{"ok":true,"data":{"evidence_id":"ev_fff0bffa3a3b97dcc393e24e81cd97928f243a3ad8179c4308c08df8f452a128","subject":{"name":"Tabbit.dll","digest":{"sha256":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c"},"local_path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","format":"unknown","architecture":null},"provider":{"id":"rizin","name":"Rizin","version":null},"analysis_profile":null,"predicate_type":"rea.reverse-engineering.command-observation","operation":"execute_rizin_command","parameters":{"path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","command":"e scr.color=0;af @ 0x1836f0b70;pdgo @ 0x1836f0b70;afij @ 0x1836f0b70","provider_executable":"C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe","command_arguments":["-N","-q","-c","e scr.color=0;af @ 0x1836f0b70;pdgo @ 0x1836f0b70;afij @ 0x1836f0b70","C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"]},"raw_result":{"stdout":"    0x1836f0b70    |\r\n    0x1836f0b70    |// WARNING: [rz-ghidra] Detected overlap for variable var_60h\r\n    0x1836f0b70    |// WARNING: [rz-ghidra] Detected overlap for variable var_b9h\r\n                   |\r\n    0x1836f0b70    |int64_t fcn.1836f0b70(int64_t arg1, int64_t arg2, int64_t arg_a8h)\r\n                   |{\r\n                   |    int32_t *piVar1;\r\n                   |    int64_t iVar2;\r\n                   |    int32_t iVar3;\r\n                   |    code *pcVar4;\r\n                   |    char cVar5;\r\n                   |    int64_t iVar6;\r\n                   |    int32_t *piVar7;\r\n                   |    undefined8 uVar8;\r\n                   |    int64_t iVar9;\r\n                   |    int64_t *piVar10;\r\n                   |    int64_t unaff_GS_OFFSET;\r\n                   |    undefined auStack_f8 [32];\r\n                   |    int64_t var_d8h;\r\n                   |    int64_t var_d0h;\r\n                   |    int64_t var_c8h;\r\n                   |    undefined var_b9h;\r\n                   |    int64_t var_b8h;\r\n                   |    int64_t var_b0h;\r\n                   |    int64_t var_a8h;\r\n                   |    int64_t var_a0h;\r\n                   |    int64_t var_98h;\r\n                   |    undefined4 uStack_90;\r\n                   |    undefined4 uStack_8c;\r\n                   |    unkbyte5 Stack_88;\r\n                   |    int64_t var_83h;\r\n                   |    int64_t var_78h;\r\n                   |    int64_t var_70h;\r\n                   |    undefined8 uStack_68;\r\n                   |    undefined var_60h [7];\r\n                   |    int64_t var_59h;\r\n                   |    int64_t var_50h;\r\n                   |    int64_t var_48h;\r\n                   |    uint64_t uStack_40;\r\n                   |    int64_t var_38h;\r\n                   |    int64_t var_30h;\r\n                   |    \r\n    0x1836f0b85    |    var_30h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_f8;\r\n    0x1836f0b94    |    if (*(char *)(arg1 + 0x30) == '\\0') goto code_r0x0001836f0fa2;\r\n    0x1836f0bab    |    stack0xffffffffffffffa8 = 0;\r\n    0x1836f0bab    |    var_50h = 0;\r\n    0x1836f0baf    |    uStack_68 = 0;\r\n    0x1836f0baf    |    _var_60h = 0;\r\n    0x1836f0bb3    |    var_78h = 0;\r\n    0x1836f0bb3    |    var_70h = 0;\r\n    0x1836f0ba3    |    func_0x000183922ba0(&var_78h, arg1 + 0x18);\r\n    0x1836f0bc9    |    if ((char)var_50h == '\\0') {\r\n    0x1836f0d56    |        func_0x000188ac4df0(arg1);\r\n    0x1836f0d61    |        func_0x000188ac4b60(arg2, arg1);\r\n                   |    } else {\r\n    0x1836f0bcf    |        iVar6 = *(int64_t *)(arg1 + 0x1d0);\r\n    0x1836f0be5    |        if ((iVar6 == 0) && (iVar6 = *(int64_t *)(arg1 + 0x1c8), iVar6 == 0)) {\r\n    0x1836f0f27    |            var_83h._2_1_ = 0x15;\r\n    0x1836f0f45    |            if ((int64_t *)0x190b80810 < &var_83h && &var_98h < (int64_t *)0x190b80811) {\r\n                   |code_r0x0001836f0fa2:\r\n    0x1836f0fa2    |    // WARNING: Does not return\r\n    0x1836f0fa2    |                pcVar4 = (code *)invalidInstructionException();\r\n    0x1836f0fa2    |                (*pcVar4)();\r\n                   |            }\r\n    0x1836f0f4e    |            piVar10 = &var_98h;\r\n    0x1836f0f53    |            Stack_88 = 0x656c62616c;\r\n    0x1836f0f57    |            var_98h._0_4_ = 0x666f7250;\r\n    0x1836f0f57    |            var_98h._4_4_ = 0x20656c69;\r\n    0x1836f0f57    |            uStack_90 = 