{"ok":true,"data":{"evidence_id":"ev_572995ccc485496ed71abbb3b006662bce5699599136af3faff8fe3aef342a9b","subject":{"name":"Tabbit.dll","digest":{"sha256":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c"},"local_path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","format":"unknown","architecture":null},"provider":{"id":"rizin","name":"Rizin","version":null},"analysis_profile":null,"predicate_type":"rea.reverse-engineering.command-observation","operation":"execute_rizin_command","parameters":{"path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","command":"e scr.color=0;af @ 0x183842c70;pdgo @ 0x183842c70;afij @ 0x183842c70","provider_executable":"C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe","command_arguments":["-N","-q","-c","e scr.color=0;af @ 0x183842c70;pdgo @ 0x183842c70;afij @ 0x183842c70","C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"]},"raw_result":{"stdout":"    0x183842c70    |\r\n    0x183842c70    |// WARNING: [rz-ghidra] Detected overlap for variable var_22h\r\n    0x183842c70    |// WARNING: [rz-ghidra] Detected overlap for variable var_23h\r\n    0x183842c70    |// WARNING: [rz-ghidra] Detected overlap for variable var_21h\r\n    0x183842c70    |// WARNING: [rz-ghidra] Detected overlap for variable var_89h\r\n    0x183842c70    |// WARNING: [rz-ghidra] Detected overlap for variable var_68h\r\n    0x183842c70    |// WARNING: [rz-ghidra] Detected overlap for variable var_49h\r\n                   |\r\n    0x183842c70    |int64_t fcn.183842c70(int64_t arg1, int64_t arg2)\r\n                   |{\r\n                   |    code *pcVar1;\r\n                   |    int64_t iVar2;\r\n                   |    int64_t *piVar3;\r\n                   |    int64_t *piVar4;\r\n                   |    undefined auStack_b8 [47];\r\n                   |    undefined var_89h;\r\n                   |    int64_t var_88h;\r\n                   |    int64_t var_80h;\r\n                   |    int64_t var_78h;\r\n                   |    int64_t var_69h;\r\n                   |    undefined4 uStack_60;\r\n                   |    undefined4 uStack_5c;\r\n                   |    undefined4 uStack_58;\r\n                   |    int64_t var_54h;\r\n                   |    undefined var_49h;\r\n                   |    int64_t var_48h;\r\n                   |    undefined4 uStack_40;\r\n                   |    undefined4 uStack_3c;\r\n                   |    undefined2 uStack_38;\r\n                   |    int64_t var_36h;\r\n                   |    undefined var_23h [3];\r\n                   |    int64_t var_20h;\r\n                   |    \r\n    0x183842c81    |    var_20h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_b8;\r\n    0x183842c90    |    if (*(char *)(arg1 + 0x30) == '\\0') {\r\n                   |code_r0x000183842e6f:\r\n    0x183842e6f    |    // WARNING: Does not return\r\n    0x183842e6f    |        pcVar1 = (code *)invalidInstructionException();\r\n    0x183842e6f    |        (*pcVar1)();\r\n                   |    }\r\n    0x183842ca4    |    var_23h._1_2_ = 0;\r\n    0x183842c9c    |    func_0x00018391a1b0(var_23h + 1, arg1 + 0x18);\r\n    0x183842cb9    |    if (var_23h[2] == '\\0') {\r\n    0x183842d98    |        var_36h._5_1_ = 0x12;\r\n    0x183842db6    |        if ((int64_t *)0x1905959d0 < &var_36h && &var_48h < (int64_t *)0x1905959d1) goto code_r0x000183842e6f;\r\n    0x183842dc3    |        piVar4 = &var_48h;\r\n    0x183842dc8    |        uStack_38 = 0x7372;\r\n    0x183842dd4    |        var_48h._0_4_ = 0x61766e49;\r\n    0x183842dd4    |        var_48h._4_4_ = 0x2064696c;\r\n    0x183842dd4    |        uStack_40 = 0x61726170;\r\n    0x183842dd4    |        uStack_3c = 0x6574656d;\r\n    0x183842dd8    |        var_36h._0_1_ = 0;\r\n    0x183842ddd    |        piVar3 = (int64_t *)var_23h;\r\n    0x183842cd5    |    } else if ((*(int64_t *)(arg1 + 0x1d0) == 0) && (*(int64_t *)(arg1 + 0x1c8) == 