{"ok":true,"data":{"evidence_id":"ev_49a5765371ce53d8377e6f95cfde259f05851e800c375c560eda74616abb0300","subject":{"name":"Tabbit.dll","digest":{"sha256":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c"},"local_path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","format":"unknown","architecture":null},"provider":{"id":"rizin","name":"Rizin","version":null},"analysis_profile":null,"predicate_type":"rea.reverse-engineering.command-observation","operation":"execute_rizin_command","parameters":{"path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","command":"e scr.color=0;af @ 0x183506850;pdgo @ 0x183506850;afij @ 0x183506850","provider_executable":"C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe","command_arguments":["-N","-q","-c","e scr.color=0;af @ 0x183506850;pdgo @ 0x183506850;afij @ 0x183506850","C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"]},"raw_result":{"stdout":" 0x183506850 |\r\n 0x183506850 |// WARNING: [rz-ghidra] Detected overlap for variable var_3e9h\r\n 0x183506850 |// WARNING: [rz-ghidra] Detected overlap for variable var_198h\r\n |\r\n 0x183506850 |void fcn.183506850(int64_t arg1, int64_t arg2, int64_t arg3)\r\n |{\r\n | int64_t iVar1;\r\n | int32_t *piVar2;\r\n | int32_t *piVar3;\r\n | code *pcVar4;\r\n | char cVar5;\r\n | undefined8 uVar6;\r\n | undefined4 *puVar7;\r\n | uint64_t uVar8;\r\n | undefined4 uVar9;\r\n | undefined auStack_1c8 [40];\r\n | int64_t var_1a0h;\r\n | int64_t var_198h;\r\n | int64_t var_190h;\r\n | int64_t var_188h;\r\n | int64_t var_180h;\r\n | undefined8 uStack_178;\r\n | int64_t var_170h;\r\n | undefined8 uStack_168;\r\n | int64_t var_160h;\r\n | undefined8 uStack_150;\r\n | int64_t var_28h;\r\n | \r\n 0x183506863 | var_28h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_1c8;\r\n 0x183506871 | if (*(char *)arg1 == '\\0') {\r\n 0x1835068a9 | uVar6 = fcn.185f006b8(0xa0);\r\n 0x1835068ba | fcn.18350d7b0(uVar6, arg2, arg3);\r\n 0x1835068bf | iVar1 = *(int64_t *)(arg1 + 8);\r\n 0x1835068c3 | *(undefined8 *)(arg1 + 8) = uVar6;\r\n 0x1835068ca | if (iVar1 != 0) {\r\n 0x1835068cf | fcn.18350d850(iVar1);\r\n 0x1835068dc | fcn.1841dcbe0(iVar1, 0xa0);\r\n | }\r\n 0x1835068e1 | fcn.185f5a0c0(&var_160h, 0, 0x138);\r\n 0x183506902 | var_170h = 0x190b79c68;\r\n 0x183506905 | uStack_168 = 0x13;\r\n 0x183506919 | var_180h = 0x190b79c80;\r\n 0x18350691c | uStack_178 = 0xe2;\r\n 0x1835068e1 | fcn.18ad74f10(&var_160h);\r\n 0x18350692c | uStack_150 = 0x20000000;\r\n 0x183506940 | var_1a0h = 0;\r\n 0x18350694d | cVar5 = fcn.1886cb570(*(undefined8 *)0x191dbee08, &var_160h, &var_1a0h, 0);\r\n 0x183506954 | if (cVar5 == '\\0') {\r\n 0x183506a36 | iVar1 = *(int64_t *)(arg1 + 8);\r\n 0x183506a3a | *(undefined8 *)(arg1 + 8) = 0;\r\n 0x183506a45 | if (iVar1 != 0) {\r\n 0x183506a4a | fcn.18350d850(iVar1);\r\n 0x183506a57 | fcn.1841dcbe0(iVar1, 0xa0);\r\n | }\r\n 0x183506a61 | uVar8 = fcn.185f006b8(0xb0);\r\n 0x183506a6e | var_198h = 0x52;\r\n 0x183506a81 | var_190h = -0x7fffffffffffffa8;\r\n 0x183506a90 | var_1a0h = uVar8;\r\n 0x183506aab | if ((uVar8 + 0xa4 < uVar8) || (0x190b79d70 < uVar8 + 0xa4 && uVar8 < 0x190b79d71)) {\r\n 0x183506b50 | // WARNING: Does not return\r\n 0x183506b50 | pcVar4 = (code *)invalidInstructionException();\r\n 0x183506b50 | (*pcVar4)();\r\n | }\r\n 0x183506ac1 | uVar9 = fcn.185f5a940(uVar8, 