0x20746f6e;\r\n    0x1836f0f57    |            uStack_8c = 0x69617661;\r\n    0x1836f0f62    |            var_83h._0_1_ = 0;\r\n                   |        } else {\r\n    0x1836f0beb    |            var_a0h = 0;\r\n    0x1836f0bf8    |            if (*(char *)(arg1 + 0x30) == '\\0') goto code_r0x0001836f0fa2;\r\n    0x1836f0c06    |            cVar5 = func_0x0001836f0fc0(arg1 + 0x18, &var_a0h);\r\n    0x1836f0c0d    |            if (cVar5 != '\\0') {\r\n    0x1836f0f7f    |                if ((*(int32_t *)\r\n    0x1836f0c28    |                      (*(int64_t *)(*(int64_t *)(unaff_GS_OFFSET + 0x58) + (uint64_t)*(uint32_t *)0x191d832e0 * 8) + 4)\r\n    0x1836f0c32    |                     < *(int32_t *)0x191dd0600) && (func_0x000185f00fe8(0x191dd0600), *(int32_t *)0x191dd0600 == -1)) {\r\n    0x1836f0f8c    |                    func_0x00018237cf50(0x191dd05c8);\r\n    0x1836f0f98    |                    func_0x000185f00f7c(0x191dd0600);\r\n                   |                }\r\n    0x1836f0c45    |                iVar6 = func_0x000184300b20(0x191dd05c8, iVar6, 1);\r\n    0x1836f0c4d    |                if (iVar6 != 0) {\r\n    0x1836f0c5b    |                    piVar7 = (int32_t *)func_0x000185f006b8(0x38);\r\n    0x1836f0c60    |                    *piVar7 = 1;\r\n    0x1836f0c6d    |                    piVar7[2] = -0x7e411b70;\r\n    0x1836f0c6d    |                    piVar7[3] = 1;\r\n    0x1836f0c78    |                    piVar7[4] = -0x7ccc36e0;\r\n    0x1836f0c78    |                    piVar7[5] = 1;\r\n    0x1836f0c83    |                    piVar7[6] = -0x7be28a30;\r\n    0x1836f0c83    |                    piVar7[7] = 1;\r\n    0x1836f0c8e    |                    piVar7[8] = -0x756e7580;\r\n    0x1836f0c8e    |                    piVar7[9] = 1;\r\n    0x1836f0c92    |                    piVar7[10] = 0;\r\n    0x1836f0c99    |                    *(int64_t *)(piVar7 + 0xc) = arg1;\r\n    0x1836f0ca0    |                    if (arg1 != 0) {\r\n    0x1836f0ca7    |                        LOCK();\r\n    0x1836f0ca7    |                        piVar1 = (int32_t *)(arg1 + 8);\r\n    0x1836f0ca7    |                        iVar3 = *piVar1;\r\n    0x1836f0ca7    |                        *piVar1 = *piVar1 + 1;\r\n    0x1836f0ca7    |                        UNLOCK();\r\n    0x1836f0cb2    |                        if (iVar3 == 0x7fffffff) goto code_r0x0001836f0fb4;\r\n                   |                    }\r\n    0x1836f0cc2    |                    if (*(int64_t *)(iVar6 + 0xf8) == 0) {\r\n    0x1836f0d6b    |                        if (piVar7 != (int32_t *)0x0) {\r\n    0x1836f0d6d    |                            LOCK();\r\n    0x1836f0d6d    |                            *piVar7 = *piVar7 + -1;\r\n    0x1836f0d6d    |                            UNLOCK();\r\n    0x1836f0d70    |                            if (*piVar7 == 0) {\r\n    0x1836f0d7c    |                                (*(code *)0x185f59da0)(piVar7, *(undefined8 *)(piVar7 + 4));\r\n                   |                            }\r\n                   |                        }\r\n                   |                    } else {\r\n    0x1836f0cd5    |                        var_d8h = (int64_t)piVar7;\r\n    0x1836f0cd5    |                        cVar5 = func_0x0001834ac3d0(*(int64_t *)(iVar6 + 0xf8), var_a0h);\r\n    0x1836f0cdc    |                        if (cVar5 != '\\0') {\r\n    0x1836f0ce4    |                            *(undefined *)arg2 = 0;\r\n    0x1836f0ce6    |                            *(undefined *)(arg2 + 0x10) = 0;\r\n    0x1836f0ce6    |                            goto code_r0x0001836f0ce9;\r\n                   |                        }\r\n                   |                    }\r\n                   |                }\r\n    0x1836f0d8a    |                var_d8h = 0;\r\n    0x1836f0d8a    |                var_d0h = 0;\r\n    0x1836f0d8d    |                var_c8h = 0;\r\n    0x1836f0da4    |                var_48h = 0x190186c60;\r\n    0x1836f0da7    |                uStack_40 = 7;\r\n    0x1836f0d85    |                func_0x0001802e59f0(&var_d8h, &var_48h, 0);\r\n    0x1836f0dcb    |                func_0x000188b4faf0(arg1, &var_b9h, &var_d8h);\r\n    0x1836f0de2    |                var_48h = 0x188ac5700;\r\n    0x1836f0de5    |                uStack_40 = uStack_40 & 0xffffffff00000000;\r\n    0x1836f0dfc    |                var_38h = arg1;\r\n    0x1836f0dfc    |                uVar8 = func_0x000188ac69e0(0x1861e7020, &var_48h);\r\n    0x1836f0dfc    |                iVar6 = var_d8h;\r\n    0x1836f0e04    |                *(undefined *)arg2 = var_b9h;\r\n    0x1836f0e06    |                *(undefined8 *)(arg2 + 8) = uVar8;\r\n    0x1836f0e0a    |                *(undefined *)(arg2 + 0x10) = 1;\r\n    0x1836f0e14    |                if (var_d8h != 0) {\r\n    0x1836f0e1f    |                    iVar9 = var_d0h << 5;\r\n    0x1836f0e26    |                    if (iVar9 != 0) {\r\n    0x1836f0e28    |                        iVar2 = var_d8h + -0x20;\r\n                   |                        do {\r\n    0x1836f0e2c    |                            func_0x000184e58cd0(iVar2 + iVar9);\r\n    0x1836f0e35    |                            iVar9 = iVar9 + -0x20;\r\n    0x1836f0e39    |                        } while (iVar9 != 0);\r\n                   |                    }\r\n    0x1836f0e43    |                    var_d0h = iVar6 - var_d8h >> 5;\r\n    0x1836f0e55    |                    func_0x0001841dcbe0(var_d8h, var_c8h << 5);\r\n                   |                }\r\n                   |                goto code_r0x0001836f0ce9;\r\n                   |            }\r\n    0x1836f0e64    |            var_b8h = func_0x000185f006b8(0x30);\r\n    0x1836f0e6e    |            var_b0h = 0x2e;\r\n    0x1836f0e85    |            var_a8h = -0x7fffffffffffffd0;\r\n    0x1836f0eae    |            if (((undefined4 *)(var_b8h + 0x2e) < (uint64_t)var_b8h) ||\r\n    0x1836f0ea8    |               ((undefined4 *)0x190c16c50 < (undefined4 *)(var_b8h + 0x2e) &&\r\n    0x1836f0ea1    |                (uint64_t)var_b8h < (undefined4 *)0x190c16c51)) goto code_r0x0001836f0fa2;\r\n    0x1836f0ebb    |            *(undefined8 *)(var_b8h + 0x1e) = 0x66656c202c6e776f;\r\n    0x1836f0ebb    |            *(undefined8 *)(var_b8h + 0x26) = 0x7468676972202c74;\r\n    0x1836f0ec6    |            *(undefined8 *)(var_b8h + 0x10) = 0x666f20656e6f2065;\r\n    0x1836f0ec6    |            *(undefined8 *)(var_b8h + 0x18) = 0x776f64202c707520;\r\n    0x1836f0ed1    |            *(undefined4 *)var_b8h = 0x65726964;\r\n    0x1836f0ed1    |            *(undefined4 *)(var_b8h + 4) = 0x6f697463;\r\n    0x1836f0ed1    |            *(undefined4 *)(var_b8h + 8) = 0x756d206e;\r\n    0x1836f0ed1    |            *(undefined4 *)(var_b8h + 0xc) = 0x62207473;\r\n    0x1836f0ed4    |            *(undefined *)(var_b8h + 0x2e) = 0;\r\n    0x1836f0ed8    |            piVar10 = &var_b8h;\r\n                   |        }\r\n    0x1836f0ee3    |        func_0x000188ac4940(arg1, arg2, piVar10);\r\n    0x1836f0eff    |        var_d8h = 0x188ac5700;\r\n    0x1836f0f02    |        var_d0h = (uint64_t)var_d0h._4_4_ << 0x20;\r\n    0x1836f0f10    |        var_48h = arg1;\r\n    0x1836f0f10    |        uVar8 = func_0x000188ac69e0(0x1861e7020);\r\n    0x1836f0f15    |        *(undefined8 *)(arg2 + 8) = uVar8;\r\n    0x1836f0f19    |        *(undefined *)(arg2 + 0x10) = 1;\r\n                   |    }\r\n                   |code_r0x0001836f0ce9:\r\n    0x1836f0d05    |    if ((((char)var_50h == '\\x01') && (var_59h._1_1_ == '\\x01')) && ((int64_t)_var_60h < 0)) {\r\n    0x1836f0d21    |        func_0x0001841dcbe0(var_70h, _var_60h & 0x7fffffffffffffff);\r\n                   |    }\r\n    0x1836f0d3b    |    if (*(uint64_t *)0x191c71040 == (var_30h ^ (uint64_t)auStack_f8)) {\r\n    0x1836f0d52    |        return arg2;\r\n                   |    }\r\n    0x1836f0fac    |    func_0x000185f05b40(var_30h ^ (uint64_t)auStack_f8);\r\n                   |code_r0x0001836f0fb4:\r\n    0x1836f0fb4    |    pcVar4 = (code *)swi(3);\r\n    0x1836f0fb4    |    iVar6 = (*pcVar4)();\r\n    0x1836f0fb4    |    return iVar6;\r\n                   |}\r\n[{\"offset\":6500060016,\"name\":\"fcn.1836f0b70\",\"size\":1093,\"is-pure\":false,\"realsz\":1093,\"noreturn\":false,\"stackframe\":248,\"calltype\":\"ms\",\"cost\":313,\"cc\":28,\"loops\":7,\"bits\":64,\"type\":\"fcn\",\"nbbs\":40,\"edges\":62,\"ebbs\":3,\"signature\":\"fcn.1836f0b70(int64_t arg1, int64_t arg2, int64_t