{"ok":true,"data":{"evidence_id":"ev_84210b6a55cdde8cd0a8215f19c38c69c17ab2bf0e6523c959248689e5be52dc","subject":{"name":"Tabbit.dll","digest":{"sha256":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c"},"local_path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","format":"unknown","architecture":null},"provider":{"id":"rizin","name":"Rizin","version":null},"analysis_profile":null,"predicate_type":"rea.reverse-engineering.command-observation","operation":"execute_rizin_command","parameters":{"path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","command":"e scr.color=0;af @ 0x1824d33c0;pdgo @ 0x1824d33c0;afij @ 0x1824d33c0","provider_executable":"C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe","command_arguments":["-N","-q","-c","e scr.color=0;af @ 0x1824d33c0;pdgo @ 0x1824d33c0;afij @ 0x1824d33c0","C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"]},"raw_result":{"stdout":"    0x1824d33c0    |\r\n    0x1824d33c0    |// WARNING: [rz-ghidra] Detected overlap for variable var_48h\r\n                   |\r\n    0x1824d33c0    |void fcn.1824d33c0(void)\r\n                   |{\r\n                   |    code *pcVar1;\r\n                   |    char cVar2;\r\n                   |    undefined uVar3;\r\n                   |    int64_t *piVar4;\r\n                   |    undefined auStack_78 [32];\r\n                   |    int64_t var_58h;\r\n                   |    undefined8 uStack_50;\r\n                   |    undefined var_48h [7];\r\n                   |    int64_t var_41h;\r\n                   |    int64_t var_30h;\r\n                   |    int64_t var_28h;\r\n                   |    int64_t var_20h;\r\n                   |    \r\n    0x1824d33ce    |    var_20h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_78;\r\n    0x1824d33dd    |    cVar2 = func_0x000184211fd0(0x191cfc688);\r\n    0x1824d33e4    |    if (cVar2 == '\\0') {\r\n    0x1824d33f2    |        var_58h = 0;\r\n    0x1824d33f2    |        uStack_50 = 0;\r\n    0x1824d33f5    |        _var_48h = 0;\r\n    0x1824d33fd    |        func_0x00018551e800(&var_28h);\r\n    0x1824d3412    |        uVar3 = func_0x00018388d800(0, &var_58h, var_28h);\r\n    0x1824d3425    |        piVar4 = (int64_t *)func_0x0001844eac90(0x190c47180, 1);\r\n    0x1824d343e    |        if (*(int64_t *)(*piVar4 + 0x28) == 0x18476a690) {\r\n    0x1824d3471    |            func_0x00018476a690(piVar4, uVar3);\r\n                   |        } else {\r\n    0x1824d3446    |            (*(code *)0x185f59da0)(piVar4);\r\n                   |        }\r\n    0x1824d3451    |        if (_var_48h < 0) {\r\n    0x1824d3464    |            func_0x0001841dcbe0(var_58h, _var_48h * 2);\r\n                   |        }\r\n                   |    } else {\r\n    0x1824d347d    |        var_28h = func_0x000185f006b8(0x30);\r\n    0x1824d3487    |        *(undefined4 *)var_28h = 1;\r\n    0x1824d3490    |        *(undefined8 *)(var_28h + 8) = 0x18388d790;\r\n    0x1824d349b    |        *(undefined8 *)(var_28h + 0x10) = 0x182bd0900;\r\n    0x1824d34a6    |        *(undefined8 *)(var_28h + 0x18) = 0x1841d75d0;\r\n    0x1824d34b1    |        *(undefined8 *)(var_28h + 0x20) = 0x18388d6d0;\r\n    0x1824d34c2    |        var_30h = func_0x000185f006b8(0x28);\r\n    0x1824d34c7    |        *(undefined4 *)var_30h = 1;\r\n    0x1824d34d0    |        *(undefined8 *)(var_30h + 8) = 0x18388d360;\r\n    