0x190b79d70, 0xa4);\r\n 0x183506ac6 | *(undefined2 *)(uVar8 + 0xa4) = 0;\r\n 0x183506ad7 | fcn.18a204d80(uVar9, &var_1a0h);\r\n 0x183506ae0 | if (var_190h < 0) {\r\n 0x183506af3 | fcn.1841dcbe0(var_1a0h, var_190h * 2);\r\n | }\r\n | } else {\r\n 0x18350695a | *(undefined *)arg1 = 1;\r\n 0x183506971 | if ((arg1 & 0xfffffffc00000000U) == *(uint64_t *)0x191cd6d08) {\r\n 0x183506976 | fcn.1841c7180(arg1);\r\n | }\r\n 0x183506984 | puVar7 = (undefined4 *)fcn.185f006b8(0x30);\r\n 0x18350698c | *puVar7 = 1;\r\n 0x183506999 | *(undefined8 *)(puVar7 + 2) = 0x1803915b0;\r\n 0x1835069a4 | *(undefined8 *)(puVar7 + 4) = 0x182bee630;\r\n 0x1835069af | *(undefined8 *)(puVar7 + 6) = 0x1841d75d0;\r\n 0x1835069ba | *(undefined8 *)(puVar7 + 8) = 0x183506b70;\r\n 0x1835069be | *(int64_t *)(puVar7 + 10) = arg1;\r\n 0x1835069d0 | fcn.184339cd0(&var_1a0h, 0x190b79e50, 0x190b79e18, 0xbd);\r\n 0x1835069e0 | piVar2 = *(int32_t **)(arg1 + 0x70);\r\n 0x1835069e4 | *(undefined4 **)(arg1 + 0x70) = puVar7;\r\n 0x1835069eb | if (piVar2 != (int32_t *)0x0) {\r\n 0x183506afd | LOCK();\r\n 0x183506afd | *piVar2 = *piVar2 + -1;\r\n 0x183506afd | UNLOCK();\r\n 0x183506b00 | if (*piVar2 == 0) {\r\n 0x183506b14 | if (*(int64_t *)(piVar2 + 4) == 0x182bf38a0) {\r\n 0x183506b24 | piVar3 = *(int32_t **)(piVar2 + 0xc);\r\n 0x183506b2b | if (piVar3 != (int32_t *)0x0) {\r\n 0x183506b3f | LOCK();\r\n 0x183506b3f | *piVar3 = *piVar3 + -1;\r\n 0x183506b3f | UNLOCK();\r\n 0x183506b42 | if (*piVar3 == 0) {\r\n 0x183506b49 | fcn.1841dcbe0(piVar3, 8);\r\n | }\r\n | }\r\n 0x183506b35 | fcn.1841dcbe0(piVar2, 0x48);\r\n | } else {\r\n 0x183506b19 | (*case.0x1841dcc6f.0)(piVar2);\r\n | }\r\n | }\r\n | }\r\n 0x1835069f5 | *(undefined4 *)(arg1 + 0x38) = (undefined4)var_190h;\r\n 0x1835069fd | *(undefined4 *)(arg1 + 0x28) = (undefined4)var_1a0h;\r\n 0x1835069fd | *(undefined4 *)(arg1 + 0x2c) = var_1a0h._4_4_;\r\n 0x1835069fd | *(undefined4 *)(arg1 + 0x30) = (undefined4)var_198h;\r\n 0x1835069fd | *(undefined4 *)(arg1 + 0x34) = var_198h._4_4_;\r\n 0x183506a06 | *(int64_t *)(arg1 + 0x40) = var_188h;\r\n 0x183506a0a | *(undefined8 *)(arg1 + 0x58) = 60000000;\r\n 0x18350697b | fcn.18477a0a0(arg1 + 0x18);\r\n 0x183506a1a | *(undefined *)(arg1 + 1) = 1;\r\n 0x183506a1e | fcn.18a204cb0(*(undefined8 *)(arg1 + 0x10));\r\n | }\r\n 0x183506a27 | fcn.18052ad00(&var_160h);\r\n | }\r\n 0x183506888 | if (*(uint64_t *)0x191c71040 == (var_28h ^ (uint64_t)auStack_1c8)) {\r\n 0x18350689a | return;\r\n | }\r\n 0x183506b5a | fcn.185f05b40(var_28h ^ (uint64_t)auStack_1c8);\r\n 0x183506b62 | pcVar4 = (code *)swi(3);\r\n 0x183506b62 | (*pcVar4)();\r\n 0x183506b62 | return;\r\n |}\r\n[{\"offset\":6498052176,\"name\":\"fcn.183506850\",\"size\":787,\"is-pure\":false,\"realsz\":787,\"noreturn\":false,\"stackframe\":456,\"calltype\":\"ms\",\"cost\":244,\"cc\":17,\"loops\":8,\"bits\":64,\"type\":\"fcn\",\"nbbs\":26,\"edges\":37,\"ebbs\":3,\"signature\":\"fcn.183506850(int64_t arg1, int64_t arg2, int64_t