arg_a8h);\",\"minbound\":6500060016,\"maxbound\":6500061109,\"callrefs\":[{\"from\":6500060096,\"to\":6502362016,\"type\":\"CALL\"},{\"from\":6500060166,\"to\":6500061120,\"type\":\"CALL\"},{\"from\":6500060229,\"to\":6512708384,\"type\":\"CALL\"},{\"from\":6500060251,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6500060373,\"to\":6497682384,\"type\":\"CALL\"},{\"from\":6500060449,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6500060502,\"to\":6587960816,\"type\":\"CALL\"},{\"from\":6500060513,\"to\":6587960160,\"type\":\"CALL\"},{\"from\":6500060518,\"to\":6500060393,\"type\":\"CODE\"},{\"from\":6500060540,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6500060600,\"to\":6445488624,\"type\":\"CALL\"},{\"from\":6500060619,\"to\":6588529392,\"type\":\"CALL\"},{\"from\":6500060668,\"to\":6587967968,\"type\":\"CALL\"},{\"from\":6500060720,\"to\":6524603600,\"type\":\"CALL\"},{\"from\":6500060757,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6500060762,\"to\":6500060393,\"type\":\"CODE\"},{\"from\":6500060772,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6500060899,\"to\":6587959616,\"type\":\"CALL\"},{\"from\":6500060944,\"to\":6587967968,\"type\":\"CALL\"},{\"from\":6500060957,\"to\":6500060393,\"type\":\"CODE\"},{\"from\":6500061031,\"to\":6500060893,\"type\":\"CODE\"},{\"from\":6500061043,\"to\":6542069736,\"type\":\"CALL\"},{\"from\":6500061068,\"to\":6479662928,\"type\":\"CALL\"},{\"from\":6500061080,\"to\":6542069628,\"type\":\"CALL\"},{\"from\":6500061085,\"to\":6500060216,\"type\":\"CODE\"},{\"from\":6500061103,\"to\":6542089024,\"type\":\"CALL\"}],\"datarefs\":[{\"from\":6500060030,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6500060179,\"to\":6742148608,\"type\":\"DATA\"},{\"from\":6500060185,\"to\":6741832416,\"type\":\"DATA\"},{\"from\":6500060216,\"to\":6742148552,\"type\":\"DATA\"},{\"from\":6500060262,\"to\":6471738512,\"type\":\"DATA\"},{\"from\":6500060273,\"to\":6496176416,\"type\":\"DATA\"},{\"from\":6500060284,\"to\":6511490512,\"type\":\"DATA\"},{\"from\":6500060295,\"to\":6619761280,\"type\":\"DATA\"},{\"from\":6500060465,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6500060565,\"to\":6712487008,\"type\":\"DATA\"},{\"from\":6500060635,\"to\":6587963136,\"type\":\"DATA\"},{\"from\":6500060653,\"to\":6545109024,\"type\":\"DATA\"},{\"from\":6500060823,\"to\":6723562576,\"type\":\"DATA\"},{\"from\":6500060852,\"to\":6723562606,\"type\":\"DATA\"},{\"from\":6500060863,\"to\":6723562592,\"type\":\"DATA\"},{\"from\":6500060874,\"to\":6723562576,\"type\":\"DATA\"},{\"from\":6500060915,\"to\":6587963136,\"type\":\"DATA\"},{\"from\":6500060937,\"to\":6545109024,\"type\":\"DATA\"},{\"from\":6500060971,\"to\":6722947088,\"type\":\"DATA\"},{\"from\":6500060999,\"to\":6722947101,\"type\":\"DATA\"},{\"from\":6500061015,\"to\":6722947088,\"type\":\"DATA\"},{\"from\":6500061036,\"to\":6742148608,\"type\":\"DATA\"},{\"from\":6500061048,\"to\":6742148608,\"type\":\"DATA\"},{\"from\":6500061061,\"to\":6742148552,\"type\":\"DATA\"},{\"from\":6500061073,\"to\":6742148608,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6500060518,\"to\":6500060393,\"type\":\"CODE\"},{\"from\":6500060762,\"to\":6500060393,\"type\":\"CODE\"},{\"from\":6500060957,\"to\":6500060393,\"type\":\"CODE\"},{\"from\":6500061031,\"to\":6500060893,\"type\":\"CODE\"},{\"from\":6500061085,\"to\":6500060216,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":5,\"outdegree\":21,\"nlocals\":18,\"nargs\":3,\"stackvars\":[{\"name\":\"var_d8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-216}},{\"name\":\"var_d0h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-208}},{\"name\":\"var_c8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-200}},{\"name\":\"var_b9h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-185}},{\"name\":\"var_b8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-184}},{\"name\":\"var_b0h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-176}},{\"name\":\"var_a8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-168}},{\"name\":\"var_a0h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-160}},{\"name\":\"var_98h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-152}},{\"name\":\"var_83h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-131}},{\"name\":\"var_78h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-120}},{\"name\":\"var_70h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-112}},{\"name\":\"var_60h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-96}},{\"name\":\"var_59h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-89}},{\"name\":\"var_50h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-80}},{\"name\":\"var_48h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-72}},{\"name\":\"var_38h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-56}},{\"name\":\"var_30h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-48}},{\"name\":\"arg_a8h\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":168}}],\"regvars\":[{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"normalized_result":{"stdout":"    