0x1824d34db    |        *(undefined8 *)(var_30h + 0x10) = 0x180b5d930;\r\n    0x1824d34df    |        *(undefined8 *)(var_30h + 0x18) = 0x1841d75d0;\r\n    0x1824d34f9    |        func_0x000184339cd0(&var_58h, 0x190c47168, 0x190c47130, 0x1e);\r\n    0x1824d34f9    |        func_0x00018388d1e0(&var_58h, 0x190c47125, &var_30h, &var_28h);\r\n                   |    }\r\n    0x1824d3533    |    if (*(uint64_t *)0x191c71040 == (var_20h ^ (uint64_t)auStack_78)) {\r\n    0x1824d353c    |        return;\r\n                   |    }\r\n    0x1824d3542    |    func_0x000185f05b40(var_20h ^ (uint64_t)auStack_78);\r\n    0x1824d354a    |    pcVar1 = (code *)swi(3);\r\n    0x1824d354a    |    (*pcVar1)();\r\n    0x1824d354a    |    return;\r\n                   |}\r\n[{\"offset\":6481064896,\"name\":\"fcn.1824d33c0\",\"size\":395,\"is-pure\":false,\"realsz\":395,\"noreturn\":false,\"stackframe\":120,\"calltype\":\"ms\",\"cost\":127,\"cc\":6,\"loops\":1,\"bits\":64,\"type\":\"fcn\",\"nbbs\":10,\"edges\":12,\"ebbs\":2,\"signature\":\"fcn.1824d33c0();\",\"minbound\":6481064896,\"maxbound\":6481065291,\"callrefs\":[{\"from\":6481064925,\"to\":6511730640,\"type\":\"CALL\"},{\"from\":6481064965,\"to\":6531704832,\"type\":\"CALL\"},{\"from\":6481064978,\"to\":6501750784,\"type\":\"CALL\"},{\"from\":6481064997,\"to\":6514715792,\"type\":\"CALL\"},{\"from\":6481065030,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6481065060,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6481065065,\"to\":6481065249,\"type\":\"CODE\"},{\"from\":6481065073,\"to\":6517335696,\"type\":\"CALL\"},{\"from\":6481065078,\"to\":6481065036,\"type\":\"CODE\"},{\"from\":6481065085,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6481065154,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6481065223,\"to\":6512942288,\"type\":\"CALL\"},{\"from\":6481065244,\"to\":6501749216,\"type\":\"CALL\"},{\"from\":6481065285,\"to\":6542089024,\"type\":\"CALL\"}],\"datarefs\":[{\"from\":6481064903,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6481064918,\"to\":6741280392,\"type\":\"DATA\"},{\"from\":6481064985,\"to\":6723760512,\"type\":\"DATA\"},{\"from\":6481065012,\"to\":6517335696,\"type\":\"DATA\"},{\"from\":6481065097,\"to\":6501750672,\"type\":\"DATA\"},{\"from\":6481065108,\"to\":6488393984,\"type\":\"DATA\"},{\"from\":6481065119,\"to\":6511490512,\"type\":\"DATA\"},{\"from\":6481065130,\"to\":6501750480,\"type\":\"DATA\"},{\"from\":6481065161,\"to\":6501749600,\"type\":\"DATA\"},{\"from\":6481065172,\"to\":6454368560,\"type\":\"DATA\"},{\"from\":6481065195,\"to\":6723760488,\"type\":\"DATA\"},{\"from\":6481065202,\"to\":6723760432,\"type\":\"DATA\"},{\"from\":6481065228,\"to\":6723760421,\"type\":\"DATA\"},{\"from\":6481065257,\"to\":6740709440,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6481065065,\"to\":6481065249,\"type\":\"CODE\"},{\"from\":6481065078,\"to\":6481065036,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":2,\"outdegree\":12,\"nlocals\":6,\"nargs\":0,\"stackvars\":[{\"name\":\"var_58h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-88}},{\"name\":\"var_48h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-72}},{\"name\":\"var_41h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-65}},{\"name\":\"var_30h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-48}},{\"name\":\"var_28h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-40}},{\"name\":\"var_20h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-32}}],\"regvars\":[]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"normalized_result":{"stdout":"    