arg3);\",\"minbound\":6498052176,\"maxbound\":6498052963,\"callrefs\":[{\"from\":6498052265,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6498052282,\"to\":6498080688,\"type\":\"CALL\"},{\"from\":6498052303,\"to\":6498080848,\"type\":\"CALL\"},{\"from\":6498052316,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6498052337,\"to\":6542434496,\"type\":\"CALL\"},{\"from\":6498052391,\"to\":6624333584,\"type\":\"CALL\"},{\"from\":6498052429,\"to\":6583793008,\"type\":\"CALL\"},{\"from\":6498052470,\"to\":6511423872,\"type\":\"CALL\"},{\"from\":6498052484,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6498052571,\"to\":6512942288,\"type\":\"CALL\"},{\"from\":6498052629,\"to\":6517399712,\"type\":\"CALL\"},{\"from\":6498052642,\"to\":6612339888,\"type\":\"CALL\"},{\"from\":6498052652,\"to\":6447869184,\"type\":\"CALL\"},{\"from\":6498052657,\"to\":6498052211,\"type\":\"CODE\"},{\"from\":6498052682,\"to\":6498080848,\"type\":\"CALL\"},{\"from\":6498052695,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6498052705,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6498052801,\"to\":6542436672,\"type\":\"CALL\"},{\"from\":6498052823,\"to\":6612340096,\"type\":\"CALL\"},{\"from\":6498052851,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6498052856,\"to\":6498052647,\"type\":\"CODE\"},{\"from\":6498052889,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6498052895,\"to\":6498052593,\"type\":\"CODE\"},{\"from\":6498052917,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6498052922,\"to\":6498052593,\"type\":\"CODE\"},{\"from\":6498052937,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6498052942,\"to\":6498052909,\"type\":\"CODE\"},{\"from\":6498052957,\"to\":6542089024,\"type\":\"CALL\"}],\"datarefs\":[{\"from\":6498052188,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6498052222,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6498052342,\"to\":6722919528,\"type\":\"DATA\"},{\"from\":6498052365,\"to\":6722919552,\"type\":\"DATA\"},{\"from\":6498052404,\"to\":6742076936,\"type\":\"DATA\"},{\"from\":6498052458,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6498052498,\"to\":6446192048,\"type\":\"DATA\"},{\"from\":6498052509,\"to\":6488516144,\"type\":\"DATA\"},{\"from\":6498052520,\"to\":6511490512,\"type\":\"DATA\"},{\"from\":6498052531,\"to\":6498052976,\"type\":\"DATA\"},{\"from\":6498052546,\"to\":6722920016,\"type\":\"DATA\"},{\"from\":6498052553,\"to\":6722919960,\"type\":\"DATA\"},{\"from\":6498052758,\"to\":6722919792,\"type\":\"DATA\"},{\"from\":6498052785,\"to\":6722919792,\"type\":\"DATA\"},{\"from\":6498052874,\"to\":6488537248,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6498052657,\"to\":6498052211,\"type\":\"CODE\"},{\"from\":6498052856,\"to\":6498052647,\"type\":\"CODE\"},{\"from\":6498052895,\"to\":6498052593,\"type\":\"CODE\"},{\"from\":6498052922,\"to\":6498052593,\"type\":\"CODE\"},{\"from\":6498052942,\"to\":6498052909,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":5,\"outdegree\":23,\"nlocals\":8,\"nargs\":3,\"stackvars\":[{\"name\":\"var_1a0h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-416}},{\"name\":\"var_198h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-408}},{\"name\":\"var_190h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-400}},{\"name\":\"var_188h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-392}},{\"name\":\"var_180h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-384}},{\"name\":\"var_170h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-368}},{\"name\":\"var_160h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-352}},{\"name\":\"var_28h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-40}}],\"regvars\":[{\"name\":\"arg3\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"r8\"}},{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"normalized_result":{"stdout":" 