0x1836f0b70    |\r\n    0x1836f0b70    |// WARNING: [rz-ghidra] Detected overlap for variable var_60h\r\n    0x1836f0b70    |// WARNING: [rz-ghidra] Detected overlap for variable var_b9h\r\n                   |\r\n    0x1836f0b70    |int64_t fcn.1836f0b70(int64_t arg1, int64_t arg2, int64_t arg_a8h)\r\n                   |{\r\n                   |    int32_t *piVar1;\r\n                   |    int64_t iVar2;\r\n                   |    int32_t iVar3;\r\n                   |    code *pcVar4;\r\n                   |    char cVar5;\r\n                   |    int64_t iVar6;\r\n                   |    int32_t *piVar7;\r\n                   |    undefined8 uVar8;\r\n                   |    int64_t iVar9;\r\n                   |    int64_t *piVar10;\r\n                   |    int64_t unaff_GS_OFFSET;\r\n                   |    undefined auStack_f8 [32];\r\n                   |    int64_t var_d8h;\r\n                   |    int64_t var_d0h;\r\n                   |    int64_t var_c8h;\r\n                   |    undefined var_b9h;\r\n                   |    int64_t var_b8h;\r\n                   |    int64_t var_b0h;\r\n                   |    int64_t var_a8h;\r\n                   |    int64_t var_a0h;\r\n                   |    int64_t var_98h;\r\n                   |    undefined4 uStack_90;\r\n                   |    undefined4 uStack_8c;\r\n                   |    unkbyte5 Stack_88;\r\n                   |    int64_t var_83h;\r\n                   |    int64_t var_78h;\r\n                   |    int64_t var_70h;\r\n                   |    undefined8 uStack_68;\r\n                   |    undefined var_60h [7];\r\n                   |    int64_t var_59h;\r\n                   |    int64_t var_50h;\r\n                   |    int64_t var_48h;\r\n                   |    uint64_t uStack_40;\r\n                   |    int64_t var_38h;\r\n                   |    int64_t var_30h;\r\n                   |    \r\n    0x1836f0b85    |    var_30h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_f8;\r\n    0x1836f0b94    |    if (*(char *)(arg1 + 0x30) == '\\0') goto code_r0x0001836f0fa2;\r\n    0x1836f0bab    |    stack0xffffffffffffffa8 = 0;\r\n    0x1836f0bab    |    var_50h = 0;\r\n    0x1836f0baf    |    uStack_68 = 0;\r\n    0x1836f0baf    |    _var_60h = 0;\r\n    0x1836f0bb3    |    var_78h = 0;\r\n    0x1836f0bb3    |    var_70h = 0;\r\n    0x1836f0ba3    |    func_0x000183922ba0(&var_78h, arg1 + 0x18);\r\n    0x1836f0bc9    |    if ((char)var_50h == '\\0') {\r\n    0x1836f0d56    |        func_0x000188ac4df0(arg1);\r\n    0x1836f0d61    |        func_0x000188ac4b60(arg2, arg1);\r\n                   |    } else {\r\n    0x1836f0bcf    |        iVar6 = *(int64_t *)(arg1 + 0x1d0);\r\n    0x1836f0be5    |        if ((iVar6 == 0) && (iVar6 = *(int64_t *)(arg1 + 0x1c8), iVar6 == 0)) {\r\n    0x1836f0f27    |            var_83h._2_1_ = 0x15;\r\n    0x1836f0f45    |            if ((int64_t *)0x190b80810 < &var_83h && &var_98h < (int64_t *)0x190b80811) {\r\n                   |code_r0x0001836f0fa2:\r\n    0x1836f0fa2    |    // WARNING: Does not return\r\n    0x1836f0fa2    |                pcVar4 = (code *)invalidInstructionException();\r\n    0x1836f0fa2    |                (*pcVar4)();\r\n                   |            }\r\n    0x1836f0f4e    |            piVar10 = &var_98h;\r\n    0x1836f0f53    |            Stack_88 = 0x656c62616c;\r\n    0x1836f0f57    |            var_98h._0_4_ = 0x666f7250;\r\n    0x1836f0f57    |            var_98h._4_4_ = 0x20656c69;\r\n    0x1836f0f57    |            uStack_90 = 0x20746f6e;\r\n    0x1836f0f57    |            uStack_8c = 0x69617661;\r\n    0x1836f0f62    |            var_83h._0_1_ = 0;\r\n                   |        } else {\r\n    0x1836f0beb    |            var_a0h = 0;\r\n    0x1836f0bf8    |            if (*(char *)(arg1 + 0x30) == '\\0') goto code_r0x0001836f0fa2;\r\n    0x1836f0c06    |            cVar5 = func_0x0001836f0fc0(arg1 + 0x18, &var_a0h);\r\n    0x1836f0c0d    |            if (cVar5 != '\\0') {\r\n    0x1836f0f7f    |                if ((*(int32_t *)\r\n    0x1836f0c28    |                      (*(int64_t *)(*(int64_t *)(unaff_GS_OFFSET + 0x58) + (uint64_t)*(uint32_t *)0x191d832e0 * 8) + 4)\r\n    0x1836f0c32    |                     < *(int32_t *)0x191dd0600) && (func_0x000185f00fe8(0x191dd0600), *(int32_t *)0x191dd0600 == -1)) {\r\n    0x1836f0f8c    |                    func_0x00018237cf50(0x191dd05c8);\r\n    0x1836f0f98    |                    func_0x000185f00f7c(0x191dd0600);\r\n                   |                }\r\n    0x1836f0c45    |                iVar6 = func_0x000184300b20(0x191dd05c8, iVar6, 1);\r\n    0x1836f0c4d    |                if (iVar6 != 0) {\r\n    0x1836f0c5b    |                    piVar7 = (int32_t *)func_0x000185f006b8(0x38);\r\n    0x1836f0c60    |                    *piVar7 = 1;\r\n    0x1836f0c6d    |                    piVar7[2] = -0x7e411b70;\r\n    0x1836f0c6d    |                    piVar7[3] = 1;\r\n    0x1836f0c78    |                    piVar7[4] = -0x7ccc36e0;\r\n    0x1836f0c78    |                    piVar7[5] = 1;\r\n    0x1836f0c83    |                    piVar7[6] = -0x7be28a30;\r\n    0x1836f0c83    |                    piVar7[7] = 1;\r\n    0x1836f0c8e    |                    piVar7[8] = -0x756e7580;\r\n    0x1836f0c8e    |                    piVar7[9] = 1;\r\n    0x1836f0c92    |                    piVar7[10] = 0;\r\n    0x1836f0c99    |                    *(int64_t *)(piVar7 + 0xc) = arg1;\r\n    0x1836f0ca0    |                    if (arg1 != 0) {\r\n    0x1836f0ca7    |                        LOCK();\r\n    0x1836f0ca7    |                        piVar1 = (int32_t *)(arg1 + 8);\r\n    0x1836f0ca7    |                        iVar3 = *piVar1;\r\n    0x1836f0ca7    |                        *piVar1 = *piVar1 + 1;\r\n    0x1836f0ca7    |                        UNLOCK();\r\n    0x1836f0cb2    |                        if (iVar3 == 0x7fffffff) goto code_r0x0001836f0fb4;\r\n                   |                    }\r\n    0x1836f0cc2    |                    if (*(int64_t *)(iVar6 + 0xf8) == 0) {\r\n    0x1836f0d6b    |                        if (piVar7 != (int32_t *)0x0) {\r\n    0x1836f0d6d    |                            LOCK();\r\n    0x1836f0d6d    |                            *piVar7 = *piVar7 + -1;\r\n    0x1836f0d6d    |                            UNLOCK();\r\n    0x1836f0d70    |                            if (*piVar7 == 0) {\r\n    0x1836f0d7c    |                                (*(code *)0x185f59da0)(piVar7, *(undefined8 *)(piVar7 + 4));\r\n                   |                            }\r\n                   |                        }\r\n                   |                    } else {\r\n    0x1836f0cd5    |                        var_d8h = (int64_t)piVar7;\r\n    0x1836f0cd5    |                        cVar5 = func_0x0001834ac3d0(*(int64_t *)(iVar6 + 0xf8), var_a0h);\r\n    0x1836f0cdc    |                        if (cVar5 != '\\0') {\r\n    0x1836f0ce4    |                            *(undefined *)arg2 = 0;\r\n    0x1836f0ce6    |                            *(undefined *)(arg2 + 0x10) = 0;\r\n    0x1836f0ce6    |                            goto code_r0x0001836f0ce9;\r\n                   |                        }\r\n                   |                    }\r\n                   |                }\r\n    0x1836f0d8a    |                var_d8h = 0;\r\n    0x1836f0d8a    |                var_d0h = 0;\r\n    0x1836f0d8d    |                var_c8h = 0;\r\n    0x1836f0da4    |                var_48h = 0x190186c60;\r\n    0x1836f0da7    |                uStack_40 = 7;\r\n    0x1836f0d85    |                func_0x0001802e59f0(&var_d8h, &var_48h, 0);\r\n    0x1836f0dcb    |                func_0x000188b4faf0(arg1, &var_b9h, &var_d8h);\r\n    0x1836f0de2    |                var_48h = 0x188ac5700;\r\n    0x1836f0de5    |                uStack_40 = uStack_40 & 0xffffffff00000000;\r\n    0x1836f0dfc    |                var_38h = arg1;\r\n    0x1836f0dfc    |                uVar8 = func_0x000188ac69e0(0x1861e7020, &var_48h);\r\n    0x1836f0dfc    |                iVar6 = var_d8h;\r\n    0x1836f0e04    |                *(undefined *)arg2 = var_b9h;\r\n    0x1836f0e06    |                *(undefined8 *)(arg2 + 8) = uVar8;\r\n    0x1836f0e0a    |                *(undefined *)(arg2 + 0x10) = 1;\r\n    0x1836f0e14    |                if (var_d8h != 0) {\r\n    0x1836f0e1f    |                    iVar9 = var_d0h << 5;\r\n    0x1836f0e26    |                    if (iVar9 != 0) {\r\n    0x1836f0e28    |                        iVar2 = var_d8h + -0x20;\r\n                   |                        do {\r\n    0x1836f0e2c    |                            func_0x000184e58cd0(iVar2 + iVar9);\r\n    0x1836f0e35    |                            iVar9 = iVar9 + -0x20;\r\n    0x1836f0e39    |                        } while (iVar9 != 0);\r\n                   |                    }\r\n    0x1836f0e43    |                    var_d0h = iVar6 - var_d8h >> 5;\r\n    0x1836f0e55    |                    func_0x0001841dcbe0(var_d8h, var_c8h << 5);\r\n                   |                }\r\n                   |                goto code_r0x0001836f0ce9;\r\n                   |            }\r\n    0x1836f0e64    |            var_b8h = func_0x000185f006b8(0x30);\r\n    0x1836f0e6e    |            var_b0h = 0x2e;\r\n    0x1836f0e85    |            var_a8h = -0x7fffffffffffffd0;\r\n    0x1836f0eae    |            if (((undefined4 *)(var_b8h + 0x2e) < (uint64_t)var_b8h) ||\r\n    0x1836f0ea8    |               ((undefined4 *)0x190c16c50 < (undefined4 *)(var_b8h + 0x2e) &&\r\n    0x1836f0ea1    |                (uint64_t)var_b8h < (undefined4 *)0x190c16c51)) goto code_r0x0001836f0fa2;\r\n    0x1836f0ebb    |            *(undefined8 *)(var_b8h + 0x1e) = 0x66656c202c6e776f;\r\n    0x1836f0ebb    |            *(undefined8 *)(var_b8h + 0x26) = 0x7468676972202c74;\r\n    0x1836f0ec6    |            *(undefined8 *)(var_b8h + 0x10) = 0x666f20656e6f2065;\r\n    0x1836f0ec6    |            *(undefined8 *)(var_b8h + 0x18) = 0x776f64202c707520;\r\n    0x1836f0ed1    |            *(undefined4 *)var_b8h = 0x65726964;\r\n    0x1836f0ed1    |            *(undefined4 *)(var_b8h + 4) = 0x6f697463;\r\n    0x1836f0ed1    |            *(undefined4 *)(var_b8h + 8) = 0x756d206e;\r\n    0x1836f0ed1    |            *(undefined4 *)(var_b8h + 0xc) = 0x62207473;\r\n    0x1836f0ed4    |            *(undefined *)(var_b8h + 0x2e) = 0;\r\n    0x1836f0ed8    |            piVar10 = &var_b8h;\r\n                   |        }\r\n    0x1836f0ee3    |        func_0x000188ac4940(arg1, arg2, piVar10);\r\n    0x1836f0eff    |        var_d8h = 0x188ac5700;\r\n    0x1836f0f02    |        var_d0h = (uint64_t)var_d0h._4_4_ << 0x20;\r\n    0x1836f0f10    |        var_48h = arg1;\r\n    0x1836f0f10    |        uVar8 = func_0x000188ac69e0(0x1861e7020);\r\n    0x1836f0f15    |        *(undefined8 *)(arg2 + 8) = uVar8;\r\n    0x1836f0f19    |        *(undefined *)(arg2 + 0x10) = 1;\r\n                   |    }\r\n                   |code_r0x0001836f0ce9:\r\n    0x1836f0d05    |    if ((((char)var_50h == '\\x01') && (var_59h._1_1_ == '\\x01')) && ((int64_t)_var_60h < 0)) {\r\n    0x1836f0d21    |        func_0x0001841dcbe0(var_70h, _var_60h & 0x7fffffffffffffff);\r\n                   |    }\r\n    0x1836f0d3b    |    if (*(uint64_t *)0x191c71040 == (var_30h ^ (uint64_t)auStack_f8)) {\r\n    0x1836f0d52    |        return arg2;\r\n                   |    }\r\n    0x1836f0fac    |    func_0x000185f05b40(var_30h ^ (uint64_t)auStack_f8);\r\n                   |code_r0x0001836f0fb4:\r\n    0x1836f0fb4    |    pcVar4 = (code *)swi(3);\r\n    0x1836f0fb4    |    iVar6 = (*pcVar4)();\r\n    0x1836f0fb4    |    return iVar6;\r\n                   |}\r\n[{\"offset\":6500060016,\"name\":\"fcn.1836f0b70\",\"size\":1093,\"is-pure\":false,\"realsz\":1093,\"noreturn\":false,\"stackframe\":248,\"calltype\":\"ms\",\"cost\":313,\"cc\":28,\"loops\":7,\"bits\":64,\"type\":\"fcn\",\"nbbs\":40,\"edges\":62,\"ebbs\":3,\"signature\":\"fcn.1836f0b70(int64_t arg1, int64_t arg2, int64_t arg_a8h);\",\"minbound\":6500060016,\"maxbound\":6500061109,\"callrefs\":[{\"from\":6500060096,\"to\":6502362016,\"type\":\"CALL\"},{\"from\":6500060166,\"to\":6500061120,\"type\":\"CALL\"},{\"from\":6500060229,\"to\":6512708384,\"type\":\"CALL\"},{\"from\":6500060251,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6500060373,\"to\":6497682384,\"type\":\"CALL\"},{\"from\":6500060449,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6500060502,\"to\":6587960816,\"type\":\"CALL\"},{\"from\":6500060513,\"to\":6587960160,\"type\":\"CALL\"},{\"from\":6500060518,\"to\":6500060393,\"type\":\"CODE\"},{\"from\":6500060540,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6500060600,\"to\":6445488624,\"type\":\"CALL\"},{\"from\":6500060619,\"to\":6588529392,\"type\":\"CALL\"},{\"from\":6500060668,\"to\":6587967968,\"type\":\"CALL\"},{\"from\":6500060720,\"to\":6524603600,\"type\":\"CALL\"},{\"from\":6500060757,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6500060762,\"to\":6500060393,\"type\":\"CODE\"},{\"from\":6500060772,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6500060899,\"to\":6587959616,\"type\":\"CALL\"},{\"from\":6500060944,\"to\":6587967968