{"ok":true,"data":{"evidence_id":"ev_7e32fe74ef1e8f3a536a7ebb6897049e9310aeb1c00fa0cc0ca96acc5bc80a11","subject":{"name":"Tabbit.dll","digest":{"sha256":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c"},"local_path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","format":"unknown","architecture":null},"provider":{"id":"rizin","name":"Rizin","version":null},"analysis_profile":null,"predicate_type":"rea.reverse-engineering.command-observation","operation":"execute_rizin_command","parameters":{"path":"C:/Users/tjzhong/AppData/Local/Tabbit/Application/1.18.21.0/Tabbit.dll","command":"e scr.color=0;af @ 0x1837fdab0;pdgo @ 0x1837fdab0;afij @ 0x1837fdab0","provider_executable":"C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe","command_arguments":["-N","-q","-c","e scr.color=0;af @ 0x1837fdab0;pdgo @ 0x1837fdab0;afij @ 0x1837fdab0","C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"]},"raw_result":{"stdout":"                   |\r\n    0x1837fdab0    |void fcn.1837fdab0(int64_t arg1, int64_t arg2, int64_t arg3, int64_t arg_50h)\r\n                   |{\r\n                   |    uint64_t *puVar1;\r\n                   |    int32_t iVar2;\r\n                   |    int32_t *piVar3;\r\n                   |    int64_t *piVar4;\r\n                   |    int64_t iVar5;\r\n                   |    int64_t iVar6;\r\n                   |    code *pcVar7;\r\n                   |    undefined4 uVar8;\r\n                   |    uint64_t uVar9;\r\n                   |    undefined4 *puVar10;\r\n                   |    uint64_t uVar11;\r\n                   |    int64_t unaff_GS_OFFSET;\r\n                   |    int64_t var_8h;\r\n                   |    undefined auStack_b8 [32];\r\n                   |    int64_t var_98h;\r\n                   |    int64_t var_90h;\r\n                   |    int64_t var_88h;\r\n                   |    int64_t *piStack_80;\r\n                   |    undefined8 uStack_78;\r\n                   |    int64_t var_70h;\r\n                   |    int64_t var_50h;\r\n                   |    int64_t var_48h;\r\n                   |    \r\n    0x1837fdad0    |    var_48h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_b8;\r\n    0x1837fdb81    |    if (((uint32_t)*(int64_t *)(arg1 + 0x20) < 0xfffffff4 && *(int64_t *)(arg1 + 0x20) != 0) &&\r\n    0x1837fdb7d    |       (*(int32_t *)(arg1 + 0x28) != 0)) {\r\n    0x1837fdb9a    |        piVar4 = *(int64_t **)\r\n    0x1837fdb96    |                  (*(int64_t *)(*(int64_t *)(unaff_GS_OFFSET + 0x58) + (uint64_t)*(uint32_t *)0x191d832e0 * 8) + 0x3d8);\r\n    0x1837fdbae    |        if ((piVar4 == (int64_t *)0x0) || (*piVar4 == 0)) {\r\n    0x1837fde77    |            pcVar7 = (code *)swi(3);\r\n    0x1837fde77    |            (*pcVar7)();\r\n    0x1837fde77    |            return;\r\n                   |        }\r\n    0x1837fdbb4    |        puVar1 = (uint64_t *)(arg1 + 0x38);\r\n    0x1837fdbbc    |        if (*(char *)(arg1 + 0x50) == '\\x01') {\r\n    0x1837fdbc1    |            func_0x0001837fe350(puVar1);\r\n    0x1837fdbc6    |            *(undefined *)(arg1 + 0x50) = 0;\r\n                   |        }\r\n    0x1837fdbcd    |        if (puVar1 == (uint64_t *)0x0) {\r\n    0x1837fde65    |    // WARNING: Does not return\r\n    0x1837fde65    |            pcVar7 = (code *)invalidInstructionException();\r\n    0x1837fde65    |            (*pcVar7)();\r\n                   |        }\r\n    0x1837fdbd8    |        iVar5 = *(int64_t *)(arg1 + 0x30);\r\n    0x1837fdbdf    |        var_90h = (int64_t)piVar4;\r\n    0x1837fdbdf    |        if (iVar5 != 0) {\r\n    0x1837fdbe6    |            LOCK();\r\n    0x1837fdbe6    |            piVar3 = (int32_t *)(iVar5 + 8);\r\n    0x1837fdbe6    |            iVar2 = *piVar3;\r\n    0x1837fdbe6    |            *piVar3 = *piVar3 + 1;\r\n    0x1837fdbe6    |            UNLOCK();\r\n    0x1837fdbf0    |            if (iVar2 == 0x7fffffff) {\r\n    0x1837fde7a    |                pcVar7 = (code *)swi(3);\r\n    0x1837fde7a    |                (*pcVar7)();\r\n    0x1837fde7a    |                return;\r\n                   |            }\r\n                   |        }\r\n    0x1837fdc03    |        *puVar1 = 0;\r\n    0x1837fdc03    |        *(undefined8 *)(arg1 + 0x40) = 0;\r\n    0x1837fdc07    |        *(int64_t *)(arg1 + 0x48) = iVar5;\r\n    0x1837fdc15    |        uVar9 = func_0x000184d3ac50(0x8288, 8);\r\n    0x1837fdc20    |        uVar11 = uVar9 & 0xfffffffc00000000;\r\n    0x1837fdc2a    |        if (uVar11 == *(uint64_t *)0x191cd6d08) {\r\n    0x1837fdc2f    |            func_0x0001841c7180(uVar9);\r\n                   |        }\r\n    0x1837fdc45    |        if ((*(uint64_t *)(arg1 + 0x40) & 0xfffffffc00000000) == *(uint64_t *)0x191cd6d08) {\r\n    0x1837fdc47    |            func_0x00018005f390();\r\n                   |        }\r\n    0x1837fdc4c    |        *(uint64_t *)(arg1 + 0x40) = uVar9;\r\n    0x1837fdc57    |        if (uVar11 == *(uint64_t *)0x191cd6d08) {\r\n    0x1837fdc5c    |            func_0x0001841c7180(uVar9);\r\n                   |        }\r\n    0x1837fdc71    |        if ((*puVar1 & 0xfffffffc00000000) == *(uint64_t *)0x191cd6d08) {\r\n    0x1837fdc73    |            func_0x00018005f390();\r\n                   |        }\r\n    0x1837fdc78    |        *puVar1 = uVar9;\r\n    0x1837fdc82    |        if (uVar11 == *(uint64_t *)0x191cd6d08) {\r\n    0x1837fdc87    |            func_0x0001841c7180(uVar9);\r\n    0x1837fdc93    |            if (uVar11 == *(uint64_t *)0x191cd6d08) {\r\n    0x1837fdc98    |                func_0x0001841c7180(uVar9);\r\n    0x1837fdca4    |                if (uVar11 == *(uint64_t *)0x191cd6d08) {\r\n    0x1837fdca9    |                    func_0x00018005f390(uVar9);\r\n                   |                }\r\n                   |            }\r\n                   |        }\r\n    0x1837fdcb3    |        puVar10 = (undefined4 *)func_0x000185f006b8(0x58);\r\n    0x1837fdcbb    |        *puVar10 = 1;\r\n    0x1837fdcc8    |        *(undefined8 *)(puVar10 + 2) = 0x1837ff7a0;\r\n    0x1837fdcd3    |        *(undefined8 *)(puVar10 + 4) = 0x1837ff800;\r\n    0x1837fdcde    |        *(undefined8 *)(puVar10 + 6) = 0x1841d75d0;\r\n    0x1837fdce9    |        *(undefined8 *)(puVar10 + 8) = 0x1837ff0f0;\r\n    0x1837fdced    |        *(uint64_t *)(puVar10 + 10) = uVar9;\r\n    0x1837fdcf3    |        *(undefined8 *)(puVar10 + 0xc) = 0;\r\n    0x1837fdcf7    |        iVar6 = *(int64_t *)(arg1 + 0x20);\r\n    0x1837fdcfb    |        *(undefined8 *)(arg1 + 0x20) = 0;\r\n    0x1837fdd13    |        var_98h = arg3;\r\n    0x1837fdd13    |        if (iVar6 == 0 || 0xfffffff3 < (uint32_t)iVar6) {\r\n    0x1837fdd18    |            if (iVar6 != 0) {\r\n    0x1837fdd26    |                uVar8 = (*(code *)0x11c21b5a)();\r\n    0x1837fdd2e    |                goto code_r0x0001837fdd52;\r\n                   |            }\r\n                   |        } else {\r\n    0x1837fdd3c    |            func_0x000184d01b00();\r\n    0x1837fdd41    |            uVar8 = (*(code *)0x11c21b5a)();\r\n    0x1837fdd49    |            *(int64_t *)(puVar10 + 0xc) = iVar6;\r\n    0x1837fdd4d    |            func_0x000184d01b00();\r\n                   |code_r0x0001837fdd52:\r\n    0x1837fdd54    |            (*(code *)0x11c22c68)(uVar8);\r\n                   |        }\r\n    0x1837fdd6b    |        arg3 = var_98h;\r\n    0x1837fdd6e    |        puVar10[0xe] = *(undefined4 *)(arg1 + 0x28);\r\n    0x1837fdd77    |        iVar6 = *(int64_t *)var_90h;\r\n    0x1837fdd7a    |        *(int64_t *)(puVar10 + 0x10) = iVar6;\r\n    0x1837fdd81    |        if (iVar6 != 0) {\r\n    0x1837fdd88    |            LOCK();\r\n    0x1837fdd88    |            piVar3 = (int32_t *)(iVar6 + 8);\r\n    0x1837fdd88    |            iVar2 = *piVar3;\r\n    0x1837fdd88    |            *piVar3 = *piVar3 + 1;\r\n    0x1837fdd88    |            UNLOCK();\r\n    0x1837fdd93    |            if (iVar2 == 0x7fffffff) {\r\n    0x1837fde7d    |                pcVar7 = (code *)swi(3);\r\n    0x1837fde7d    |                (*pcVar7)();\r\n    0x1837fde7d    |                return;\r\n                   |            }\r\n                   |        }\r\n    0x1837fdd99    |        *(int64_t *)(puVar10 + 0x12) = arg2;\r\n    0x1837fdda0    |        *(undefined8 *)(puVar10 + 0x14) = *(undefined8 *)var_98h;\r\n    0x1837fdda4    |        *(undefined8 *)var_98h = 0;\r\n    0x1837fddb9    |        func_0x000184339cd0(&var_70h, 0x19027d8f8, 0x19027d8c8, 0x65);\r\n    0x1837fdde4    |        var_50h = (int64_t)puVar10;\r\n    0x1837fdde4    |        (*(code *)0x185f59da0)(iVar5, &var_70h, &var_50h, 0);\r\n    0x1837fddea    |        *(undefined *)(arg1 + 0x50) = 1;\r\n    0x1837fddfc    |        func_0x000184339cd0(&var_70h, 0x190151058, 0x190c22d30, 0x1b4);\r\n    0x1837fde1f    |        if (((uint64_t)puVar1 & 0xfffffffc00000000) == *(uint64_t *)0x191cd6d08) {\r\n    0x1837fde24    |            func_0x0001841c7180(puVar1);\r\n                   |        }\r\n    0x1837fde3b    |        var_88h = (int64_t)puVar1;\r\n    0x1837fde3b    |        if (((uint64_t)&var_70h & 0xfffffffc00000000) == *(uint64_t *)0x191cd6d08) {\r\n    0x1837fde3d    |            func_0x0001841c7180(&var_70h);\r\n                   |        }\r\n    0x1837fde57    |        uStack_78 = 0x1837fedb0;\r\n    0x1837fde5b    |        piStack_80 = &var_70h;\r\n    0x1837fde5b    |        func_0x0001837fefb0();\r\n                   |    } else {\r\n    0x1837fdaf0    |        piVar3 = *(int32_t **)arg3;\r\n    0x1837fdaf6    |        if (piVar3 == (int32_t *)0x0) goto code_r0x0001837fde74;\r\n    0x1837fdafc    |        *(undefined8 *)arg3 = 0;\r\n    0x1837fdb0a    |        (*(code *)0x185f59da0)(piVar3);\r\n    0x1837fdb10    |        LOCK();\r\n    0x1837fdb10    |        *piVar3 = *piVar3 + -1;\r\n    0x1837fdb10    |        UNLOCK();\r\n    0x1837fdb13    |        if (*piVar3 == 0) {\r\n    0x1837fdb1c    |            (*(code *)0x185f59da0)(piVar3);\r\n                   |        }\r\n    0x1837fdb25    |        if (arg2 != 0) {\r\n    0x1837fdb69    |            LOCK();\r\n    0x1837fdb69    |            *(int32_t *)arg2 = *(int32_t *)arg2 + -1;\r\n    0x1837fdb69    |            UNLOCK();\r\n    0x1837fdb6c    |            if (*(int32_t *)arg2 == 0) {\r\n    0x1837fdb75    |                (*(code *)0x185f59da0)(arg2);\r\n                   |            }\r\n                   |        }\r\n                   |    }\r\n    0x1837fdb27    |    piVar3 = *(int32_t **)arg3;\r\n    0x1837fdb2d    |    if (piVar3 != (int32_t *)0x0) {\r\n    0x1837fdb58    |        LOCK();\r\n    0x1837fdb58    |        *piVar3 = *piVar3 + -1;\r\n    0x1837fdb58    |        UNLOCK();\r\n    0x1837fdb5b    |        if (*piVar3 == 0) {\r\n    0x1837fdb61    |            (*(code *)0x185f59da0)();\r\n                   |        }\r\n                   |    }\r\n    0x1837fdb41    |    if (*(uint64_t *)0x191c71040 == (var_48h ^ (uint64_t)auStack_b8)) {\r\n    0x1837fdb57    |        return;\r\n                   |    }\r\n    0x1837fde6c    |    func_0x000185f05b40(var_48h ^ (uint64_t)auStack_b8);\r\n                   |code_r0x0001837fde74:\r\n    0x1837fde74    |    pcVar7 = (code *)swi(3);\r\n    0x1837fde74    |    (*pcVar7)();\r\n    0x1837fde74    |    return;\r\n                   |}\r\n[{\"offset\":6501161648,\"name\":\"fcn.1837fdab0\",\"size\":974,\"is-pure\":false,\"realsz\":968,\"noreturn\":false,\"stackframe\":184,\"calltype\":\"ms\",\"cost\":342,\"cc\":34,\"loops\":6,\"bits\":64,\"type\":\"fcn\",\"nbbs\":50,\"edges\":72,\"ebbs\":6,\"signature\":\"fcn.1837fdab0(int64_t arg1, int64_t arg2, int64_t arg3, int64_t arg_50h);\",\"minbound\":6501161648,\"maxbound\":6501162622,\"callrefs\":[{\"from\":6501161738,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6501161756,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6501161825,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6501161831,\"to\":6501161775,\"type\":\"CODE\"},{\"from\":6501161845,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6501161851,\"to\":6501161767,\"type\":\"CODE\"},{\"from\":6501161921,\"to\":6501163856,\"type\":\"CALL\"},{\"from\":6501162005,\"to\":6523432016,\"type\":\"CALL\"},{\"from\":6501162031,\"to\":6511423872,\"type\":\"CALL\"},{\"from\":6501162055,\"to\":6442840976,\"type\":\"CALL\"},{\"from\":6501162076,\"to\":6511423872,\"type\":\"CALL\"},{\"from\":6501162099,\"to\":6442840976,\"type\":\"CALL\"},{\"from\":6501162119,\"to\":6511423872,\"type\":\"CALL\"},{\"from\":6501162136,\"to\":6511423872,\"type\":\"CALL\"},{\"from\":6501162153,\"to\":6442840976,\"type\":\"CALL\"},{\"from\":6501162163,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6501162278,\"to\":6740378384,\"type\":\"CALL\"},{\"from\":6501162286,\"to\":6501162322,\"type\":\"CODE\"},{\"from\":6501162300,\"to\":6523198208,\"type\":\"CALL\"},{\"from\":6501162305,\"to\":6740378384,\"type\":\"CALL\"},{\"from\":6501162317,\"to\":6523198208,\"type\":\"CALL\"},{\"from\":6501162324,\"to\":6740380040,\"type\":\"CALL\"},{\"from\":6501162439,\"to\":6512942288,\"type\":\"CALL\"},{\"from\":6501162468,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6501162506,\"to\":6512942288,\"type\":\"CALL\"},{\"from\":6501162532,\"to\":6511423872,\"type\":\"CALL\"},{\"from\":6501162562,\"to\":6511423872,\"type\":\"CALL\"},{\"from\":6501162587,\"to\":6501167024,\"type\":\"CALL\"},{\"from\":6501162592,\"to\":6501161767,\"type\":\"CODE\"},{\"from\":6501162607,\"to\":6542089024,\"type\":\"CALL\"}],\"datarefs\":[{\"from\":6501161673,