{"ok":true,"data":{"evidence_id":"ev_84c08b3803f576087a07ea76e4e156473466971834bf377ae674615b674559a1","subject":{"name":"Tabbit.dll","digest":{"sha256":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c"},"local_path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","format":"unknown","architecture":null},"provider":{"id":"rizin","name":"Rizin","version":null},"analysis_profile":null,"predicate_type":"rea.reverse-engineering.command-observation","operation":"execute_rizin_command","parameters":{"path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","command":"e scr.color=0;af @ 0x1836dd870;pdgo @ 0x1836dd870;afij @ 0x1836dd870","provider_executable":"C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe","command_arguments":["-N","-q","-c","e scr.color=0;af @ 0x1836dd870;pdgo @ 0x1836dd870;afij @ 0x1836dd870","C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"]},"raw_result":{"stdout":" 0x1836dd870 |\r\n 0x1836dd870 |// WARNING: [rz-ghidra] Detected overlap for variable var_50h\r\n 0x1836dd870 |// WARNING: [rz-ghidra] Detected overlap for variable var_54h\r\n 0x1836dd870 |// WARNING: [rz-ghidra] Detected overlap for variable var_5ch\r\n 0x1836dd870 |// WARNING: [rz-ghidra] Detected overlap for variable var_9ch\r\n 0x1836dd870 |// WARNING: [rz-ghidra] Detected overlap for variable var_64h\r\n |\r\n 0x1836dd870 |int64_t fcn.1836dd870(int64_t arg1, int64_t arg2)\r\n |{\r\n | code *pcVar1;\r\n | int32_t iVar2;\r\n | undefined8 uVar3;\r\n | int64_t iVar4;\r\n | int32_t iVar5;\r\n | int64_t *piVar6;\r\n | bool bVar7;\r\n | undefined auStack_e8 [32];\r\n | int64_t var_c8h;\r\n | int64_t var_b8h;\r\n | int64_t var_b0h;\r\n | int64_t var_a8h;\r\n | int64_t var_a0h;\r\n | int64_t var_98h;\r\n | int64_t var_90h;\r\n | int64_t var_88h;\r\n | undefined4 uStack_80;\r\n | undefined4 uStack_7c;\r\n | undefined2 uStack_78;\r\n | int64_t var_76h;\r\n | int64_t var_68h;\r\n | int64_t var_60h;\r\n | int64_t var_58h;\r\n | undefined var_50h [4];\r\n | int64_t var_4ch;\r\n | int64_t var_38h;\r\n | int64_t var_28h;\r\n | int64_t var_20h;\r\n | \r\n 0x1836dd881 | var_20h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_e8;\r\n 0x1836dd890 | if (*(char *)(arg1 + 0x30) == '\\0') {\r\n |code_r0x0001836ddaee:\r\n 0x1836ddaee | // WARNING: Does not return\r\n 0x1836ddaee | pcVar1 = (code *)invalidInstructionException();\r\n 0x1836ddaee | (*pcVar1)();\r\n | }\r\n 0x1836dd8a7 | var_58h = 0;\r\n 0x1836dd8a7 | _var_50h = 0;\r\n 0x1836dd8ab | var_68h = 0;\r\n 0x1836dd8ab | var_60h = 0;\r\n 0x1836dd8ae | var_4ch._4_4_ = 0;\r\n 0x1836dd89f | func_0x0001839269f0(&var_68h);\r\n 0x1836dd8c5 | if ((var_4ch._4_4_ & 1) == 0) {\r\n 0x1836dd9c5 | var_76h._5_1_ = 0x12;\r\n 0x1836dd9e3 | if ((int64_t *)0x1905959d0 < &var_76h && &var_88h < (int64_t *)0x1905959d1) goto code_r0x0001836ddaee;\r\n 0x1836dd9f5 | uStack_78 = 0x7372;\r\n 0x1836dda01 | var_88h._0_4_ = 0x61766e49;\r\n 0x1836dda01 | var_88h._4_4_ = 0x2064696c;\r\n 0x1836dda01 | uStack_80 = 0x61726170;\r\n 0x1836dda01 | uStack_7c = 0x6574656d;\r\n 0x1836dda05 | var_76h._0_1_ = 0;\r\n 0x1836dda10 | func_0x000188ac4940(arg1, arg2);\r\n 0x1836dda27 | piVar6 = &var_a0h;\r\n 0x1836dda27 | var_38h = arg1;\r\n | } else {\r\n 