{"ok":true,"data":{"evidence_id":"ev_30376900aaa8c467bce4b43a32d493cbba03aa708fb3d5aa70e97cc15a6936ec","subject":{"name":"Tabbit.dll","digest":{"sha256":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c"},"local_path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","format":"unknown","architecture":null},"provider":{"id":"rizin","name":"Rizin","version":null},"analysis_profile":null,"predicate_type":"rea.reverse-engineering.command-observation","operation":"execute_rizin_command","parameters":{"path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","command":"e scr.color=0;af @ 0x1893211b0;pdgo @ 0x1893211b0;afij @ 0x1893211b0","provider_executable":"C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe","command_arguments":["-N","-q","-c","e scr.color=0;af @ 0x1893211b0;pdgo @ 0x1893211b0;afij @ 0x1893211b0","C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"]},"raw_result":{"stdout":" |\r\n 0x1893211b0 |void fcn.1893211b0(int64_t arg1, int64_t arg2)\r\n |{\r\n | int32_t *piVar1;\r\n | uint64_t uVar2;\r\n | undefined uVar3;\r\n | int64_t iVar4;\r\n | code *pcVar5;\r\n | char cVar6;\r\n | undefined8 uVar7;\r\n | undefined auStack_68 [40];\r\n | int64_t var_40h;\r\n | undefined8 uStack_38;\r\n | int64_t var_30h;\r\n | \r\n 0x1893211c6 | var_30h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_68;\r\n 0x1893211ce | uVar2 = arg1 + 0x94;\r\n 0x1893211e9 | if ((uVar2 & 0xfffffffc00000000) == *(uint64_t *)0x191cd6d08) {\r\n 0x1893211ee | func_0x0001841c7180(uVar2);\r\n | }\r\n 0x1893211f3 | uVar3 = *(undefined *)(arg1 + 0x94);\r\n 0x1893211fa | *(undefined *)(arg1 + 0x94) = 1;\r\n 0x18932120d | uVar7 = (*(code *)0x185f59da0)(arg1 + 8);\r\n 0x189321216 | cVar6 = func_0x00018931eed0(uVar7);\r\n 0x189321221 | if (((int32_t)arg2 != 0) && (cVar6 != '\\0')) {\r\n 0x189321223 | iVar4 = *(int64_t *)(arg1 + 0x70);\r\n 0x189321227 | *(undefined8 *)(arg1 + 0x70) = 0;\r\n 0x189321232 | if (iVar4 != 0) {\r\n 0x189321234 | LOCK();\r\n 0x189321234 | piVar1 = (int32_t *)(iVar4 + 8);\r\n 0x189321234 | *piVar1 = *piVar1 + -1;\r\n 0x189321234 | UNLOCK();\r\n 0x189321238 | if (*piVar1 == 0) {\r\n 0x189321246 | (*(code *)0x185f59da0)(iVar4, 1);\r\n | }\r\n | }\r\n | }\r\n 0x18932125a | uVar7 = (*(code *)0x185f59da0)();\r\n 0x18932126c | var_40h = 0x190870178;\r\n 0x18932126f | uStack_38 = 0x1b;\r\n 0x18932127d | func_0x000182e4f360(uVar7, &var_40h, arg2 & 0xffffffff);\r\n 0x189321282 | *(undefined *)(arg1 + 0x94) = uVar3;\r\n 0x189321290 | if ((uVar2 & 0xfffffffc00000000) == *(uint64_t *)0x191cd6d08) {\r\n 0x189321295 | func_0x00018005f390(uVar2);\r\n | }\r\n 0x18932129d | func_0x000182495a40(arg1);\r\n 0x1893212b4 | if (*(uint64_t *)0x191c71040 == (var_30h ^ (uint64_t)auStack_68)) {\r\n 0x1893212c0 | return;\r\n | }\r\n 0x1893212c6 | func_0x000185f05b40(var_30h ^ (uint64_t)auStack_68);\r\n 0x1893212ce | pcVar5 = (code *)swi(3);\r\n 0x1893212ce | (*pcVar5)();\r\n 0x1893212ce | return;\r\n |}\r\n[{\"offset\":6596727216,\"name\":\"fcn.1893211b0\",\"size\":287,\"is-pure\":false,\"realsz\":287,\"noreturn\":false,\"stackframe\":104,\"calltype\":\"ms\",\"cost\":104,\"cc\":9,\"loops\":0,\"bits\":64,\"type\":\"fcn\",\"nbbs\":12,\"edges\":17,\"ebbs\":2,\"signature\":\"fcn.1893211b0(int64_t arg1, int64_t arg2);\",\"minbound\":6596727216,\"maxbound\":6596727503,\"callrefs\":[{\"from\":6596727278,\"to\":6511423872,\"type\":\"CALL\"},{\"from\":6596727309,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6596727318,\"to\":6596718288,\"type\":\"CALL\"},{\"from\":6596727366,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6596727386,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6596727421,\"to\":6491009888,\"type\":\"CALL\"},{\"from\":6596727445,\"to\":6442840976,\"type\":\"CALL\"},{\"from\":6596727453,\"to\":6480812608,\"type\":\"CALL\"},{\"from\":6596727497,\"to\":6542089024,\"type\":\"CALL\"}],\"datarefs\":[{\"from\":6596727231,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6596727266,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6596727392,\"to\":6719734136,\"type\":\"DATA\"},{\"from\":6596727433,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6596727466,\"to\":6740709440,\"type\":\"DATA\"}],\"indegree\":0,\"outdegree\":9,\"nlocals\":2,\"nargs\":2,\"stackvars\":[{\"name\":\"var_40h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-64}},{\"name\":\"var_30h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-48}}],\"regvars\":[{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"normalized_result":{"stdout":" |\r\n 