0)) {\r\n    0x183842e28    |        var_54h._3_1_ = 0x14;\r\n    0x183842e46    |        if ((int64_t *)0x190c26960 < &var_54h && (int64_t)&var_69h + 1U < 0x190c26961) goto code_r0x000183842e6f;\r\n    0x183842e48    |        var_69h._1_4_ = 0x70206f4e;\r\n    0x183842e48    |        unique0x100001fd = 0x69666f72;\r\n    0x183842e48    |        uStack_60 = 0x6120656c;\r\n    0x183842e48    |        uStack_5c = 0x6c696176;\r\n    0x183842e4f    |        piVar4 = (int64_t *)((int64_t)&var_69h + 1);\r\n    0x183842e58    |        uStack_58 = 0x656c6261;\r\n    0x183842e60    |        var_54h._0_1_ = 0;\r\n    0x183842e65    |        piVar3 = (int64_t *)&var_49h;\r\n                   |    } else {\r\n    0x183842cdb    |        iVar2 = func_0x00018596d320();\r\n    0x183842ce3    |        if (iVar2 != 0) {\r\n    0x183842ced    |            if (var_23h[2] == '\\0') goto code_r0x000183842e6f;\r\n    0x183842d00    |            func_0x0001893211b0(iVar2, var_23h[1] + 1);\r\n    0x183842d05    |            piVar3 = (int64_t *)&var_89h;\r\n    0x183842d10    |            func_0x000188ac53a0(arg1, piVar3);\r\n    0x183842d15    |            goto code_r0x000183842df0;\r\n                   |        }\r\n    0x183842d1f    |        var_88h = func_0x000185f006b8(0x20);\r\n    0x183842d29    |        var_80h = 0x1b;\r\n    0x183842d3c    |        var_78h = -0x7fffffffffffffe0;\r\n    0x183842d65    |        if (((undefined4 *)(var_88h + 0x1b) < (uint64_t)var_88h) ||\r\n    0x183842d5f    |           ((undefined4 *)0x190c26a30 < (undefined4 *)(var_88h + 0x1b) && (uint64_t)var_88h < (undefined4 *)0x190c26a31)\r\n    0x183842d65    |           ) goto code_r0x000183842e6f;\r\n    0x183842d72    |        *(undefined8 *)(var_88h + 0xb) = 0x6120746f6e206563;\r\n    0x183842d72    |        *(undefined8 *)(var_88h + 0x13) = 0x656c62616c696176;\r\n    0x183842d7d    |        *(undefined4 *)var_88h = 0x6d656854;\r\n    0x183842d7d    |        *(undefined4 *)(var_88h + 4) = 0x65732065;\r\n    0x183842d7d    |        *(undefined4 *)(var_88h + 8) = 0x63697672;\r\n    0x183842d7d    |        *(undefined4 *)(var_88h + 0xc) = 0x6f6e2065;\r\n    0x183842d80    |        *(undefined *)(var_88h + 0x1b) = 0;\r\n    0x183842d84    |        piVar3 = &var_69h;\r\n    0x183842d89    |        piVar4 = &var_88h;\r\n                   |    }\r\n    0x183842deb    |    func_0x000188ac4940(arg1, piVar3, piVar4);\r\n                   |code_r0x000183842df0:\r\n    0x183842df9    |    func_0x000188ac4bd0(arg1, arg2, piVar3);\r\n    0x183842e13    |    if (*(uint64_t *)0x191c71040 == (var_20h ^ (uint64_t)auStack_b8)) {\r\n    0x183842e22    |        return arg2;\r\n                   |    }\r\n    0x183842e79    |    func_0x000185f05b40(var_20h ^ (uint64_t)auStack_b8);\r\n    0x183842e81    |    pcVar1 = (code *)swi(3);\r\n    0x183842e81    |    iVar2 = (*pcVar1)();\r\n    0x183842e81    |    return iVar2;\r\n                   |}\r\n[{\"offset\":6501444720,\"name\":\"fcn.183842c70\",\"size\":530,\"is-pure\":false,\"realsz\":530,\"noreturn\":false,\"stackframe\":184,\"calltype\":\"ms\",\"cost\":151,\"cc\":14,\"loops\":1,\"bits\":64,\"type\":\"fcn\",\"nbbs\":19,\"edges\":27,\"ebbs\":3,\"signature\":\"fcn.183842c70(int64_t arg1, int64_t arg2);\",\"minbound\":6501444720,\"maxbound\":6501445250,\"callrefs\":[{\"from\":6501444784,\"to\":6502326704,\"type\":\"CALL\"},{\"from\":6501444827,\"to\":6536221472,\"type\":\"CALL\"},{\"from\":6501444864,\"to\":6596727216,\"type\":\"CALL\"},{\"from\":6501444880,\"to\":6587962272,\"type\":\"CALL\"},{\"from\":6501444885,\"to\":6501445104,\"type\":\"CODE\"},{\"from\":6501444895,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6501445006,\"to\":6501445093,\"type\":\"CODE\"},{\"from\":6501445099,\"to\":6587959616,\"type\":\"CALL\"},{\"from\":6501445113,\"to\":6587960272,\"type\":\"CALL\"},{\"from\":6501445226,\"to\":6501445093,\"type\":\"CODE\"},{\"from\":6501445244,\