0x1836dd8d5 | var_a0h = 0x2000000000;\r\n 0x1836dd8da | var_98h = 0x200000;\r\n 0x1836dd8e3 | var_90h = 30000000;\r\n 0x1836dd8f4 | if ((char)var_4ch == '\\x01') {\r\n 0x1836dd900 | iVar2 = 0;\r\n 0x1836dd900 | if ((char)var_60h == '\\x01') {\r\n 0x1836dd909 | var_a0h = CONCAT44(0x20, var_68h._4_4_);\r\n 0x1836dd909 | iVar2 = var_68h._4_4_;\r\n | }\r\n 0x1836dd91a | iVar5 = 0x20;\r\n 0x1836dd91a | if ((char)var_58h == '\\x01') {\r\n 0x1836dd923 | var_a0h = CONCAT44(var_60h._4_4_, (undefined4)var_a0h);\r\n 0x1836dd923 | iVar5 = var_60h._4_4_;\r\n | }\r\n 0x1836dd92f | if (var_50h[0] == '\\x01') {\r\n 0x1836dd935 | var_98h = (int64_t)var_58h._4_4_;\r\n 0x1836dd949 | bVar7 = var_98h - 0xa00001U < 0xffffffffff600000;\r\n | } else {\r\n 0x1836dd931 | bVar7 = false;\r\n | }\r\n | } else {\r\n 0x1836dd955 | bVar7 = false;\r\n 0x1836dd957 | iVar5 = 0x20;\r\n 0x1836dd95c | iVar2 = 0;\r\n | }\r\n 0x1836dd974 | if (((-1 < iVar2) && (0xffffff9b < iVar5 - 0x65U)) && (!bVar7)) {\r\n 0x1836dd982 | var_c8h._0_1_ = 0;\r\n 0x1836dd992 | func_0x0001836dbb70(arg1, arg2, var_68h & 0xffffffff, &var_a0h);\r\n 0x1836dd992 | goto code_r0x0001836dd997;\r\n | }\r\n 0x1836dda54 | var_b8h = func_0x000185f006b8(0x30);\r\n 0x1836dda5e | var_b0h = 0x27;\r\n 0x1836dda71 | var_a8h = -0x7fffffffffffffd0;\r\n 0x1836dda96 | if (((undefined4 *)(var_b8h + 0x27) < (uint64_t)var_b8h) ||\r\n 0x1836dda90 | ((undefined4 *)0x190c14ae0 < (undefined4 *)(var_b8h + 0x27) && (uint64_t)var_b8h < (undefined4 *)0x190c14ae1)\r\n 0x1836dda96 | ) goto code_r0x0001836ddaee;\r\n 0x1836dda9f | *(undefined8 *)(var_b8h + 0x10) = 0x7261207374696d69;\r\n 0x1836dda9f | *(undefined8 *)(var_b8h + 0x18) = 0x666f2074756f2065;\r\n 0x1836ddaaa | *(undefined4 *)var_b8h = 0x20464450;\r\n 0x1836ddaaa | *(undefined4 *)(var_b8h + 4) = 0x72747865;\r\n 0x1836ddaaa | *(undefined4 *)(var_b8h + 8) = 0x69746361;\r\n 0x1836ddaaa | *(undefined4 *)(var_b8h + 0xc) = 0x6c206e6f;\r\n 0x1836ddab7 | *(undefined8 *)(var_b8h + 0x1f) = 0x73646e756f622066;\r\n 0x1836ddabb | *(undefined *)(var_b8h + 0x27) = 0;\r\n 0x1836ddaca | func_0x000188ac4940(arg1, arg2, &var_b8h);\r\n 0x1836ddae1 | piVar6 = &var_38h;\r\n 0x1836ddae9 | var_28h = arg1;\r\n | }\r\n 0x1836dda2c | *piVar6 = 0x188ac5700;\r\n 0x1836dda2f | *(undefined4 *)(piVar6 + 1) = 0;\r\n 0x1836dda3d | uVar3 = func_0x000188ac69e0(0x1861e7020);\r\n 0x1836dda42 | *(undefined8 *)(arg2 + 8) = uVar3;\r\n 0x1836dda46 | *(undefined *)(arg2 + 0x10) = 1;\r\n |code_r0x0001836dd997:\r\n 0x1836dd9ac | if (*(uint64_t *)0x191c71040 == (var_20h ^ (uint64_t)auStack_e8)) {\r\n 0x1836dd9bf | return arg2;\r\n | }\r\n 0x1836ddaf8 | func_0x000185f05b40(var_20h ^ (uint64_t)auStack_e8);\r\n 0x1836ddb00 | pcVar1 = (code *)swi(3);\r\n 0x1836ddb00 | iVar4 = (*pcVar1)();\r\n 0x1836ddb00 | return iVar4;\r\n |}\r\n[{\"offset\":6499981424,\"name\":\"fcn.1836dd870\",\"size\":657,\"is-pure\":false,\"realsz\":657,\"noreturn\":false,\"stackframe\":232,\"calltype\":\"ms\",\"cost\":174,\"cc\":16,\"loops\":2,\"bits\":64,\"type\":\"fcn\",\"nbbs\":25,\"edges\":35,\"ebbs\":3,\"signature\":\"fcn.1836dd870(int64_t arg1, int64_t