0x1893211b0 |void fcn.1893211b0(int64_t arg1, int64_t arg2)\r\n |{\r\n | int32_t *piVar1;\r\n | uint64_t uVar2;\r\n | undefined uVar3;\r\n | int64_t iVar4;\r\n | code *pcVar5;\r\n | char cVar6;\r\n | undefined8 uVar7;\r\n | undefined auStack_68 [40];\r\n | int64_t var_40h;\r\n | undefined8 uStack_38;\r\n | int64_t var_30h;\r\n | \r\n 0x1893211c6 | var_30h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_68;\r\n 0x1893211ce | uVar2 = arg1 + 0x94;\r\n 0x1893211e9 | if ((uVar2 & 0xfffffffc00000000) == *(uint64_t *)0x191cd6d08) {\r\n 0x1893211ee | func_0x0001841c7180(uVar2);\r\n | }\r\n 0x1893211f3 | uVar3 = *(undefined *)(arg1 + 0x94);\r\n 0x1893211fa | *(undefined *)(arg1 + 0x94) = 1;\r\n 0x18932120d | uVar7 = (*(code *)0x185f59da0)(arg1 + 8);\r\n 0x189321216 | cVar6 = func_0x00018931eed0(uVar7);\r\n 0x189321221 | if (((int32_t)arg2 != 0) && (cVar6 != '\\0')) {\r\n 0x189321223 | iVar4 = *(int64_t *)(arg1 + 0x70);\r\n 0x189321227 | *(undefined8 *)(arg1 + 0x70) = 0;\r\n 0x189321232 | if (iVar4 != 0) {\r\n 0x189321234 | LOCK();\r\n 0x189321234 | piVar1 = (int32_t *)(iVar4 + 8);\r\n 0x189321234 | *piVar1 = *piVar1 + -1;\r\n 0x189321234 | UNLOCK();\r\n 0x189321238 | if (*piVar1 == 0) {\r\n 0x189321246 | (*(code *)0x185f59da0)(iVar4, 1);\r\n | }\r\n | }\r\n | }\r\n 0x18932125a | uVar7 = (*(code *)0x185f59da0)();\r\n 0x18932126c | var_40h = 0x190870178;\r\n 0x18932126f | uStack_38 = 0x1b;\r\n 0x18932127d | func_0x000182e4f360(uVar7, &var_40h, arg2 & 0xffffffff);\r\n 0x189321282 | *(undefined *)(arg1 + 0x94) = uVar3;\r\n 0x189321290 | if ((uVar2 & 0xfffffffc00000000) == *(uint64_t *)0x191cd6d08) {\r\n 0x189321295 | func_0x00018005f390(uVar2);\r\n | }\r\n 0x18932129d | func_0x000182495a40(arg1);\r\n 0x1893212b4 | if (*(uint64_t *)0x191c71040 == (var_30h ^ (uint64_t)auStack_68)) {\r\n 0x1893212c0 | return;\r\n | }\r\n 0x1893212c6 | func_0x000185f05b40(var_30h ^ (uint64_t)auStack_68);\r\n 0x1893212ce | pcVar5 = (code *)swi(3);\r\n 0x1893212ce | (*pcVar5)();\r\n 0x1893212ce | return;\r\n |}\r\n[{\"offset\":6596727216,\"name\":\"fcn.1893211b0\",\"size\":287,\"is-pure\":false,\"realsz\":287,\"noreturn\":false,\"stackframe\":104,\"calltype\":\"ms\",\"cost\":104,\"cc\":9,\"loops\":0,\"bits\":64,\"type\":\"fcn\",\"nbbs\":12,\"edges\":17,\"ebbs\":2,\"signature\":\"fcn.1893211b0(int64_t arg1, int64_t arg2);\",\"minbound\":6596727216,\"maxbound\":6596727503,\"callrefs\":[{\"from\":6596727278,\"to\":6511423872,\"type\":\"CALL\"},{\"from\":6596727309,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6596727318,\"to\":6596718288,\"type\":\"CALL\"},{\"from\":6596727366,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6596727386,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6596727421,\"to\":6491009888,\"type\":\"CALL\"},{\"from\":6596727445,\"to\":6442840976,\"type\":\"CALL\"},{\"from\":6596727453,\"to\":6480812608,\"type\":\"CALL\"},{\"from\":6596727497,\"to\":6542089024,\"type\":\"CALL\"}],\"datarefs\":[{\"from\":6596727231,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6596727266,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6596727392,\"to\":6719734136,\"type\":\"DATA\"},{\"from\":6596727433,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6596727466,\"to\":6740709440,\"type\":\"DATA\"}],\"indegree\":0,\"outdegree\":9,\"nlocals\":2,\"nargs\":2,\"stackvars\":[{\"name\":\"var_40h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-64}},{\"name\":\"var_30h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-48}}],\"regvars\":[{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"confidence":"observed","authority":"shipped-artifact","environment":null,"limitations":["The executable version and supported formats are reported as unknown because no reliable version probe was performed.","A non-zero process exit is preserved as an observed command result.","Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.","When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call."],"relationship_coverage":null,"locations":[{"kind":"artifact-path","path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"}],"evidence_links":[]},"meta":{"command":"execute-rizin-command","duration":"4895ms"}}