"to\":6542089024,\"type\":\"CALL\"}],\"datarefs\":[{\"from\":6501444730,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6501444942,\"to\":6723627568,\"type\":\"DATA\"},{\"from\":6501444971,\"to\":6723627579,\"type\":\"DATA\"},{\"from\":6501444982,\"to\":6723627568,\"type\":\"DATA\"},{\"from\":6501445020,\"to\":6716742096,\"type\":\"DATA\"},{\"from\":6501445052,\"to\":6716742112,\"type\":\"DATA\"},{\"from\":6501445069,\"to\":6716742096,\"type\":\"DATA\"},{\"from\":6501445129,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6501445164,\"to\":6723627360,\"type\":\"DATA\"},{\"from\":6501445192,\"to\":6723627360,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6501444885,\"to\":6501445104,\"type\":\"CODE\"},{\"from\":6501445006,\"to\":6501445093,\"type\":\"CODE\"},{\"from\":6501445226,\"to\":6501445093,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":3,\"outdegree\":8,\"nlocals\":14,\"nargs\":2,\"stackvars\":[{\"name\":\"var_89h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-137}},{\"name\":\"var_88h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-136}},{\"name\":\"var_80h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-128}},{\"name\":\"var_78h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-120}},{\"name\":\"var_69h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-105}},{\"name\":\"var_68h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-104}},{\"name\":\"var_54h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-84}},{\"name\":\"var_49h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-73}},{\"name\":\"var_48h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-72}},{\"name\":\"var_36h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-54}},{\"name\":\"var_23h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-35}},{\"name\":\"var_22h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-34}},{\"name\":\"var_21h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-33}},{\"name\":\"var_20h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-32}}],\"regvars\":[{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"normalized_result":{"stdout":"    0x183842c70    |\r\n    0x183842c70    |// WARNING: [rz-ghidra] Detected overlap for variable var_22h\r\n    0x183842c70    |// WARNING: [rz-ghidra] Detected overlap for variable var_23h\r\n    0x183842c70    |// WARNING: [rz-ghidra] Detected overlap for variable var_21h\r\n    0x183842c70    |// WARNING: [rz-ghidra] Detected overlap for variable var_89h\r\n    0x183842c70    |// WARNING: [rz-ghidra] Detected overlap for variable var_68h\r\n    0x183842c70    |// WARNING: [rz-ghidra] Detected overlap for variable var_49h\r\n                   |\r\n    0x183842c70    |int64_t fcn.183842c70(int64_t arg1, int64_t arg2)\r\n                   |{\r\n                   |    code *pcVar1;\r\n                   |    int64_t iVar2;\r\n                   |    int64_t *piVar3;\r\n                   |    int64_t *piVar4;\r\n                   |    undefined auStack_b8 [47];\r\n                   |    undefined var_89h;\r\n                   |    int64_t var_88h;\r\n                   |    int64_t var_80h;\r\n                   |    int64_t var_78h;\r\n                   |    int64_t var_69h;\r\n                   |    undefined4 uStack_60;\r\n                   |    undefined4 uStack_5c;\r\n                   |    undefined4 uStack_58;\r\n                   |    int64_t var_54h;\r\n                   |    undefined var_49h;\r\n                   |    int64_t var_48h;\r\n                   |    undefined4 uStack_40;\r\n                   |    undefined4 uStack_3c;\r\n                   |    undefined2 uStack_38;\r\n                   |    int64_t var_36h;\r\n                   |    undefined var_23h [3];\r\n                   |    int64_t var_20h;\r\n                   |    \r\n    0x183842c81    |    var_20h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_b8;\r\n    