0x183506850 |\r\n 0x183506850 |// WARNING: [rz-ghidra] Detected overlap for variable var_3e9h\r\n 0x183506850 |// WARNING: [rz-ghidra] Detected overlap for variable var_198h\r\n |\r\n 0x183506850 |void fcn.183506850(int64_t arg1, int64_t arg2, int64_t arg3)\r\n |{\r\n | int64_t iVar1;\r\n | int32_t *piVar2;\r\n | int32_t *piVar3;\r\n | code *pcVar4;\r\n | char cVar5;\r\n | undefined8 uVar6;\r\n | undefined4 *puVar7;\r\n | uint64_t uVar8;\r\n | undefined4 uVar9;\r\n | undefined auStack_1c8 [40];\r\n | int64_t var_1a0h;\r\n | int64_t var_198h;\r\n | int64_t var_190h;\r\n | int64_t var_188h;\r\n | int64_t var_180h;\r\n | undefined8 uStack_178;\r\n | int64_t var_170h;\r\n | undefined8 uStack_168;\r\n | int64_t var_160h;\r\n | undefined8 uStack_150;\r\n | int64_t var_28h;\r\n | \r\n 0x183506863 | var_28h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_1c8;\r\n 0x183506871 | if (*(char *)arg1 == '\\0') {\r\n 0x1835068a9 | uVar6 = fcn.185f006b8(0xa0);\r\n 0x1835068ba | fcn.18350d7b0(uVar6, arg2, arg3);\r\n 0x1835068bf | iVar1 = *(int64_t *)(arg1 + 8);\r\n 0x1835068c3 | *(undefined8 *)(arg1 + 8) = uVar6;\r\n 0x1835068ca | if (iVar1 != 0) {\r\n 0x1835068cf | fcn.18350d850(iVar1);\r\n 0x1835068dc | fcn.1841dcbe0(iVar1, 0xa0);\r\n | }\r\n 0x1835068e1 | fcn.185f5a0c0(&var_160h, 0, 0x138);\r\n 0x183506902 | var_170h = 0x190b79c68;\r\n 0x183506905 | uStack_168 = 0x13;\r\n 0x183506919 | var_180h = 0x190b79c80;\r\n 0x18350691c | uStack_178 = 0xe2;\r\n 0x1835068e1 | fcn.18ad74f10(&var_160h);\r\n 0x18350692c | uStack_150 = 0x20000000;\r\n 0x183506940 | var_1a0h = 0;\r\n 0x18350694d | cVar5 = fcn.1886cb570(*(undefined8 *)0x191dbee08, &var_160h, &var_1a0h, 0);\r\n 0x183506954 | if (cVar5 == '\\0') {\r\n 0x183506a36 | iVar1 = *(int64_t *)(arg1 + 8);\r\n 0x183506a3a | *(undefined8 *)(arg1 + 8) = 0;\r\n 0x183506a45 | if (iVar1 != 0) {\r\n 0x183506a4a | fcn.18350d850(iVar1);\r\n 0x183506a57 | fcn.1841dcbe0(iVar1, 0xa0);\r\n | }\r\n 0x183506a61 | uVar8 = fcn.185f006b8(0xb0);\r\n 0x183506a6e | var_198h = 0x52;\r\n 0x183506a81 | var_190h = -0x7fffffffffffffa8;\r\n 0x183506a90 | var_1a0h = uVar8;\r\n 0x183506aab | if ((uVar8 + 0xa4 < uVar8) || (0x190b79d70 < uVar8 + 0xa4 && uVar8 < 0x190b79d71)) {\r\n 0x183506b50 | // WARNING: Does not return\r\n 0x183506b50 | pcVar4 = (code *)invalidInstructionException();\r\n 0x183506b50 | (*pcVar4)();\r\n | }\r\n 0x183506ac1 | uVar9 = fcn.185f5a940(uVar8, 0x190b79d70, 0xa4);\r\n 0x183506ac6 | *(undefined2 *)(uVar8 + 0xa4) = 0;\r\n 0x183506ad7 | fcn.18a204d80(uVar9, &var_1a0h);\r\n 0x183506ae0 | if (var_190h < 0) {\r\n 0x183506af3 | fcn.1841dcbe0(var_1a0h, var_190h * 2);\r\n | }\r\n | } else {\r\n 0x18350695a | *(undefined *)arg1 = 1;\r\n 0x183506971 | if ((arg1 & 0xfffffffc00000000U) == *(uint64_t *)0x191cd6d08) {\r\n 0x183506976 | fcn.1841c7180(arg1);\r\n | }\r\n 0x183506984 | puVar7 = (undefined4 *)fcn.185f006b8(0x30);\r\n 0x18350698c | *puVar7 = 1;\r\n 0x183506999 | *(undefined8 *)(puVar7 + 2) = 0x1803915b0;\r\n 0x1835069a4 | *(undefined8 *)(puVar7 + 4) = 0x182bee630;\r\n 0x1835069af | *(undefined8 *)(puVar7 + 6) = 0x1841d75d0;\r\n 0x1835069ba | *(undefined8 *)(puVar7 + 8) = 0x183506b70;\r\n 