arg2);\",\"minbound\":6499981424,\"maxbound\":6499982081,\"callrefs\":[{\"from\":6499981500,\"to\":6502377968,\"type\":\"CALL\"},{\"from\":6499981619,\"to\":6499981662,\"type\":\"CODE\"},{\"from\":6499981651,\"to\":6499981662,\"type\":\"CODE\"},{\"from\":6499981714,\"to\":6499974000,\"type\":\"CALL\"},{\"from\":6499981840,\"to\":6587959616,\"type\":\"CALL\"},{\"from\":6499981885,\"to\":6587967968,\"type\":\"CALL\"},{\"from\":6499981898,\"to\":6499981719,\"type\":\"CODE\"},{\"from\":6499981908,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6499982026,\"to\":6587959616,\"type\":\"CALL\"},{\"from\":6499982057,\"to\":6499981868,\"type\":\"CODE\"},{\"from\":6499982075,\"to\":6542089024,\"type\":\"CALL\"}],\"datarefs\":[{\"from\":6499981434,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6499981730,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6499981769,\"to\":6716742096,\"type\":\"DATA\"},{\"from\":6499981801,\"to\":6716742112,\"type\":\"DATA\"},{\"from\":6499981818,\"to\":6716742096,\"type\":\"DATA\"},{\"from\":6499981856,\"to\":6587963136,\"type\":\"DATA\"},{\"from\":6499981878,\"to\":6545109024,\"type\":\"DATA\"},{\"from\":6499981951,\"to\":6723554016,\"type\":\"DATA\"},{\"from\":6499981976,\"to\":6723554032,\"type\":\"DATA\"},{\"from\":6499981987,\"to\":6723554016,\"type\":\"DATA\"},{\"from\":6499982042,\"to\":6587963136,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6499981619,\"to\":6499981662,\"type\":\"CODE\"},{\"from\":6499981651,\"to\":6499981662,\"type\":\"CODE\"},{\"from\":6499981898,\"to\":6499981719,\"type\":\"CODE\"},{\"from\":6499982057,\"to\":6499981868,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":4,\"outdegree\":7,\"nlocals\":21,\"nargs\":2,\"stackvars\":[{\"name\":\"var_c8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-200}},{\"name\":\"var_b8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-184}},{\"name\":\"var_b0h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-176}},{\"name\":\"var_a8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-168}},{\"name\":\"var_a0h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-160}},{\"name\":\"var_9ch\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-156}},{\"name\":\"var_98h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-152}},{\"name\":\"var_90h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-144}},{\"name\":\"var_88h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-136}},{\"name\":\"var_76h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-118}},{\"name\":\"var_68h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-104}},{\"name\":\"var_64h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-100}},{\"name\":\"var_60h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-96}},{\"name\":\"var_5ch\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-92}},{\"name\":\"var_58h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-88}},{\"name\":\"var_54h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-84}},{\"name\":\"var_50h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-80}},{\"name\":\"var_4ch\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-76}},{\"name\":\"var_38h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-56}},{\"name\":\"var_28h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-40}},{\"name\":\"var_20h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-32}}],\"regvars\":[{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"normalized_result":{"stdout":" 