{"ok":true,"data":{"evidence_id":"ev_f0433022e0041673265625c4a60f2835b2015786439bd90d8cb29929679fbe58","subject":{"name":"Tabbit.dll","digest":{"sha256":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c"},"local_path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","format":"unknown","architecture":null},"provider":{"id":"rizin","name":"Rizin","version":null},"analysis_profile":null,"predicate_type":"rea.reverse-engineering.command-observation","operation":"execute_rizin_command","parameters":{"path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","command":"e scr.color=0;af @ 0x1836bdb90;pdgo @ 0x1836bdb90;afij @ 0x1836bdb90","provider_executable":"C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe","command_arguments":["-N","-q","-c","e scr.color=0;af @ 0x1836bdb90;pdgo @ 0x1836bdb90;afij @ 0x1836bdb90","C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"]},"raw_result":{"stdout":" 0x1836bdb90 |\r\n 0x1836bdb90 |// WARNING: [rz-ghidra] Detected overlap for variable var_81h\r\n 0x1836bdb90 |// WARNING: [rz-ghidra] Detected overlap for variable var_88h\r\n 0x1836bdb90 |// WARNING: [rz-ghidra] Detected overlap for variable var_61h\r\n 0x1836bdb90 |// WARNING: [rz-ghidra] Detected overlap for variable var_60h\r\n |\r\n 0x1836bdb90 |void fcn.1836bdb90(int64_t arg1, int64_t arg2, int64_t arg3, int64_t arg4)\r\n |{\r\n | int64_t iVar1;\r\n | code *pcVar2;\r\n | undefined8 uVar3;\r\n | int64_t iVar4;\r\n | int64_t iVar5;\r\n | int64_t *piVar6;\r\n | int64_t iVar7;\r\n | int32_t iVar8;\r\n | undefined auStack_118 [40];\r\n | int64_t var_f0h;\r\n | int64_t var_e8h;\r\n | int64_t var_e0h;\r\n | int64_t var_d8h;\r\n | int64_t iStack_d0;\r\n | uint64_t uStack_c8;\r\n | int64_t var_b8h;\r\n | undefined8 uStack_b0;\r\n | int64_t iStack_a8;\r\n | int64_t var_98h;\r\n | int64_t var_90h;\r\n | uint64_t var_88h;\r\n | int64_t var_80h;\r\n | int64_t var_78h;\r\n | int64_t iStack_70;\r\n | int64_t var_68h;\r\n | uint64_t var_60h;\r\n | int64_t var_50h;\r\n | undefined8 uStack_48;\r\n | int64_t var_40h;\r\n | int64_t var_38h;\r\n | \r\n 0x1836bdbac | var_40h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_118;\r\n 0x1836bdbb7 | iVar4 = *(int64_t *)(arg1 + 8);\r\n 0x1836bdbbe | if (iVar4 != 0) {\r\n 0x1836bdbcd | uVar3 = func_0x000180589d40();\r\n 0x1836bdbdb | iVar4 = func_0x000184300b20(uVar3, iVar4, 1);\r\n 0x1836bdbe3 | if (iVar4 != 0) {\r\n 0x1836bdbef | iVar8 = (int32_t)arg3;\r\n 0x1836bdbef | var_80h._0_4_ = iVar8;\r\n 0x1836bdbef | if ((char)arg4 == '\\0') {\r\n 0x1836bde75 | if (*(char *)(arg2 + 0x17) < '\\0') {\r\n 0x1836bde62 | func_0x0001841dd0f0(&var_98h, *(undefined8 *)arg2, *(undefined8 *)(arg2 + 8));\r\n | } else {\r\n 0x1836bde77 | var_88h = *(uint64_t *)(arg2 + 0x10);\r\n 0x1836bde83 | var_98h = *(int64_t *)arg2;\r\n 0x1836bde83 | var_90h = *(int64_t *)(arg2 + 8);\r\n | }\r\n 0x1836bde98 | var_78h = 0;\r\n 0x1836bde98 | iStack_70 = 0;\r\n 0x1836bdea0 | var_68h = 0;\r\n 0x1836bdea0 | var_60h = 0;\r\n 0x1836bdeb0 | if ((int64_t)var_88h < 0) {\r\n 0x1836bdfb1 | func_0x000184211d10(&var_78h, var_98h, var_90h);\r\n 0x1836bdfd0 | var_60h = CONCAT44(var_60h._4_4_, ((int32_t)var_80h == 1) + 1);\r\n 0x1836bdfdb | if ((int64_t)var_88h < 0) {\r\n 0x1836bdffb | func_0x0001841dcbe0(var_98h, var_88h & 0x7fffffffffffffff);\r\n | }\r\n | } else {\r\n 0x1836bdebe | var_68h = var_88h;\r\n 0x1836bdece | var_78h = var_98h;\r\n 0x1836bdece | iStack_70 = var_90h;\r\n 0x1836bdee0 | var_60h = (uint64_t)((iVar8 == 1) + 1);\r\n | }\r\n 0x1836bdeef | var_b8h = 0;\r\n 0x1836bdeef | uStack_b0 = 0;\r\n 0x1836bdef2 | iStack_a8 = 0;\r\n 0x1836bdefa | func_0x000183929130(&var_78h, &var_98h);\r\n 0x1836bdeea | func_0x0001812b4470(&var_b8h, &var_98h);\r\n 0x1836bdf18 | iVar5 = var_98h;\r\n 0x1836bdf23 | if (var_98h != 0) {\r\n 0x1836be00d | iVar7 = var_90h << 5;\r\n 0x1836be014 | if (iVar7 != 0) {\r\n 0x1836be016 | iVar1 = var_98h + -0x20;\r\n | do {\r\n 0x1836be01a | func_0x000184e58cd0(iVar1 + iVar7);\r\n 0x1836be023 | iVar7 = iVar7 + -0x20;\r\n 0x1836be027 | } while (iVar7 != 0);\r\n | }\r\n 0x1836be034 | var_90h = iVar5 - var_98h >> 5;\r\n 0x1836be04c | func_0x0001841dcbe0(var_98h, var_88h << 5);\r\n | }\r\n 0x1836bdf31 | uStack_c8 = 0;\r\n 0x1836bdf35 | var_d8h = 0;\r\n 0x1836bdf35 | iStack_d0 = 0;\r\n 0x1836bdf2c | func_0x000181800f90(&var_d8h, &var_b8h);\r\n 0x1836bdf4a | iVar5 = func_0x000185f006b8(0x110);\r\n 0x1836bdf4a | var_88h = uStack_c8;\r\n 0x1836bdf4a | var_90h = iStack_d0;\r\n 0x1836bdf4a | var_98h = var_d8h;\r\n 0x1836bdf55 | var_d8h = 0;\r\n 0x1836bdf67 | iStack_d0 = 0;\r\n 0x1836bdf67 | uStack_c8 = 0;\r\n 0x1836bdf7f | var_50h = 0x190c132c0;\r\n 0x1836bdf82 | uStack_48 = 0x21;\r\n 0x1836bdf92 | func_0x000182422390(iVar5, 0x24d);\r\n 0x1836bdf97 | piVar6 = &var_e8h;\r\n | } else {\r\n 0x1836bdbf9 | if (*(char *)(arg2 + 0x17) < '\\0') {\r\n 0x1836bde05 | func_0x0001841dd0f0(&var_98h, *(undefined8 *)arg2, *(undefined8 *)(arg2 + 8));\r\n | } else {\r\n 0x1836bdbff | var_88h = *(uint64_t *)(arg2 + 0x10);\r\n 0x1836bdc0b | var_98h = *(int64_t *)arg2;\r\n 0x1836bdc0b | var_90h = *(int64_t *)(arg2 + 8);\r\n | }\r\n 0x1836bdc20 | var_78h = 0;\r\n 0x1836bdc20 | iStack_70 = 0;\r\n 0x1836bdc28 | var_68h = 0;\r\n 0x1836bdc28 | var_60h = 0;\r\n 0x1836bdc38 | if ((int64_t)var_88h < 0) {\r\n 0x1836be066 | func_0x000184211d10(&var_78h, var_98h, var_90h);\r\n 0x1836be085 | var_60h = CONCAT44(var_60h._4_4_, ((int32_t)var_80h == 1) + 1);\r\n 0x1836be090 | if ((int64_t)var_88h < 0) {\r\n 0x1836be0b0 | func_0x0001841dcbe0(var_98h, var_88h & 0x7fffffffffffffff);\r\n | }\r\n | } else {\r\n 0x1836bdc46 | var_68h = var_88h;\r\n 0x1836bdc56 | var_78h = var_98h;\r\n 0x1836bdc56 | iStack_70 = var_90h;\r\n 0x1836bdc68 | var_60h = (uint64_t)((iVar8 == 1) + 1);\r\n | }\r\n 0x1836bdc77 | var_b8h = 0;\r\n 0x1836bdc77 | uStack_b0 = 0;\r\n 0x1836bdc7a | iStack_a8 = 0;\r\n 0x1836bdc82 | func_0x000183929130(&var_78h, &var_98h);\r\n 0x1836bdc72 | func_0x0001812b4470(&var_b8h, &var_98h);\r\n 0x1836bdca0 | iVar5 = var_98h;\r\n 0x1836bdcab | if (var_98h != 0) {\r\n 0x1836be0c2 | iVar7 = var_90h << 5;\r\n 0x1836be0c9 | if (iVar7 != 0) {\r\n 0x1836be0cb | iVar1 = var_98h + -0x20;\r\n | do {\r\n 0x1836be0cf | func_0x000184e58cd0(iVar1 + iVar7);\r\n 0x1836be0d8 | iVar7 = iVar7 + -0x20;\r\n 0x1836be0dc | } while (iVar7 != 0);\r\n | }\r\n 0x1836be0e9 | var_90h = iVar5 - var_98h >> 5;\r\n 0x1836be101 | func_0x0001841dcbe0(var_98h, var_88h << 5);\r\n | }\r\n 0x1836bdcb9 | uStack_c8 = 0;\r\n 0x1836bdcbd | var_d8h = 0;\r\n 0x1836bdcbd | iStack_d0 = 0;\r\n 0x1836bdcb4 | func_0x000181800f90(&var_d8h, &var_b8h);\r\n 0x1836bdcd2 | iVar5 = func_0x000185f006b8(0x110);\r\n 0x1836bdcd2 | var_88h = uStack_c8;\r\n 0x1836bdcd2 | var_90h = iStack_d0;\r\n 