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6501161783,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6501161863,\"to\":6741832416,\"type\":\"DATA\"},{\"from\":6501162019,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6501162046,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6501162064,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6501162090,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6501162107,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6501162124,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6501162141,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6501162177,\"to\":6501169056,\"type\":\"DATA\"},{\"from\":6501162188,\"to\":6501169152,\"type\":\"DATA\"},{\"from\":6501162199,\"to\":6511490512,\"type\":\"DATA\"},{\"from\":6501162210,\"to\":6501167344,\"type\":\"DATA\"},{\"from\":6501162411,\"to\":6713497848,\"type\":\"DATA\"},{\"from\":6501162418,\"to\":6713497800,\"type\":\"DATA\"},{\"from\":6501162478,\"to\":6712266840,\"type\":\"DATA\"},{\"from\":6501162485,\"to\":6723611952,\"type\":\"DATA\"},{\"from\":6501162517,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6501162537,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6501162576,\"to\":6501166512,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6501161831,\"to\":6501161775,\"type\":\"CODE\"},{\"from\":6501161851,\"to\":6501161767,\"type\":\"CODE\"},{\"from\":6501162286,\"to\":6501162322,\"type\":\"CODE\"},{\"from\":6501162592,\"to\":6501161767,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":4,\"outdegree\":26,\"nlocals\":7,\"nargs\":4,\"stackvars\":[{\"name\":\"var_98h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-152}},{\"name\":\"var_90h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-144}},{\"name\":\"var_88h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-136}},{\"name\":\"var_70h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-112}},{\"name\":\"var_50h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-80}},{\"name\":\"var_48h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-72}},{\"name\":\"var_8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":8}},{\"name\":\"arg_50h\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":80}}],\"regvars\":[{\"name\":\"arg3\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"r8\"}},{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"normalized_result":{"stdout":"                   |\r\n    0x1837fdab0    |void fcn.1837fdab0(int64_t arg1, int64_t arg2, int64_t arg3, int64_t arg_50h)\r\n                   |{\r\n                   |    uint64_t *puVar1;\r\n                   |    int32_t iVar2;\r\n                   |    int32_t *piVar3;\r\n                   |    int64_t *piVar4;\r\n                   |    int64_t iVar5;\r\n                   |    int64_t iVar6;\r\n                   |    code *pcVar7;\r\n                   |    undefined4 uVar8;\r\n                   |    uint64_t uVar9;\r\n                   |    undefined4 *puVar10;\r\n                   |    uint64_t uVar11;\r\n                   |    int64_t unaff_GS_OFFSET;\r\n                   |    int64_t var_8h;\r\n                   |    undefined auStack_b8 [32];\r\n                   |    int64_t var_98h;\r\n                   |    int64_t var_90h;\r\n                   |    int64_t var_88h;\r\n                   |    int64_t *piStack_80;\r\n                   |    undefined8 