0x183842c90    |    if (*(char *)(arg1 + 0x30) == '\\0') {\r\n                   |code_r0x000183842e6f:\r\n    0x183842e6f    |    // WARNING: Does not return\r\n    0x183842e6f    |        pcVar1 = (code *)invalidInstructionException();\r\n    0x183842e6f    |        (*pcVar1)();\r\n                   |    }\r\n    0x183842ca4    |    var_23h._1_2_ = 0;\r\n    0x183842c9c    |    func_0x00018391a1b0(var_23h + 1, arg1 + 0x18);\r\n    0x183842cb9    |    if (var_23h[2] == '\\0') {\r\n    0x183842d98    |        var_36h._5_1_ = 0x12;\r\n    0x183842db6    |        if ((int64_t *)0x1905959d0 < &var_36h && &var_48h < (int64_t *)0x1905959d1) goto code_r0x000183842e6f;\r\n    0x183842dc3    |        piVar4 = &var_48h;\r\n    0x183842dc8    |        uStack_38 = 0x7372;\r\n    0x183842dd4    |        var_48h._0_4_ = 0x61766e49;\r\n    0x183842dd4    |        var_48h._4_4_ = 0x2064696c;\r\n    0x183842dd4    |        uStack_40 = 0x61726170;\r\n    0x183842dd4    |        uStack_3c = 0x6574656d;\r\n    0x183842dd8    |        var_36h._0_1_ = 0;\r\n    0x183842ddd    |        piVar3 = (int64_t *)var_23h;\r\n    0x183842cd5    |    } else if ((*(int64_t *)(arg1 + 0x1d0) == 0) && (*(int64_t *)(arg1 + 0x1c8) == 0)) {\r\n    0x183842e28    |        var_54h._3_1_ = 0x14;\r\n    0x183842e46    |        if ((int64_t *)0x190c26960 < &var_54h && (int64_t)&var_69h + 1U < 0x190c26961) goto code_r0x000183842e6f;\r\n    0x183842e48    |        var_69h._1_4_ = 0x70206f4e;\r\n    0x183842e48    |        unique0x100001fd = 0x69666f72;\r\n    0x183842e48    |        uStack_60 = 0x6120656c;\r\n    0x183842e48    |        uStack_5c = 0x6c696176;\r\n    0x183842e4f    |        piVar4 = (int64_t *)((int64_t)&var_69h + 1);\r\n    0x183842e58    |        uStack_58 = 0x656c6261;\r\n    0x183842e60    |        var_54h._0_1_ = 0;\r\n    0x183842e65    |        piVar3 = (int64_t *)&var_49h;\r\n                   |    } else {\r\n    0x183842cdb    |        iVar2 = func_0x00018596d320();\r\n    0x183842ce3    |        if (iVar2 != 0) {\r\n    0x183842ced    |            if (var_23h[2] == '\\0') goto code_r0x000183842e6f;\r\n    0x183842d00    |            func_0x0001893211b0(iVar2, var_23h[1] + 1);\r\n    0x183842d05    |            piVar3 = (int64_t *)&var_89h;\r\n    0x183842d10    |            func_0x000188ac53a0(arg1, piVar3);\r\n    0x183842d15    |            goto code_r0x000183842df0;\r\n                   |        }\r\n    0x183842d1f    |        var_88h = func_0x000185f006b8(0x20);\r\n    0x183842d29    |        var_80h = 0x1b;\r\n    0x183842d3c    |        var_78h = -0x7fffffffffffffe0;\r\n    0x183842d65    |        if (((undefined4 *)(var_88h + 0x1b) < (uint64_t)var_88h) ||\r\n    0x183842d5f    |           ((undefined4 *)0x190c26a30 < (undefined4 *)(var_88h + 0x1b) && (uint64_t)var_88h < (undefined4 *)0x190c26a31)\r\n    0x183842d65    |           ) goto code_r0x000183842e6f;\r\n    0x183842d72    |        *(undefined8 *)(var_88h + 0xb) = 0x6120746f6e206563;\r\n    0x183842d72    |        *(undefined8 *)(var_88h + 0x13) = 0x656c62616c696176;\r\n    0x183842d7d    |        *(undefined4 *)var_88h = 0x6d656854;\r\n    0x183842d7d    |        *(undefined4 *)(var_88h + 4) = 0x65732065;\r\n    0x183842d7d    |        *(undefined4 *)(var_88h + 8) = 0x63697672;\r\n    0x183842d7d    |        *(undefined4 *)(var_88h + 0xc) = 0x6f6e2065;\r\n    0x183842d80    |        *(undefined *)(var_88h + 0x1b) = 0;\r\n    0x183842d84    |        piVar3 = &var_69h;\r\n    0x183842d89    |        piVar4 = &var_88h;\r\n                   |    }\r\n    0x183842deb    |    func_0x000188ac4940(arg1, piVar3, piVar4);\r\n                   |code_r0x000183842df0:\r\n    0x183842df9    |    func_0x000188ac4bd0(arg1, arg2, piVar3);\r\n    0x183842e13    |    if (*(uint64_t *)0x191c71040 == (var_20h ^ (uint64_t)auStack_b8)) {\r\n    0x183842e22    |        return arg2;\r\n                   |    }\r\n    0x183842e79    |    func_0x000185f05b40(var_20h ^ (uint64_t)auStack_b8);\r\n    0x183842e81    |    pcVar1 = (code *)swi(3);\r\n    0x183842e81    |    iVar2 = (*pcVar1)();\r\n    0x183842e81    |    return iVar2;\r\n                   |}\r\n[{\"offset\":6501444720,\"name\":\"fcn.183842c70\",\"size\":530,\"is-pure\":false,\"realsz\":530,\"noreturn\":false,\"stackframe\":184,\"calltype\":\"ms\",\"cost\":151,\"cc\":14,\"loops\":1,\"bits\":64,\"type\":\"fcn\",\"nbbs\":19,\"edges\":27,\"ebbs\":3,\"signature\":\"fcn.183842c70(int64_t arg1, int64_t arg2);\",\"minbound\":6501444720,\"maxbound\":6501445250,\"callrefs\":[{\"from\":6501444784,\"to\":6502326704,\"type\":\"CALL\"},{\"from\":6501444827,\"to\":6536221472,\"type\":\"CALL\"},{\"from\":6501444864,\"to\":6596727216,\"type\":\"CALL\"},{\"from\":6501444880,\"to\":6587962272,\"type\":\"CALL\"},{\"from\":6501444885,\"to\":6501445104,\"type\":\"CODE\"},{\"from\":6501444895,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6501445006,\"to\":6501445093,\"type\":\"CODE\"},{\"from\":6501445099,\"to\":6587959616,\"type\":\"CALL\"},{\"from\":6501445113,\"to\":6587960272,\"type\":\"CALL\"},{\"from\":6501445226,\"to\":6501445093,\"type\":\"CODE\"},{\"from\":6501445244,\"to\":6542089024,\"type\":\"CALL\"}],\"datarefs\":[{\"from\":6501444730,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6501444942,\"to\":6723627568,\"type\":\"DATA\"},{\"from\":6501444971,\"to\":6723627579,\"type\":\"DATA\"},{\"from\":6501444982,\"to\":6723627568,\"type\":\"DATA\"},{\"from\":6501445020,\"to\":6716742096,\"type\":\"DATA\"},{\"from\":6501445052,\"to\":6716742112,\"type\":\"DATA\"},{\"from\":6501445069,\"to\":6716742096,\"type\":\"DATA\"},{\"from\":6501445129,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6501445164,\"to\":6723627360,\"type\":\"DATA\"},{\"from\":6501445192,\"to\":6723627360,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6501444885,\"to\":6501445104,\"type\":\"CODE\"},{\"from\":6501445006,\"to\":6501445093,\"type\":\"CODE\"},{\"from\":6501445226,\"to\":6501445093,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":3,\"outdegree\":8,\"nlocals\":14,\"nargs\":2,\"stackvars\":[{\"name\":\"var_89h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-137}},{\"name\":\"var_88h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-136}},{\"name\":\"var_80h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-128}},{\"name\":\"var_78h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-120}},{\"name\":\"var_69h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-105}},{\"name\":\"var_68h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-104}},{\"name\":\"var_54h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-84}},{\"name\":\"var_49h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-73}},{\"name\":\"var_48h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-72}},{\"name\":\"var_36h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-54}},{\"name\":\"var_23h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-35}},{\"name\":\"var_22h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-34}},{\"name\":\"var_21h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-33}},{\"name\":\"var_20h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-32}}],\"regvars\":[{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"confidence":"observed","authority":"shipped-artifact","environment":null,"limitations":["The executable version and supported formats are reported as unknown because no reliable version probe was performed.","A non-zero process exit is preserved as an observed command result.","Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.","When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call."],"relationship_coverage":null,"locations":[{"kind":"artifact-path","path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"}],"evidence_links":[]},"meta":{"command":"execute-rizin-command","duration":"5020ms"}}