0x1836bdcd2 | var_98h = var_d8h;\r\n 0x1836bdcdd | var_d8h = 0;\r\n 0x1836bdcef | iStack_d0 = 0;\r\n 0x1836bdcef | uStack_c8 = 0;\r\n 0x1836bdd07 | var_50h = 0x190c132a0;\r\n 0x1836bdd0a | uStack_48 = 0x1f;\r\n 0x1836bdd1a | func_0x000182422390(iVar5, 0x24c);\r\n 0x1836bdd1f | piVar6 = &var_e0h;\r\n | }\r\n 0x1836bdd24 | *piVar6 = iVar5;\r\n 0x1836bdd2a | func_0x000180eba190(iVar4);\r\n 0x1836bdd35 | if (var_d8h != 0) {\r\n 0x1836bde17 | func_0x000184780a80(&var_d8h);\r\n 0x1836bde2f | func_0x0001841dcbe0(var_d8h, uStack_c8 << 5);\r\n | }\r\n 0x1836bdd43 | if (var_b8h != 0) {\r\n 0x1836bde39 | func_0x000184780a80(&var_b8h);\r\n 0x1836bde51 | func_0x0001841dcbe0(var_b8h, iStack_a8 << 5);\r\n | }\r\n 0x1836bdd51 | if (var_68h < 0) {\r\n 0x1836bdd6d | func_0x0001841dcbe0(var_78h, var_68h & 0x7fffffffffffffff);\r\n | }\r\n 0x1836bdd77 | iVar5 = func_0x000185f006b8(0x110);\r\n 0x1836bdd8a | var_78h = 0;\r\n 0x1836bdd8a | iStack_70 = 0;\r\n 0x1836bdd8e | var_68h = 0;\r\n 0x1836bdda5 | var_98h = 0x190c132e8;\r\n 0x1836bdda8 | var_90h = 0x24;\r\n 0x1836bddb8 | func_0x000182422390(iVar5, 0x24e);\r\n 0x1836bddc8 | var_f0h = iVar5;\r\n 0x1836bddc8 | func_0x000180eba190(iVar4);\r\n | }\r\n | }\r\n 0x1836bdde2 | if (*(uint64_t *)0x191c71040 != (var_40h ^ (uint64_t)auStack_118)) {\r\n 0x1836be113 | func_0x000185f05b40(var_40h ^ (uint64_t)auStack_118);\r\n 0x1836be11b | pcVar2 = (code *)swi(3);\r\n 0x1836be11b | (*pcVar2)();\r\n 0x1836be11b | return;\r\n | }\r\n 0x1836bddfd | return;\r\n |}\r\n[{\"offset\":6499851152,\"name\":\"fcn.1836bdb90\",\"size\":1420,\"is-pure\":false,\"realsz\":1420,\"noreturn\":false,\"stackframe\":280,\"calltype\":\"ms\",\"cost\":385,\"cc\":21,\"loops\":11,\"bits\":64,\"type\":\"fcn\",\"nbbs\":41,\"edges\":58,\"ebbs\":2,\"signature\":\"fcn.1836bdb90(int64_t arg1, int64_t arg2, int64_t arg3, int64_t arg4);\",\"minbound\":6499851152,\"maxbound\":6499852572,\"callrefs\":[{\"from\":6499851213,\"to\":6448258368,\"type\":\"CALL\"},{\"from\":6499851227,\"to\":6512708384,\"type\":\"CALL\"},{\"from\":6499851413,\"to\":6502388016,\"type\":\"CALL\"},{\"from\":6499851424,\"to\":6462063728,\"type\":\"CALL\"},{\"from\":6499851464,\"to\":6467620752,\"type\":\"CALL\"},{\"from\":6499851474,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6499851546,\"to\":6480339856,\"type\":\"CALL\"},{\"from\":6499851562,\"to\":6457893264,\"type\":\"CALL\"},{\"from\":6499851629,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6499851639,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6499851704,\"to\":6480339856,\"type\":\"CALL\"},{\"from\":6499851720,\"to\":6457893264,\"type\":\"CALL\"},{\"from\":6499851789,\"to\":6511513840,\"type\":\"CALL\"},{\"from\":6499851794,\"to\":6499851286,\"type\":\"CODE\"},{\"from\":6499851807,\"to\":6517426816,\"type\":\"CALL\"},{\"from\":6499851823,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6499851828,\"to\":6499851579,\"type\":\"CODE\"},{\"from\":6499851841,\"to\":6517426816,\"type\":\"CALL\"},{\"from\":6499851857,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6499851862,\"to\":6499851593,\"type\":\"CODE\"},{\"from\":6499851882,\"to\":6511513840,\"type\":\"CALL\"},{\"from\":6499851887,\"to\":6499851918,\"type\":\"CODE\"},{\"from\":6499852045,\"to\":6502388016,\"type\":\"CALL\"},{\"from\":6499852056,\"to\":6462063728,\"type\":\"CALL\"},{\"from\":6499852096,\"to\":6467