uStack_78;\r\n                   |    int64_t var_70h;\r\n                   |    int64_t var_50h;\r\n                   |    int64_t var_48h;\r\n                   |    \r\n    0x1837fdad0    |    var_48h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_b8;\r\n    0x1837fdb81    |    if (((uint32_t)*(int64_t *)(arg1 + 0x20) < 0xfffffff4 && *(int64_t *)(arg1 + 0x20) != 0) &&\r\n    0x1837fdb7d    |       (*(int32_t *)(arg1 + 0x28) != 0)) {\r\n    0x1837fdb9a    |        piVar4 = *(int64_t **)\r\n    0x1837fdb96    |                  (*(int64_t *)(*(int64_t *)(unaff_GS_OFFSET + 0x58) + (uint64_t)*(uint32_t *)0x191d832e0 * 8) + 0x3d8);\r\n    0x1837fdbae    |        if ((piVar4 == (int64_t *)0x0) || (*piVar4 == 0)) {\r\n    0x1837fde77    |            pcVar7 = (code *)swi(3);\r\n    0x1837fde77    |            (*pcVar7)();\r\n    0x1837fde77    |            return;\r\n                   |        }\r\n    0x1837fdbb4    |        puVar1 = (uint64_t *)(arg1 + 0x38);\r\n    0x1837fdbbc    |        if (*(char *)(arg1 + 0x50) == '\\x01') {\r\n    0x1837fdbc1    |            func_0x0001837fe350(puVar1);\r\n    0x1837fdbc6    |            *(undefined *)(arg1 + 0x50) = 0;\r\n                   |        }\r\n    0x1837fdbcd    |        if (puVar1 == (uint64_t *)0x0) {\r\n    0x1837fde65    |    // WARNING: Does not return\r\n    0x1837fde65    |            pcVar7 = (code *)invalidInstructionException();\r\n    0x1837fde65    |            (*pcVar7)();\r\n                   |        }\r\n    0x1837fdbd8    |        iVar5 = *(int64_t *)(arg1 + 0x30);\r\n    0x1837fdbdf    |        var_90h = (int64_t)piVar4;\r\n    0x1837fdbdf    |        if (iVar5 != 0) {\r\n    0x1837fdbe6    |            LOCK();\r\n    0x1837fdbe6    |            piVar3 = (int32_t *)(iVar5 + 8);\r\n    0x1837fdbe6    |            iVar2 = *piVar3;\r\n    0x1837fdbe6    |            *piVar3 = *piVar3 + 1;\r\n    0x1837fdbe6    |            UNLOCK();\r\n    0x1837fdbf0    |            if (iVar2 == 0x7fffffff) {\r\n    0x1837fde7a    |                pcVar7 = (code *)swi(3);\r\n    0x1837fde7a    |                (*pcVar7)();\r\n    0x1837fde7a    |                return;\r\n                   |            }\r\n                   |        }\r\n    0x1837fdc03    |        *puVar1 = 0;\r\n    0x1837fdc03    |        *(undefined8 *)(arg1 + 0x40) = 0;\r\n    0x1837fdc07    |        *(int64_t *)(arg1 + 0x48) = iVar5;\r\n    0x1837fdc15    |        uVar9 = func_0x000184d3ac50(0x8288, 8);\r\n    0x1837fdc20    |        uVar11 = uVar9 & 0xfffffffc00000000;\r\n    0x1837fdc2a    |        if (uVar11 == *(uint64_t *)0x191cd6d08) {\r\n    0x1837fdc2f    |            func_0x0001841c7180(uVar9);\r\n                   |        }\r\n    0x1837fdc45    |        if ((*(uint64_t *)(arg1 + 0x40) & 0xfffffffc00000000) == *(uint64_t *)0x191cd6d08) {\r\n    0x1837fdc47    |            func_0x00018005f390();\r\n                   |        }\r\n    0x1837fdc4c    |        *(uint64_t *)(arg1 + 0x40) = uVar9;\r\n    0x1837fdc57    |        if (uVar11 == *(uint64_t *)0x191cd6d08) {\r\n    0x1837fdc5c    |            func_0x0001841c7180(uVar9);\r\n                   |        }\r\n    0x1837fdc71    |        if ((*puVar1 & 0xfffffffc00000000) == *(uint64_t *)0x191cd6d08) {\r\n    0x1837fdc73    |            func_0x00018005f390();\r\n                   |        }\r\n    0x1837fdc78    |        *puVar1 = uVar9;\r\n    0x1837fdc82    |        if (uVar11 == *(uint64_t *)0x191cd6d08) {\r\n    0x1837fdc87    |            func_0x0001841c7180(uVar9);\r\n    0x1837fdc93    |            if (uVar11 == *(uint64_t *)0x191cd6d08) {\r\n    0x1837fdc98    |                func_0x0001841c7180(uVar9);\r\n    0x1837fdca4    |                if (uVar11 == *(uint64_t *)0x191cd6d08) {\r\n    0x1837fdca9    |                    func_0x00018005f390(uVar9);\r\n                   |                }\r\n                   |            }\r\n                   |        }\r\n    0x1837fdcb3    |        puVar10 = (undefined4 *)func_0x000185f006b8(0x58);\r\n    0x1837fdcbb    |        *puVar10 = 1;\r\n    0x1837fdcc8    |        *(undefined8 *)(puVar10 + 2) = 0x1837ff7a0;\r\n    0x1837fdcd3    |        *(undefined8 *)(puVar10 + 4) = 0x1837ff800;\r\n    0x1837fdcde    |        *(undefined8 *)(puVar10 + 6) = 0x1841d75d0;\r\n    0x1837fdce9    |        *(undefined8 *)(puVar10 + 8) = 0x1837ff0f0;\r\n    0x1837fdced    |        *(uint64_t *)(puVar10 + 10) = uVar9;\r\n    0x1837fdcf3    |        *(undefined8 *)(puVar10 + 0xc) = 0;\r\n    0x1837fdcf7    |        iVar6 = *(int64_t *)(arg1 + 0x20);\r\n    0x1837fdcfb    |        *(undefined8 *)(arg1 + 0x20) = 0;\r\n    0x1837fdd13    |        var_98h = arg3;\r\n    0x1837fdd13    |        if (iVar6 == 0 || 0xfffffff3 < (uint32_t)iVar6) {\r\n    0x1837fdd18    |            if (iVar6 != 0) {\r\n    0x1837fdd26    |                uVar8 = (*(code *)0x11c21b5a)();\r\n    0x1837fdd2e    |                goto code_r0x0001837fdd52;\r\n                   |            }\r\n                   |        } else {\r\n    0x1837fdd3c    |            func_0x000184d01b00();\r\n    0x1837fdd41    |            uVar8 = (*(code *)0x11c21b5a)();\r\n    0x1837fdd49    |            *(int64_t *)(puVar10 + 0xc) = iVar6;\r\n    0x1837fdd4d    |            func_0x000184d01b00();\r\n                   |code_r0x0001837fdd52:\r\n    0x1837fdd54    |            (*(code *)0x11c22c68)(uVar8);\r\n                   |        }\r\n    0x1837fdd6b    |        arg3 = var_98h;\r\n    0x1837fdd6e    |        puVar10[0xe] = *(undefined4 *)(arg1 + 0x28);\r\n    0x1837fdd77    |        iVar6 = *(int64_t *)var_90h;\r\n    0x1837fdd7a    |        *(int64_t *)(puVar10 + 0x10) = iVar6;\r\n    0x1837fdd81    |        if (iVar6 != 0) {\r\n    0x1837fdd88    |            LOCK();\r\n    0x1837fdd88    |            piVar3 = (int32_t *)(iVar6 + 8);\r\n    0x1837fdd88    |            iVar2 = *piVar3;\r\n    0x1837fdd88    |            *piVar3 = *piVar3 + 1;\r\n    0x1837fdd88    |            UNLOCK();\r\n    0x1837fdd93    |            if (iVar2 == 0x7fffffff) {\r\n    0x1837fde7d    |                pcVar7 = (code *)swi(3);\r\n    0x1837fde7d    |                (*pcVar7)();\r\n    0x1837fde7d    |                return;\r\n                   |            }\r\n                   |        }\r\n    0x1837fdd99    |        *(int64_t *)(puVar10 + 0x12) = arg2;\r\n    0x1837fdda0    |        *(undefined8 *)(puVar10 + 0x14) = *(undefined8 *)var_98h;\r\n    0x1837fdda4    |        *(undefined8 *)var_98h = 0;\r\n    0x1837fddb9    |        func_0x000184339cd0(&var_70h, 0x19027d8f8, 0x19027d8c8, 0x65);\r\n    0x1837fdde4    |        var_50h = (int64_t)puVar10;\r\n    0x1837fdde4    |        (*(code *)0x185f59da0)(iVar5, &var_70h, &var_50h, 0);\r\n    0x1837fddea    |        *(undefined *)(arg1 + 0x50) = 1;\r\n    