0x1835069be | *(int64_t *)(puVar7 + 10) = arg1;\r\n 0x1835069d0 | fcn.184339cd0(&var_1a0h, 0x190b79e50, 0x190b79e18, 0xbd);\r\n 0x1835069e0 | piVar2 = *(int32_t **)(arg1 + 0x70);\r\n 0x1835069e4 | *(undefined4 **)(arg1 + 0x70) = puVar7;\r\n 0x1835069eb | if (piVar2 != (int32_t *)0x0) {\r\n 0x183506afd | LOCK();\r\n 0x183506afd | *piVar2 = *piVar2 + -1;\r\n 0x183506afd | UNLOCK();\r\n 0x183506b00 | if (*piVar2 == 0) {\r\n 0x183506b14 | if (*(int64_t *)(piVar2 + 4) == 0x182bf38a0) {\r\n 0x183506b24 | piVar3 = *(int32_t **)(piVar2 + 0xc);\r\n 0x183506b2b | if (piVar3 != (int32_t *)0x0) {\r\n 0x183506b3f | LOCK();\r\n 0x183506b3f | *piVar3 = *piVar3 + -1;\r\n 0x183506b3f | UNLOCK();\r\n 0x183506b42 | if (*piVar3 == 0) {\r\n 0x183506b49 | fcn.1841dcbe0(piVar3, 8);\r\n | }\r\n | }\r\n 0x183506b35 | fcn.1841dcbe0(piVar2, 0x48);\r\n | } else {\r\n 0x183506b19 | (*case.0x1841dcc6f.0)(piVar2);\r\n | }\r\n | }\r\n | }\r\n 0x1835069f5 | *(undefined4 *)(arg1 + 0x38) = (undefined4)var_190h;\r\n 0x1835069fd | *(undefined4 *)(arg1 + 0x28) = (undefined4)var_1a0h;\r\n 0x1835069fd | *(undefined4 *)(arg1 + 0x2c) = var_1a0h._4_4_;\r\n 0x1835069fd | *(undefined4 *)(arg1 + 0x30) = (undefined4)var_198h;\r\n 0x1835069fd | *(undefined4 *)(arg1 + 0x34) = var_198h._4_4_;\r\n 0x183506a06 | *(int64_t *)(arg1 + 0x40) = var_188h;\r\n 0x183506a0a | *(undefined8 *)(arg1 + 0x58) = 60000000;\r\n 0x18350697b | fcn.18477a0a0(arg1 + 0x18);\r\n 0x183506a1a | *(undefined *)(arg1 + 1) = 1;\r\n 0x183506a1e | fcn.18a204cb0(*(undefined8 *)(arg1 + 0x10));\r\n | }\r\n 0x183506a27 | fcn.18052ad00(&var_160h);\r\n | }\r\n 0x183506888 | if (*(uint64_t *)0x191c71040 == (var_28h ^ (uint64_t)auStack_1c8)) {\r\n 0x18350689a | return;\r\n | }\r\n 0x183506b5a | fcn.185f05b40(var_28h ^ (uint64_t)auStack_1c8);\r\n 0x183506b62 | pcVar4 = (code *)swi(3);\r\n 0x183506b62 | (*pcVar4)();\r\n 0x183506b62 | return;\r\n |}\r\n[{\"offset\":6498052176,\"name\":\"fcn.183506850\",\"size\":787,\"is-pure\":false,\"realsz\":787,\"noreturn\":false,\"stackframe\":456,\"calltype\":\"ms\",\"cost\":244,\"cc\":17,\"loops\":8,\"bits\":64,\"type\":\"fcn\",\"nbbs\":26,\"edges\":37,\"ebbs\":3,\"signature\":\"fcn.183506850(int64_t arg1, int64_t arg2, int64_t arg3);\",\"minbound\":6498052176,\"maxbound\":6498052963,\"callrefs\":[{\"from\":6498052265,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6498052282,\"to\":6498080688,\"type\":\"CALL\"},{\"from\":6498052303,\"to\":6498080848,\"type\":\"CALL\"},{\"from\":6498052316,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6498052337,\"to\":6542434496,\"type\":\"CALL\"},{\"from\":6498052391,\"to\":6624333584,\"type\":\"CALL\"},{\"from\":6498052429,\"to\":6583793008,\"type\":\"CALL\"},{\"from\":6498052470,\"to\":6511423872,\"type\":\"CALL\"},{\"from\":6498052484,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6498052571,\"to\":6512942288,\"type\":\"CALL\"},{\"from\":6498052629,\"to\":6517399712,\"type\":\"CALL\"},{\"from\":6498052642,\"to\":6612339888,\"type\":\"CALL\"},{\"from\":6498052652,\"to\":6447869184,\"type\":\"CALL\"},{\"from\":6498052657,\"to\":6498052211,\"type\":\"CODE\"},{\"from\":6498052682,\"to\":6498080848,\"type\":\"CALL\"},{\"from\":6498052695,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6498052705,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6498052801,\"to\":6542436672