0x1836dd870 |\r\n 0x1836dd870 |// WARNING: [rz-ghidra] Detected overlap for variable var_50h\r\n 0x1836dd870 |// WARNING: [rz-ghidra] Detected overlap for variable var_54h\r\n 0x1836dd870 |// WARNING: [rz-ghidra] Detected overlap for variable var_5ch\r\n 0x1836dd870 |// WARNING: [rz-ghidra] Detected overlap for variable var_9ch\r\n 0x1836dd870 |// WARNING: [rz-ghidra] Detected overlap for variable var_64h\r\n |\r\n 0x1836dd870 |int64_t fcn.1836dd870(int64_t arg1, int64_t arg2)\r\n |{\r\n | code *pcVar1;\r\n | int32_t iVar2;\r\n | undefined8 uVar3;\r\n | int64_t iVar4;\r\n | int32_t iVar5;\r\n | int64_t *piVar6;\r\n | bool bVar7;\r\n | undefined auStack_e8 [32];\r\n | int64_t var_c8h;\r\n | int64_t var_b8h;\r\n | int64_t var_b0h;\r\n | int64_t var_a8h;\r\n | int64_t var_a0h;\r\n | int64_t var_98h;\r\n | int64_t var_90h;\r\n | int64_t var_88h;\r\n | undefined4 uStack_80;\r\n | undefined4 uStack_7c;\r\n | undefined2 uStack_78;\r\n | int64_t var_76h;\r\n | int64_t var_68h;\r\n | int64_t var_60h;\r\n | int64_t var_58h;\r\n | undefined var_50h [4];\r\n | int64_t var_4ch;\r\n | int64_t var_38h;\r\n | int64_t var_28h;\r\n | int64_t var_20h;\r\n | \r\n 0x1836dd881 | var_20h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_e8;\r\n 0x1836dd890 | if (*(char *)(arg1 + 0x30) == '\\0') {\r\n |code_r0x0001836ddaee:\r\n 0x1836ddaee | // WARNING: Does not return\r\n 0x1836ddaee | pcVar1 = (code *)invalidInstructionException();\r\n 0x1836ddaee | (*pcVar1)();\r\n | }\r\n 0x1836dd8a7 | var_58h = 0;\r\n 0x1836dd8a7 | _var_50h = 0;\r\n 0x1836dd8ab | var_68h = 0;\r\n 0x1836dd8ab | var_60h = 0;\r\n 0x1836dd8ae | var_4ch._4_4_ = 0;\r\n 0x1836dd89f | func_0x0001839269f0(&var_68h);\r\n 0x1836dd8c5 | if ((var_4ch._4_4_ & 1) == 0) {\r\n 0x1836dd9c5 | var_76h._5_1_ = 0x12;\r\n 0x1836dd9e3 | if ((int64_t *)0x1905959d0 < &var_76h && &var_88h < (int64_t *)0x1905959d1) goto code_r0x0001836ddaee;\r\n 0x1836dd9f5 | uStack_78 = 0x7372;\r\n 0x1836dda01 | var_88h._0_4_ = 0x61766e49;\r\n 0x1836dda01 | var_88h._4_4_ = 0x2064696c;\r\n 0x1836dda01 | uStack_80 = 0x61726170;\r\n 0x1836dda01 | uStack_7c = 0x6574656d;\r\n 0x1836dda05 | var_76h._0_1_ = 0;\r\n 0x1836dda10 | func_0x000188ac4940(arg1, arg2);\r\n 0x1836dda27 | piVar6 = &var_a0h;\r\n 0x1836dda27 | var_38h = arg1;\r\n | } else {\r\n 0x1836dd8d5 | var_a0h = 0x2000000000;\r\n 0x1836dd8da | var_98h = 0x200000;\r\n 0x1836dd8e3 | var_90h = 30000000;\r\n 0x1836dd8f4 | if ((char)var_4ch == '\\x01') {\r\n 0x1836dd900 | iVar2 = 0;\r\n 0x1836dd900 | if ((char)var_60h == '\\x01') {\r\n 0x1836dd909 | var_a0h = CONCAT44(0x20, var_68h._4_4_);\r\n 0x1836dd909 | iVar2 = var_68h._4_4_;\r\n | }\r\n 0x1836dd91a | iVar5 = 0x20;\r\n 0x1836dd91a | if ((char)var_58h == '\\x01') {\r\n 0x1836dd923 | var_a0h = CONCAT44(var_60h._4_4_, (undefined4)var_a0h);\r\n 0x1836dd923 | iVar5 = var_60h._4_4_;\r\n | }\r\n 0x1836dd92f | if (var_50h[0] == '\\x01') {\r\n 0x1836dd935 | var_98h = (int64_t)var_58h._4_4_;\r\n 0x1836dd949 | bVar7 = var_98h - 0xa00001U < 0xffffffffff600000;\r\n | } else {\r\n 0x1836dd931 | bVar7 = false;\r\n | }\r\n | } else {\r\n 0x1836dd955 | bVar7 = false;\r\n 0x1836dd957 | iVar5 = 0x20;\r\n 0x1836dd95c | iVar2 = 0;\r\n | }\r\n 0x1836dd974 | if (((-1 < iVar2) && (0xffffff9b < iVar5 - 0x65U)) && (!bVar7)) {\r\n 0x1836dd982 | var_c8h._0_1_ = 0;\r\n 0x1836dd992 | func_0x0001836dbb70(arg1, arg2, var_68h & 0xffffffff, &var_a0h);\r\n 0x1836dd992 | goto code_r0x0001836dd997;\r\n | }\r\n 0x1836dda54 | var_b8h = func_0x000185f006b8(0x30);\r\n 0x1836dda5e | var_b0h = 0x27;\r\n 0x1836dda71 | var_a8h = -0x7fffffffffffffd0;\r\n 0x1836dda96 | if (((undefined4 *)(var_b8h + 0x27) < (uint64_t)var_b8h) ||\r\n 0x1836dda90 | ((undefined4 *)0x190c14ae0 < (undefined4 *)(var_b8h + 0x27) && (uint64_t)var_b8h < (undefined4 *)0x190c14ae1)\r\n 0x1836dda96 | ) goto code_r0x0001836ddaee;\r\n 0x1836dda9f | *(undefined8 *)(var_b8h + 0x10) = 0x7261207374696d69;\r\n 0x1836dda9f | *(undefined8 *)(var_b8h + 0x18) = 0x666f2074756f2065;\r\n 0x1836ddaaa | *(undefined4 *)var_b8h = 0x20464450;\r\n 0x1836ddaaa | *(undefined4 *)(var_b8h + 4) = 0x72747865;\r\n 0x1836ddaaa | *(undefined4 *)(var_b8h + 8) = 0x69746361;\r\n 0x1836ddaaa | *(undefined4 *)(var_b8h + 0xc) = 0x6c206e6f;\r\n 0x1836ddab7 | *(undefined8 *)(var_b8h + 0x1f) = 0x73646e756f622066;\r\n 0x1836ddabb | *(undefined *)(var_b8h + 0x27) = 0;\r\n 0x1836ddaca | func_0x000188ac4940(arg1, arg2, &var_b8h);\r\n 0x1836ddae1 | piVar6 = &var_38h;\r\n 0x1836ddae9 | var_28h = arg1;\r\n | }\r\n 0x1836dda2c | *piVar6 = 0x188ac5700;\r\n 0x1836dda2f | *(undefined4 *)(piVar6 + 1) = 0;\r\n 0x1836dda3d | uVar3 = func_0x000188ac69e0(0x1861e7020);\r\n 0x1836dda42 | *(undefined8 *)(arg2 + 8) = uVar3;\r\n 0x1836dda46 | *(undefined *)(arg2 + 0x10) = 1;\r\n |code_r0x0001836dd997:\r\n 0x1836dd9ac | if (*(uint64_t *)0x191c71040 == (var_20h ^ (uint64_t)auStack_e8)) {\r\n 0x1836dd9bf | return arg2;\r\n | }\r\n 0x1836ddaf8 | func_0x000185f05b40(var_20h ^ (uint64_t)auStack_e8);\r\n 0x1836ddb00 | pcVar1 = (code *)swi(3);\r\n 0x1836ddb00 | iVar4 = (*pcVar1)();\r\n 0x1836ddb00 | return iVar4;\r\n |}\r\n[{\"offset\":6499981424,\"name\":\"fcn.1836dd870\",\"size\":657,\"is-pure\":false,\"realsz\":657,\"noreturn\":false,\"stackframe\":232,\"calltype\":\"ms\",\"cost\":174,\"cc\":16,\"loops\":2,\"bits\":64,\"type\":\"fcn\",\"nbbs\":25,\"edges\":35,\"ebbs\":3,\"signature\":\"fcn.1836dd870(int64_t arg1, int64_t arg2);\",\"minbound\":6499981424,\"maxbound\":6499982081,\"callrefs\":[{\"from\":6499981500,\"to\":6502377968,\"type\":\"CALL\"},{\"from\":6499981619,\"to\":6499981662,\"type\":\"CODE\"},{\"from\":6499981651,\"to\":6499981662,\"type\":\"CODE\"},{\"from\":6499981714,\"to\":6499974000,\"type\":\"CALL\"},{\"from\":6499981840,\"to\":6587959616,\"type\":\"CALL\"},{\"from\":6499981885,\"to\":6587967968,\"type\":\"CALL\"},{\"from\":6499981898,\"to\":6499981719,\"type\":\"CODE\"},{\"from\":6499981908,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6499982026,\"to\":6587959616,\"type\":\"CALL\"},{\"from\":6499982057,\"to\":6499981868,\"type\":\"CODE\"},{\"from\":6499982075,\"to\":6542089024,\"type\":\"CALL\"}],\"datarefs\":[{\"from\":6499981434,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6499981730,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