0x1824d33c0    |\r\n    0x1824d33c0    |// WARNING: [rz-ghidra] Detected overlap for variable var_48h\r\n                   |\r\n    0x1824d33c0    |void fcn.1824d33c0(void)\r\n                   |{\r\n                   |    code *pcVar1;\r\n                   |    char cVar2;\r\n                   |    undefined uVar3;\r\n                   |    int64_t *piVar4;\r\n                   |    undefined auStack_78 [32];\r\n                   |    int64_t var_58h;\r\n                   |    undefined8 uStack_50;\r\n                   |    undefined var_48h [7];\r\n                   |    int64_t var_41h;\r\n                   |    int64_t var_30h;\r\n                   |    int64_t var_28h;\r\n                   |    int64_t var_20h;\r\n                   |    \r\n    0x1824d33ce    |    var_20h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_78;\r\n    0x1824d33dd    |    cVar2 = func_0x000184211fd0(0x191cfc688);\r\n    0x1824d33e4    |    if (cVar2 == '\\0') {\r\n    0x1824d33f2    |        var_58h = 0;\r\n    0x1824d33f2    |        uStack_50 = 0;\r\n    0x1824d33f5    |        _var_48h = 0;\r\n    0x1824d33fd    |        func_0x00018551e800(&var_28h);\r\n    0x1824d3412    |        uVar3 = func_0x00018388d800(0, &var_58h, var_28h);\r\n    0x1824d3425    |        piVar4 = (int64_t *)func_0x0001844eac90(0x190c47180, 1);\r\n    0x1824d343e    |        if (*(int64_t *)(*piVar4 + 0x28) == 0x18476a690) {\r\n    0x1824d3471    |            func_0x00018476a690(piVar4, uVar3);\r\n                   |        } else {\r\n    0x1824d3446    |            (*(code *)0x185f59da0)(piVar4);\r\n                   |        }\r\n    0x1824d3451    |        if (_var_48h < 0) {\r\n    0x1824d3464    |            func_0x0001841dcbe0(var_58h, _var_48h * 2);\r\n                   |        }\r\n                   |    } else {\r\n    0x1824d347d    |        var_28h = func_0x000185f006b8(0x30);\r\n    0x1824d3487    |        *(undefined4 *)var_28h = 1;\r\n    0x1824d3490    |        *(undefined8 *)(var_28h + 8) = 0x18388d790;\r\n    0x1824d349b    |        *(undefined8 *)(var_28h + 0x10) = 0x182bd0900;\r\n    0x1824d34a6    |        *(undefined8 *)(var_28h + 0x18) = 0x1841d75d0;\r\n    0x1824d34b1    |        *(undefined8 *)(var_28h + 0x20) = 0x18388d6d0;\r\n    0x1824d34c2    |        var_30h = func_0x000185f006b8(0x28);\r\n    0x1824d34c7    |        *(undefined4 *)var_30h = 1;\r\n    0x1824d34d0    |        *(undefined8 *)(var_30h + 8) = 0x18388d360;\r\n    0x1824d34db    |        *(undefined8 *)(var_30h + 0x10) = 0x180b5d930;\r\n    0x1824d34df    |        *(undefined8 *)(var_30h + 0x18) = 0x1841d75d0;\r\n    0x1824d34f9    |        func_0x000184339cd0(&var_58h, 0x190c47168, 0x190c47130, 0x1e);\r\n    0x1824d34f9    |        func_0x00018388d1e0(&var_58h, 0x190c47125, &var_30h, &var_28h);\r\n                   |    }\r\n    0x1824d3533    |    if (*(uint64_t *)0x191c71040 == (var_20h ^ (uint64_t)auStack_78)) {\r\n    0x1824d353c    |        return;\r\n                   |    }\r\n    0x1824d3542    |    func_0x000185f05b40(var_20h ^ (uint64_t)auStack_78);\r\n    0x1824d354a    |    pcVar1 = (code *)swi(3);\r\n    0x1824d354a    |    (*pcVar1)();\r\n    0x1824d354a    |    return;\r\n                   |}\r\n[{\"offset\":6481064896,\"name\":\"fcn.1824d33c0\",\"size\":395,\"is-pure\":false,\"realsz\":395,\"noreturn\":false,\"stackframe\":120,\"calltype\":\"ms\",\"cost\":127,\"cc\":6,\"loops\":1,\"bits\":64,\"type\":\"fcn\",\"nbbs\":10,\"edges\":12,\"ebbs\":2,\"signature\":\"fcn.1824d33c0();\",\"minbound\":6481064896,\"maxbound\":6481065291,\"callrefs\":[{\"from\":6481064925,\"to\":6511730640,\"type\":\"CALL\"},{\"from\":6481064965,\"to\":6531704832,\"type\":\"CALL\"},{\"from\":6481064978,\"to\":6501750784,\"type\":\"CALL\"},{\"from\":6481064997,\"to\":6514715792,\"type\":\"CALL\"},{\"from\":6481065030,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6481065060,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6481065065,\"to\":6481065249,\"type\":\"CODE\"},{\"from\":6481065073,\"to\":6517335696,\"type\":\"CALL\"},{\"from\":6481065078,\"to\":6481065036,\"type\":\"CODE\"},{\"from\":6481065085,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6481065154,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6481065223,\"to\":6512942288,\"type\":\"CALL\"},{\"from\":6481065244,\"to\":6501749216,\"type\":\"CALL\"},{\"from\":6481065285,\"to\":6542089024,\"type\":\"CALL\"}],\"datarefs\":[{\"from\":6481064903,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6481064918,\"to\":6741280392,\"type\":\"DATA\"},{\"from\":6481064985,\"to\":6723760512,\"type\":\"DATA\"},{\"from\":6481065012,\"to\":6517335696,\"type\":\"DATA\"},{\"from\":6481065097,\"to\":6501750672,\"type\":\"DATA\"},{\"from\":6481065108,\"to\":6488393984,\"type\":\"DATA\"},{\"from\":6481065119,\"to\":6511490512,\"type\":\"DATA\"},{\"from\":6481065130,\"to\":6501750480,\"type\":\"DATA\"},{\"from\":6481065161,\"to\":6501749600,\"type\":\"DATA\"},{\"from\":6481065172,\"to\":6454368560,\"type\":\"DATA\"},{\"from\":6481065195,\"to\":6723760488,\"type\":\"DATA\"},{\"from\":6481065202,\"to\":6723760432,\"type\":\"DATA\"},{\"from\":6481065228,\"to\":6723760421,\"type\":\"DATA\"},{\"from\":6481065257,\"to\":6740709440,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6481065065,\"to\":6481065249,\"type\":\"CODE\"},{\"from\":6481065078,\"to\":6481065036,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":2,\"outdegree\":12,\"nlocals\":6,\"nargs\":0,\"stackvars\":[{\"name\":\"var_58h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-88}},{\"name\":\"var_48h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-72}},{\"name\":\"var_41h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-65}},{\"name\":\"var_30h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-48}},{\"name\":\"var_28h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-40}},{\"name\":\"var_20h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-32}}],\"regvars\":[]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"confidence":"observed","authority":"shipped-artifact","environment":null,"limitations":["The executable version and supported formats are reported as unknown because no reliable version probe was performed.","A non-zero process exit is preserved as an observed command result.","Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.","When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call."],"relationship_coverage":null,"locations":[{"kind":"artifact-path","path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"}],"evidence_links":[]},"meta":{"command":"execute-rizin-command","duration":"5165ms"}}