,\"type\":\"CALL\"},{\"from\":6498052823,\"to\":6612340096,\"type\":\"CALL\"},{\"from\":6498052851,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6498052856,\"to\":6498052647,\"type\":\"CODE\"},{\"from\":6498052889,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6498052895,\"to\":6498052593,\"type\":\"CODE\"},{\"from\":6498052917,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6498052922,\"to\":6498052593,\"type\":\"CODE\"},{\"from\":6498052937,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6498052942,\"to\":6498052909,\"type\":\"CODE\"},{\"from\":6498052957,\"to\":6542089024,\"type\":\"CALL\"}],\"datarefs\":[{\"from\":6498052188,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6498052222,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6498052342,\"to\":6722919528,\"type\":\"DATA\"},{\"from\":6498052365,\"to\":6722919552,\"type\":\"DATA\"},{\"from\":6498052404,\"to\":6742076936,\"type\":\"DATA\"},{\"from\":6498052458,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6498052498,\"to\":6446192048,\"type\":\"DATA\"},{\"from\":6498052509,\"to\":6488516144,\"type\":\"DATA\"},{\"from\":6498052520,\"to\":6511490512,\"type\":\"DATA\"},{\"from\":6498052531,\"to\":6498052976,\"type\":\"DATA\"},{\"from\":6498052546,\"to\":6722920016,\"type\":\"DATA\"},{\"from\":6498052553,\"to\":6722919960,\"type\":\"DATA\"},{\"from\":6498052758,\"to\":6722919792,\"type\":\"DATA\"},{\"from\":6498052785,\"to\":6722919792,\"type\":\"DATA\"},{\"from\":6498052874,\"to\":6488537248,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6498052657,\"to\":6498052211,\"type\":\"CODE\"},{\"from\":6498052856,\"to\":6498052647,\"type\":\"CODE\"},{\"from\":6498052895,\"to\":6498052593,\"type\":\"CODE\"},{\"from\":6498052922,\"to\":6498052593,\"type\":\"CODE\"},{\"from\":6498052942,\"to\":6498052909,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":5,\"outdegree\":23,\"nlocals\":8,\"nargs\":3,\"stackvars\":[{\"name\":\"var_1a0h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-416}},{\"name\":\"var_198h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-408}},{\"name\":\"var_190h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-400}},{\"name\":\"var_188h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-392}},{\"name\":\"var_180h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-384}},{\"name\":\"var_170h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-368}},{\"name\":\"var_160h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-352}},{\"name\":\"var_28h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-40}}],\"regvars\":[{\"name\":\"arg3\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"r8\"}},{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"confidence":"observed","authority":"shipped-artifact","environment":null,"limitations":["The executable version and supported formats are reported as unknown because no reliable version probe was performed.","A non-zero process exit is preserved as an observed command result.","Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.","When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call."],"relationship_coverage":null,"locations":[{"kind":"artifact-path","path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"}],"evidence_links":[]},"meta":{"command":"execute-rizin-command","duration":"5281ms"}}