6499981769,\"to\":6716742096,\"type\":\"DATA\"},{\"from\":6499981801,\"to\":6716742112,\"type\":\"DATA\"},{\"from\":6499981818,\"to\":6716742096,\"type\":\"DATA\"},{\"from\":6499981856,\"to\":6587963136,\"type\":\"DATA\"},{\"from\":6499981878,\"to\":6545109024,\"type\":\"DATA\"},{\"from\":6499981951,\"to\":6723554016,\"type\":\"DATA\"},{\"from\":6499981976,\"to\":6723554032,\"type\":\"DATA\"},{\"from\":6499981987,\"to\":6723554016,\"type\":\"DATA\"},{\"from\":6499982042,\"to\":6587963136,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6499981619,\"to\":6499981662,\"type\":\"CODE\"},{\"from\":6499981651,\"to\":6499981662,\"type\":\"CODE\"},{\"from\":6499981898,\"to\":6499981719,\"type\":\"CODE\"},{\"from\":6499982057,\"to\":6499981868,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":4,\"outdegree\":7,\"nlocals\":21,\"nargs\":2,\"stackvars\":[{\"name\":\"var_c8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-200}},{\"name\":\"var_b8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-184}},{\"name\":\"var_b0h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-176}},{\"name\":\"var_a8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-168}},{\"name\":\"var_a0h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-160}},{\"name\":\"var_9ch\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-156}},{\"name\":\"var_98h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-152}},{\"name\":\"var_90h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-144}},{\"name\":\"var_88h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-136}},{\"name\":\"var_76h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-118}},{\"name\":\"var_68h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-104}},{\"name\":\"var_64h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-100}},{\"name\":\"var_60h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-96}},{\"name\":\"var_5ch\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-92}},{\"name\":\"var_58h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-88}},{\"name\":\"var_54h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-84}},{\"name\":\"var_50h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-80}},{\"name\":\"var_4ch\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-76}},{\"name\":\"var_38h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-56}},{\"name\":\"var_28h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-40}},{\"name\":\"var_20h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-32}}],\"regvars\":[{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"confidence":"observed","authority":"shipped-artifact","environment":null,"limitations":["The executable version and supported formats are reported as unknown because no reliable version probe was performed.","A non-zero process exit is preserved as an observed command result.","Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.","When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call."],"relationship_coverage":null,"locations":[{"kind":"artifact-path","path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"}],"evidence_links":[]},"meta":{"command":"execute-rizin-command","duration":"4933ms"}}