620752,\"type\":\"CALL\"},{\"from\":6499852106,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6499852178,\"to\":6480339856,\"type\":\"CALL\"},{\"from\":6499852188,\"to\":6499851556,\"type\":\"CODE\"},{\"from\":6499852220,\"to\":6511729936,\"type\":\"CALL\"},{\"from\":6499852283,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6499852288,\"to\":6499852007,\"type\":\"CODE\"},{\"from\":6499852318,\"to\":6524603600,\"type\":\"CALL\"},{\"from\":6499852364,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6499852369,\"to\":6499852073,\"type\":\"CODE\"},{\"from\":6499852401,\"to\":6511729936,\"type\":\"CALL\"},{\"from\":6499852464,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6499852469,\"to\":6499851375,\"type\":\"CODE\"},{\"from\":6499852499,\"to\":6524603600,\"type\":\"CALL\"},{\"from\":6499852545,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6499852550,\"to\":6499851441,\"type\":\"CODE\"},{\"from\":6499852566,\"to\":6542089024,\"type\":\"CALL\"}],\"datarefs\":[{\"from\":6499851173,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6499851512,\"to\":6723547808,\"type\":\"DATA\"},{\"from\":6499851670,\"to\":6723547880,\"type\":\"DATA\"},{\"from\":6499851736,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6499852144,\"to\":6723547840,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6499851794,\"to\":6499851286,\"type\":\"CODE\"},{\"from\":6499851828,\"to\":6499851579,\"type\":\"CODE\"},{\"from\":6499851862,\"to\":6499851593,\"type\":\"CODE\"},{\"from\":6499851887,\"to\":6499851918,\"type\":\"CODE\"},{\"from\":6499852188,\"to\":6499851556,\"type\":\"CODE\"},{\"from\":6499852288,\"to\":6499852007,\"type\":\"CODE\"},{\"from\":6499852369,\"to\":6499852073,\"type\":\"CODE\"},{\"from\":6499852469,\"to\":6499851375,\"type\":\"CODE\"},{\"from\":6499852550,\"to\":6499851441,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":9,\"outdegree\":32,\"nlocals\":17,\"nargs\":4,\"stackvars\":[{\"name\":\"var_f0h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-240}},{\"name\":\"var_e8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-232}},{\"name\":\"var_e0h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-224}},{\"name\":\"var_d8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-216}},{\"name\":\"var_b8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-184}},{\"name\":\"var_98h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-152}},{\"name\":\"var_90h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-144}},{\"name\":\"var_88h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-136}},{\"name\":\"var_81h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-129}},{\"name\":\"var_80h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-128}},{\"name\":\"var_78h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-120}},{\"name\":\"var_68h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-104}},{\"name\":\"var_61h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-97}},{\"name\":\"var_60h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-96}},{\"name\":\"var_50h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-80}},{\"name\":\"var_40h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-64}},{\"name\":\"var_38h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-56}}],\"regvars\":[{\"name\":\"arg3\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"r8\"}},{\"name\":\"arg4\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"r9\"}},{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"normalized_result":{"stdout":" 