,\"type\":\"CALL\"},{\"from\":6500060957,\"to\":6500060393,\"type\":\"CODE\"},{\"from\":6500061031,\"to\":6500060893,\"type\":\"CODE\"},{\"from\":6500061043,\"to\":6542069736,\"type\":\"CALL\"},{\"from\":6500061068,\"to\":6479662928,\"type\":\"CALL\"},{\"from\":6500061080,\"to\":6542069628,\"type\":\"CALL\"},{\"from\":6500061085,\"to\":6500060216,\"type\":\"CODE\"},{\"from\":6500061103,\"to\":6542089024,\"type\":\"CALL\"}],\"datarefs\":[{\"from\":6500060030,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6500060179,\"to\":6742148608,\"type\":\"DATA\"},{\"from\":6500060185,\"to\":6741832416,\"type\":\"DATA\"},{\"from\":6500060216,\"to\":6742148552,\"type\":\"DATA\"},{\"from\":6500060262,\"to\":6471738512,\"type\":\"DATA\"},{\"from\":6500060273,\"to\":6496176416,\"type\":\"DATA\"},{\"from\":6500060284,\"to\":6511490512,\"type\":\"DATA\"},{\"from\":6500060295,\"to\":6619761280,\"type\":\"DATA\"},{\"from\":6500060465,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6500060565,\"to\":6712487008,\"type\":\"DATA\"},{\"from\":6500060635,\"to\":6587963136,\"type\":\"DATA\"},{\"from\":6500060653,\"to\":6545109024,\"type\":\"DATA\"},{\"from\":6500060823,\"to\":6723562576,\"type\":\"DATA\"},{\"from\":6500060852,\"to\":6723562606,\"type\":\"DATA\"},{\"from\":6500060863,\"to\":6723562592,\"type\":\"DATA\"},{\"from\":6500060874,\"to\":6723562576,\"type\":\"DATA\"},{\"from\":6500060915,\"to\":6587963136,\"type\":\"DATA\"},{\"from\":6500060937,\"to\":6545109024,\"type\":\"DATA\"},{\"from\":6500060971,\"to\":6722947088,\"type\":\"DATA\"},{\"from\":6500060999,\"to\":6722947101,\"type\":\"DATA\"},{\"from\":6500061015,\"to\":6722947088,\"type\":\"DATA\"},{\"from\":6500061036,\"to\":6742148608,\"type\":\"DATA\"},{\"from\":6500061048,\"to\":6742148608,\"type\":\"DATA\"},{\"from\":6500061061,\"to\":6742148552,\"type\":\"DATA\"},{\"from\":6500061073,\"to\":6742148608,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6500060518,\"to\":6500060393,\"type\":\"CODE\"},{\"from\":6500060762,\"to\":6500060393,\"type\":\"CODE\"},{\"from\":6500060957,\"to\":6500060393,\"type\":\"CODE\"},{\"from\":6500061031,\"to\":6500060893,\"type\":\"CODE\"},{\"from\":6500061085,\"to\":6500060216,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":5,\"outdegree\":21,\"nlocals\":18,\"nargs\":3,\"stackvars\":[{\"name\":\"var_d8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-216}},{\"name\":\"var_d0h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-208}},{\"name\":\"var_c8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-200}},{\"name\":\"var_b9h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-185}},{\"name\":\"var_b8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-184}},{\"name\":\"var_b0h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-176}},{\"name\":\"var_a8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-168}},{\"name\":\"var_a0h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-160}},{\"name\":\"var_98h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-152}},{\"name\":\"var_83h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-131}},{\"name\":\"var_78h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-120}},{\"name\":\"var_70h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-112}},{\"name\":\"var_60h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-96}},{\"name\":\"var_59h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-89}},{\"name\":\"var_50h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-80}},{\"name\":\"var_48h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-72}},{\"name\":\"var_38h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-56}},{\"name\":\"var_30h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-48}},{\"name\":\"arg_a8h\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":168}}],\"regvars\":[{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"confidence":"observed","authority":"shipped-artifact","environment":null,"limitations":["The executable version and supported formats are reported as unknown because no reliable version probe was performed.","A non-zero process exit is preserved as an observed command result.","Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.","When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call."],"relationship_coverage":null,"locations":[{"kind":"artifact-path","path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"}],"evidence_links":[]},"meta":{"command":"execute-rizin-command","duration":"5161ms"}}