2 = 0;\r\n 0x1836dbdab | *(undefined *)(arg2 + 0x10) = 0;\r\n | }\r\n 0x1836dbdc3 | if (*(uint64_t *)0x191c71040 == (var_48h ^ (uint64_t)auStack_e8)) {\r\n 0x1836dbddf | return arg2;\r\n | }\r\n 0x1836dbfbe | func_0x000185f05b40(var_48h ^ (uint64_t)auStack_e8);\r\n |code_r0x0001836dbfc6:\r\n 0x1836dbfc6 | pcVar6 = (code *)swi(3);\r\n 0x1836dbfc6 | iVar11 = (*pcVar6)();\r\n 0x1836dbfc6 | return iVar11;\r\n |}\r\n[{\"offset\":6499974000,\"name\":\"fcn.1836dbb70\",\"size\":1116,\"is-pure\":false,\"realsz\":1114,\"noreturn\":false,\"stackframe\":232,\"calltype\":\"ms\",\"cost\":299,\"cc\":23,\"loops\":8,\"bits\":64,\"type\":\"fcn\",\"nbbs\":36,\"edges\":51,\"ebbs\":4,\"signature\":\"fcn.1836dbb70(int64_t arg1, int64_t arg2, int64_t arg3, int64_t arg4, int64_t arg_28h, int64_t arg_48h);\",\"minbound\":6499974000,\"maxbound\":6499975116,\"callrefs\":[{\"from\":6499974173,\"to\":6464405264,\"type\":\"CALL\"},{\"from\":6499974255,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6499974284,\"to\":6499974293,\"type\":\"CODE\"},{\"from\":6499974376,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6499974477,\"to\":6512942288,\"type\":\"CALL\"},{\"from\":6499974545,\"to\":6517399712,\"type\":\"CALL\"},{\"from\":6499974562,\"to\":6499975392,\"type\":\"CALL\"},{\"from\":6499974657,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6499974663,\"to\":6499974501,\"type\":\"CODE\"},{\"from\":6499974699,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6499974769,\"to\":6593739920,\"type\":\"CALL\"},{\"from\":6499974774,\"to\":6499974567,\"type\":\"CODE\"},{\"from\":6499974860,\"to\":6587959616,\"type\":\"CALL\"},{\"from\":6499974905,\"to\":6587967968,\"type\":\"CALL\"},{\"from\":6499974918,\"to\":6499974574,\"type\":\"CODE\"},{\"from\":6499974928,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6499975045,\"to\":6499974854,\"type\":\"CODE\"},{\"from\":6499975067,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6499975072,\"to\":6499974501,\"type\":\"CODE\"},{\"from\":6499975087,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6499975092,\"to\":6499975059,\"type\":\"CODE\"},{\"from\":6499975105,\"to\":6542089024,\"type\":\"CALL\"}],\"datarefs\":[{\"from\":6499974035,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6499974226,\"to\":6489794112,\"type\":\"DATA\"},{\"from\":6499974390,\"to\":6467877968,\"type\":\"DATA\"},{\"from\":6499974402,\"to\":6496176416,\"type\":\"DATA\"},{\"from\":6499974414,\"to\":6511490512,\"type\":\"DATA\"},{\"from\":6499974426,\"to\":6499975120,\"type\":\"DATA\"},{\"from\":6499974452,\"to\":6723553808,\"type\":\"DATA\"},{\"from\":6499974459,\"to\":6723552192,\"type\":\"DATA\"},{\"from\":6499974585,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6499974638,\"to\":6488537248,\"type\":\"DATA\"},{\"from\":6499974710,\"to\":6467877968,\"type\":\"DATA\"},{\"from\":6499974721,\"to\":6496176416,\"type\":\"DATA\"},{\"from\":6499974736,\"to\":6499975392,\"type\":\"DATA\"},{\"from\":6499974791,\"to\":6722732536,\"type\":\"DATA\"},{\"from\":6499974823,\"to\":6722732541,\"type\":\"DATA\"},{\"from\":6499974839,\"to\":6722732536,\"type\":\"DATA\"},{\"from\":6499974876,\"to\":6587963136,\"type\":\"DATA\"},{\"from\":6499974898,\"to\":6545109024,\"type\":\"DATA\"},{\"from\":6499974979,\"to\":6723553760,\"type\":\"DATA\"},{\"from\":6499975004,\"to\":6723553789,\"type\":\"DATA\"},{\"from\":6499975015,\"to\":6723553776,\"type\":\"DATA\"},{\"from\":6499975026,\"to\":6723553760,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6499974284,\"to\":6499974293,\"type\":\"CODE\"},{\"from\":6499974663,\"to\":6499974501,\"type\":\"CODE\"},{\"from\":6499974774,\"to\":6499974567,\"type\":\"CODE\"},{\"from\":6499974918,\"to\":6499974574,\"type\":\"CODE\"},{\"from\":6499975045,\"to\":6499974854,\"type\":\"CODE\"},{\"from\":6499975072,\"to\":6499974501,\"type\":\"CODE\"},{\"from\":6499975092,\"to\":6499975059,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":7,\"outdegree\":15,\"nlocals\":14,\"nargs\":6,\"stackvars\":[{\"name\":\"var_c8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-200}},{\"name\":\"var_c0h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-192}},{\"name\":\"var_b0h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-176}},{\"name\":\"var_a8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-168}},{\"name\":\"var_98h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-152}},{\"name\":\"var_90h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-144}},{\"name\":\"var_88h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-136}},{\"name\":\"var_80h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-128}},{\"name\":\"var_78h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-120}},{\"name\":\"var_70h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-112}},{\"name\":\"var_63h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-99}},{\"name\":\"var_58h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-88}},{\"name\":\"var_50h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-80}},{\"name\":\"var_48h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-72}},{\"name\":\"arg_28h\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":40}},{\"name\":\"arg_48h\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":72}}],\"regvars\":[{\"name\":\"arg3\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"r8\"}},{\"name\":\"arg4\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"r9\"}},{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"confidence":"observed","authority":"shipped-artifact","environment":null,"limitations":["The executable version and supported formats are reported as unknown because no reliable version probe was performed.","A non-zero process exit is preserved as an observed command result.","Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.","When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call."],"relationship_coverage":null,"locations":[{"kind":"artifact-path","path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"}],"evidence_links":[]},"meta":{"command":"execute-rizin-command","duration":"4903ms"}}