0x1836bdb90 |\r\n 0x1836bdb90 |// WARNING: [rz-ghidra] Detected overlap for variable var_81h\r\n 0x1836bdb90 |// WARNING: [rz-ghidra] Detected overlap for variable var_88h\r\n 0x1836bdb90 |// WARNING: [rz-ghidra] Detected overlap for variable var_61h\r\n 0x1836bdb90 |// WARNING: [rz-ghidra] Detected overlap for variable var_60h\r\n |\r\n 0x1836bdb90 |void fcn.1836bdb90(int64_t arg1, int64_t arg2, int64_t arg3, int64_t arg4)\r\n |{\r\n | int64_t iVar1;\r\n | code *pcVar2;\r\n | undefined8 uVar3;\r\n | int64_t iVar4;\r\n | int64_t iVar5;\r\n | int64_t *piVar6;\r\n | int64_t iVar7;\r\n | int32_t iVar8;\r\n | undefined auStack_118 [40];\r\n | int64_t var_f0h;\r\n | int64_t var_e8h;\r\n | int64_t var_e0h;\r\n | int64_t var_d8h;\r\n | int64_t iStack_d0;\r\n | uint64_t uStack_c8;\r\n | int64_t var_b8h;\r\n | undefined8 uStack_b0;\r\n | int64_t iStack_a8;\r\n | int64_t var_98h;\r\n | int64_t var_90h;\r\n | uint64_t var_88h;\r\n | int64_t var_80h;\r\n | int64_t var_78h;\r\n | int64_t iStack_70;\r\n | int64_t var_68h;\r\n | uint64_t var_60h;\r\n | int64_t var_50h;\r\n | undefined8 uStack_48;\r\n | int64_t var_40h;\r\n | int64_t var_38h;\r\n | \r\n 0x1836bdbac | var_40h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_118;\r\n 0x1836bdbb7 | iVar4 = *(int64_t *)(arg1 + 8);\r\n 0x1836bdbbe | if (iVar4 != 0) {\r\n 0x1836bdbcd | uVar3 = func_0x000180589d40();\r\n 0x1836bdbdb | iVar4 = func_0x000184300b20(uVar3, iVar4, 1);\r\n 0x1836bdbe3 | if (iVar4 != 0) {\r\n 0x1836bdbef | iVar8 = (int32_t)arg3;\r\n 0x1836bdbef | var_80h._0_4_ = iVar8;\r\n 0x1836bdbef | if ((char)arg4 == '\\0') {\r\n 0x1836bde75 | if (*(char *)(arg2 + 0x17) < '\\0') {\r\n 0x1836bde62 | func_0x0001841dd0f0(&var_98h, *(undefined8 *)arg2, *(undefined8 *)(arg2 + 8));\r\n | } else {\r\n 0x1836bde77 | var_88h = *(uint64_t *)(arg2 + 0x10);\r\n 0x1836bde83 | var_98h = *(int64_t *)arg2;\r\n 0x1836bde83 | var_90h = *(int64_t *)(arg2 + 8);\r\n | }\r\n 0x1836bde98 | var_78h = 0;\r\n 0x1836bde98 | iStack_70 = 0;\r\n 0x1836bdea0 | var_68h = 0;\r\n 0x1836bdea0 | var_60h = 0;\r\n 0x1836bdeb0 | if ((int64_t)var_88h < 0) {\r\n 0x1836bdfb1 | func_0x000184211d10(&var_78h, var_98h, var_90h);\r\n 0x1836bdfd0 | var_60h = CONCAT44(var_60h._4_4_, ((int32_t)var_80h == 1) + 1);\r\n 0x1836bdfdb | if ((int64_t)var_88h < 0) {\r\n 0x1836bdffb | func_0x0001841dcbe0(var_98h, var_88h & 0x7fffffffffffffff);\r\n | }\r\n | } else {\r\n 0x1836bdebe | var_68h = var_88h;\r\n 0x1836bdece | var_78h = var_98h;\r\n 0x1836bdece | iStack_70 = var_90h;\r\n 0x1836bdee0 | var_60h = (uint64_t)((iVar8 == 1) + 1);\r\n | }\r\n 0x1836bdeef | var_b8h = 0;\r\n 0x1836bdeef | uStack_b0 = 0;\r\n 0x1836bdef2 | iStack_a8 = 0;\r\n 0x1836bdefa | func_0x000183929130(&var_78h, &var_98h);\r\n 0x1836bdeea | func_0x0001812b4470(&var_b8h, &var_98h);\r\n 0x1836bdf18 | iVar5 = var_98h;\r\n 0x1836bdf23 | if (var_98h != 0) {\r\n 0x1836be00d | iVar7 = var_90h << 5;\r\n 0x1836be014 | if (iVar7 != 0) {\r\n 0x1836be016 | iVar1 = var_98h + -0x20;\r\n | do {\r\n 0x1836be01a | func_0x000184e58cd0(iVar1 + iVar7);\r\n 0x1836be023 | iVar7 = iVar7 + -0x20;\r\n 0x1836be027 | } while (iVar7 != 0);\r\n | }\r\n 0x1836be034 | var_90h = iVar5 - var_98h >> 5;\r\n 0x1836be04c | func_0x0001841dcbe0(var_98h, var_88h << 5);\r\n | }\r\n 0x1836bdf31 | uStack_c8 = 0;\r\n 0x1836bdf35 | var_d8h = 0;\r\n 0x1836bdf35 | iStack_d0 = 0;\r\n 0x1836bdf2c | func_0x000181800f90(&var_d8h, &var_b8h);\r\n 0x1836bdf4a | iVar5 = func_0x000185f006b8(0x110);\r\n 0x1836bdf4a | var_88h = uStack_c8;\r\n 0x1836bdf4a | var_90h = iStack_d0;\r\n 0x1836bdf4a | var_98h = var_d8h;\r\n 0x1836bdf55 | var_d8h = 0;\r\n 0x1836bdf67 | iStack_d0 = 0;\r\n 0x1836bdf67 | uStack_c8 = 0;\r\n 0x1836bdf7f | var_50h = 0x190c132c0;\r\n 0x1836bdf82 | uStack_48 = 0x21;\r\n 0x1836bdf92 | func_0x000182422390(iVar5, 0x24d);\r\n 0x1836bdf97 | piVar6 = &var_e8h;\r\n | } else {\r\n 0x1836bdbf9 | if (*(char *)(arg2 + 0x17) < '\\0') {\r\n 0x1836bde05 | func_0x0001841dd0f0(&var_98h, *(undefined8 *)arg2, *(undefined8 *)(arg2 + 8));\r\n | } else {\r\n 0x1836bdbff | var_88h = *(uint64_t *)(arg2 + 0x10);\r\n 0x1836bdc0b | var_98h = *(int64_t *)arg2;\r\n 0x1836bdc0b | var_90h = *(int64_t *)(arg2 + 8);\r\n | }\r\n 0x1836bdc20 | var_78h = 0;\r\n 0x1836bdc20 | iStack_70 = 0;\r\n 0x1836bdc28 | var_68h = 0;\r\n 0x1836bdc28 | var_60h = 0;\r\n 0x1836bdc38 | if ((int64_t)var_88h < 0) {\r\n 0x1836be066 | func_0x000184211d10(&var_78h, var_98h, var_90h);\r\n 0x1836be085 | var_60h = CONCAT44(var_60h._4_4_, ((int32_t)var_80h == 1) + 1);\r\n 0x1836be090 | if ((int64_t)var_88h < 0) {\r\n 0x1836be0b0 | func_0x0001841dcbe0(var_98h, var_88h & 0x7fffffffffffffff);\r\n | }\r\n | } else {\r\n 0x1836bdc46 | var_68h = var_88h;\r\n 0x1836bdc56 | var_78h = var_98h;\r\n 0x1836bdc56 | iStack_70 = var_90h;\r\n 0x1836bdc68 | var_60h = (uint64_t)((iVar8 == 1) + 1);\r\n | }\r\n 0x1836bdc77 | var_b8h = 0;\r\n 0x1836bdc77 | uStack_b0 = 0;\r\n 0x1836bdc7a | iStack_a8 = 0;\r\n 0x1836bdc82 | func_0x000183929130(&var_78h, &var_98h);\r\n 0x1836bdc72 | func_0x0001812b4470(&var_b8h, &var_98h);\r\n 0x1836bdca0 | iVar5 = var_98h;\r\n 0x1836bdcab | if (var_98h != 0) {\r\n 0x1836be0c2 | iVar7 = var_90h << 5;\r\n 0x1836be0c9 | if (iVar7 != 0) {\r\n 0x1836be0cb | iVar1 = var_98h + -0x20;\r\n | do {\r\n 0x1836be0cf | func_0x000184e58cd0(iVar1 + iVar7);\r\n 0x1836be0d8 | iVar7 = iVar7 + -0x20;\r\n 0x1836be0dc | } while (iVar7 != 0);\r\n | }\r\n 0x1836be0e9 | var_90h = iVar5 - var_98h >> 5;\r\n 0x1836be101 | func_0x0001841dcbe0(var_98h, var_88h << 5);\r\n | }\r\n 0x1836bdcb9 | uStack_c8 = 0;\r\n 0x1836bdcbd | var_d8h = 0;\r\n 0x1836bdcbd | iStack_d0 = 0;\r\n 0x1836bdcb4 | func_0x000181800f90(&var_d8h, &var_b8h);\r\n 0x1836bdcd2 | iVar5 = func_0x000185f006b8(0x110);\r\n 0x1836bdcd2 | var_88h = uStack_c8;\r\n 0x1836bdcd2 | var_90h = iStack_d0;\r\n 0x1836bdcd2 | var_98h = var_d8h;\r\n 0x1836bdcdd | var_d8h = 0;\r\n 0x1836bdcef | iStack_d0 = 0;\r\n 0x1836bdcef | uStack_c8 = 0;\r\n 0x1836bdd07 | var_50h = 0x190c132a0;\r\n 0x1836bdd0a | uStack_48 = 0x1f;\r\n 0x1836bdd1a | func_0x000182422390(iVar5, 0x24c);\r\n 0x1836bdd1f | piVar6 = &var_e0h;\r\n | }\r\n 0x1836bdd24 | *piVar6 = iVar5;\r\n 0x1836bdd2a | func_0x000180eba190(iVar4);\r\n 0x1836bdd35 | if (var_d8h != 0) {\r\n 0x1836bde17 | func_0x000184780a80(&var_d8h);\r\n 0x1836bde2f | func_0x0001841dcbe0(var_d8h, uStack_c8 << 5);\r\n | }\r\n 0x1836bdd43 | if (var_b8h != 0) {\r\n 0x1836bde39 | func_0x000184780a80(&var_b8h);\r\n 0x1836bde51 | func_0x0001841dcbe0(var_b8h, iStack_a8 << 5);\r\n | }\r\n 0x1836bdd51 | if (var_68h < 0) {\r\n 0x1836bdd6d | func_0x0001841dcbe0(var_78h, var_68h & 0x7fffffffffffffff);\r\n | }\r\n 0x1836bdd77 | iVar5 = func_0x000185f006b8(0x110);\r\n 0x1836bdd8a | var_78h = 0;\r\n 0x1836bdd8a | iStack_70 = 0;\r\n 0x1836bdd8e | var_68h = 0;\r\n 0x1836bdda5 | var_98h = 0x190c132e8;\r\n 0x1836bdda8 | var_90h = 0x24;\r\n 0x1836bddb8 | func_0x000182422390(iVar5, 0x24e);\r\n 0x1836bddc8 | var_f0h = iVar5;\r\n 0x1836bddc8 | func_0x000180eba190(iVar4);\r\n | }\r\n | }\r\n 0x1836bdde2 | if (*(uint64_t *)0x191c71040 != (var_40h ^ (uint64_t)auStack_118)) {\r\n 0x1836be113 | func_0x000185f05b40(var_40h ^ (uint64_t)auStack_118);\r\n 0x1836be11b | pcVar2 = (code *)swi(3);\r\n 0x1836be11b | (*pcVar2)();\r\n 0x1836be11b | return;\r\n | }\r\n 0x1836bddfd | return;\r\n |}\r\n[{\"offset\":6499851152,\"name\":\"fcn.1836bdb90\",\"size\":1420,\"is-pure\":false,\"realsz\":1420,\"noreturn\":false,\"stackframe\":280,\"calltype\":\"ms\",\"cost\":385,\"cc\":21,\"loops\":11,\"bits\":64,\"type\":\"fcn\",\"nbbs\":41,\"edges\":58,\"ebbs\":2,\"signature\":\"fcn.1836bdb90(int64_t arg1, int64_t arg2, int64_t arg3, int64_t arg4);\",\"minbound\":6499851152,\"maxbound\":6499852572,\"callrefs\":[{\"from\":6499851213,\"to\":6448258368,\"type\":\"CALL\"},{\"from\":6499851227,\"to\":6512708384,\"type\":\"CALL\"},{\"from\":6499851413,\"to\":6502388016,\"type\":\"CALL\"},{\"from\":6499851424,\"to\":6462063728,\"type\":\"CALL\"},{\"from\":6499851464,\"to\":6467620752,\"type\":\"CALL\"},{\"from\":6499851474,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6499851546,\"to\":6480339856,\"type\":\"CALL\"},{\"from\":6499851562,\"to\":6457893264,\"type\":\"CALL\"},{\"from\":6499851629,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6499851639,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6499851704,\"to\":6480339856,\"type\":\"CALL\"},{\"from\":6499851720,\"to\":6457893264,\"type\":\"CALL\"},{\"from\":6499851789,\"to\":6511513840,\"type\":\"CALL\"},{\"from\":6499851794,\"to\":6499851286,\"type\":\"CODE\"},{\"from\":6499851807,\"to\":6517426816,\"type\":\"CALL\"},{\"from\":6499851823,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6499851828,\"to\":6499851579,\"type\":\"CODE\"},{\"from\":6499851841,\"to\":6517426816,\"type\":\"CALL\"},{\"from\":6499851857,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6499851862,\"to\":6499851593,\"type\":\"CODE\"},{\"from\":6499851882,\"to\":6511513840,\"type\":\"CALL\"},{\"from\":6499851887,\"to\":6499851918,\"type\":\"CODE\"},{\"from\":6499852045,\"to\":6502388016,\"type\":\"CALL\"},{\"from\":6499852056,\"to\":6462063728,\"type\":\"CALL\"},{\"from\":6499852096,\"to\":6467620752,\"type\":\"CALL\"},{\"from\":6499852106,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6499852178,\"to\":6480339856,\"type\":\"CALL\"},{\"from\":6499852188,\"to\":6499851556,\"type\":\"CODE\"},{\"from\":6499852220,\"to\":6511729936,\"type\":\"CALL\"},{\"from\":6499852283,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6499852288,\"to\":6499852007,\"type\":\"CODE\"},{\"from\":6499852318,\"to\":6524603600,\"type\":\"CALL\"},{\"from\":6499852364,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6499852369,\"to\":6499852073,\"type\":\"CODE\"},{\"from\":6499852401,\"to\":6511729936,\"type\":\"CALL\"},{\"from\":6499852464,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6499852469,\"to\":6499851375,\"type\":\"CODE\"},{\"from\":6499852499,\"to\":6524603600,\"type\":\"CALL\"},{\"from\":6499852545,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6499852550,\"to\":6499851441,\"type\":\"CODE\"},{\"from\":6499852566,\"to\":6542089024,\"type\":\"CALL\"}],\"datarefs\":[{\"from\":6499851173,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6499851512,\"to\":6723547808,\"type\":\"DATA\"},{\"from\":6499851670,\"to\":6723547880,\"type\":\"DATA\"},{\"from\":6499851736,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6499852144,\"to\":6723547840,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6499851794,\"to\":6499851286,\"type\":\"CODE\"},{\"from\":6499851828,\"to\":6499851579,\"type\":\"CODE\"},{\"from\":6499851862,\"to\":6499851593,\"type\":\"CODE\"},{\"from\":6499851887,\"to\":6499851918,\"type\":\"CODE\"},{\"from\":6499852188,\"to\":6499851556,\"type\":\"CODE\"},{\"from\":6499852288,\"to\":6499852007,\"type\":\"CODE\"},{\"from\":6499852369,\"to\":6499852073,\"type\":\"CODE\"},{\"from\":6499852469,\"to\":6499851375,\"type\":\"CODE\"},{\"from\":6499852550,\"to\":6499851441,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":9,\"outdegree\":32,\"nlocals\":17,\"nargs\":4,\"stackvars\":[{\"name\":\"var_f0h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-240}},{\"name\":\"var_e8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-232}},{\"name\":\"var_e0h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-224}},{\"name\":\"var_d8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-216}},{\"name\":\"var_b8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-184}},{\"name\":\"var_98h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-152}},{\"name\":\"var_90h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-144}},{\"name\":\"var_88h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-136}},{\"name\":\"var_81h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-129}},{\"name\":\"var_80h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-128}},{\"name\":\"var_78h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-120}},{\"name\":\"var_68h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-104}},{\"name\":\"var_61h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-97}},{\"name\":\"var_60h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-96}},{\"name\":\"var_50h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-80}},{\"name\":\"var_40h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-64}},{\"name\":\"var_38h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-56}}],\"regvars\":[{\"name\":\"arg3\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"r8\"}},{\"name\":\"arg4\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"r9\"}},{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"confidence":"observed","authority":"shipped-artifact","environment":null,"limitations":["The executable version and supported formats are reported as unknown because no reliable version probe was performed.","A non-zero process exit is preserved as an observed command result.","Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.","When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call."],"relationship_coverage":null,"locations":[{"kind":"artifact-path","path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"}],"evidence_links":[]},"meta":{"command":"execute-rizin-command","duration":"5113ms"}}