0x1837fddfc    |        func_0x000184339cd0(&var_70h, 0x190151058, 0x190c22d30, 0x1b4);\r\n    0x1837fde1f    |        if (((uint64_t)puVar1 & 0xfffffffc00000000) == *(uint64_t *)0x191cd6d08) {\r\n    0x1837fde24    |            func_0x0001841c7180(puVar1);\r\n                   |        }\r\n    0x1837fde3b    |        var_88h = (int64_t)puVar1;\r\n    0x1837fde3b    |        if (((uint64_t)&var_70h & 0xfffffffc00000000) == *(uint64_t *)0x191cd6d08) {\r\n    0x1837fde3d    |            func_0x0001841c7180(&var_70h);\r\n                   |        }\r\n    0x1837fde57    |        uStack_78 = 0x1837fedb0;\r\n    0x1837fde5b    |        piStack_80 = &var_70h;\r\n    0x1837fde5b    |        func_0x0001837fefb0();\r\n                   |    } else {\r\n    0x1837fdaf0    |        piVar3 = *(int32_t **)arg3;\r\n    0x1837fdaf6    |        if (piVar3 == (int32_t *)0x0) goto code_r0x0001837fde74;\r\n    0x1837fdafc    |        *(undefined8 *)arg3 = 0;\r\n    0x1837fdb0a    |        (*(code *)0x185f59da0)(piVar3);\r\n    0x1837fdb10    |        LOCK();\r\n    0x1837fdb10    |        *piVar3 = *piVar3 + -1;\r\n    0x1837fdb10    |        UNLOCK();\r\n    0x1837fdb13    |        if (*piVar3 == 0) {\r\n    0x1837fdb1c    |            (*(code *)0x185f59da0)(piVar3);\r\n                   |        }\r\n    0x1837fdb25    |        if (arg2 != 0) {\r\n    0x1837fdb69    |            LOCK();\r\n    0x1837fdb69    |            *(int32_t *)arg2 = *(int32_t *)arg2 + -1;\r\n    0x1837fdb69    |            UNLOCK();\r\n    0x1837fdb6c    |            if (*(int32_t *)arg2 == 0) {\r\n    0x1837fdb75    |                (*(code *)0x185f59da0)(arg2);\r\n                   |            }\r\n                   |        }\r\n                   |    }\r\n    0x1837fdb27    |    piVar3 = *(int32_t **)arg3;\r\n    0x1837fdb2d    |    if (piVar3 != (int32_t *)0x0) {\r\n    0x1837fdb58    |        LOCK();\r\n    0x1837fdb58    |        *piVar3 = *piVar3 + -1;\r\n    0x1837fdb58    |        UNLOCK();\r\n    0x1837fdb5b    |        if (*piVar3 == 0) {\r\n    0x1837fdb61    |            (*(code *)0x185f59da0)();\r\n                   |        }\r\n                   |    }\r\n    0x1837fdb41    |    if (*(uint64_t *)0x191c71040 == (var_48h ^ (uint64_t)auStack_b8)) {\r\n    0x1837fdb57    |        return;\r\n                   |    }\r\n    0x1837fde6c    |    func_0x000185f05b40(var_48h ^ (uint64_t)auStack_b8);\r\n                   |code_r0x0001837fde74:\r\n    0x1837fde74    |    pcVar7 = (code *)swi(3);\r\n    0x1837fde74    |    (*pcVar7)();\r\n    0x1837fde74    |    return;\r\n                   |}\r\n[{\"offset\":6501161648,\"name\":\"fcn.1837fdab0\",\"size\":974,\"is-pure\":false,\"realsz\":968,\"noreturn\":false,\"stackframe\":184,\"calltype\":\"ms\",\"cost\":342,\"cc\":34,\"loops\":6,\"bits\":64,\"type\":\"fcn\",\"nbbs\":50,\"edges\":72,\"ebbs\":6,\"signature\":\"fcn.1837fdab0(int64_t arg1, int64_t arg2, int64_t arg3, int64_t arg_50h);\",\"minbound\":6501161648,\"maxbound\":6501162622,\"callrefs\":[{\"from\":6501161738,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6501161756,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6501161825,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6501161831,\"to\":6501161775,\"type\":\"CODE\"},{\"from\":6501161845,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6501161851,\"to\":6501161767,\"type\":\"CODE\"},{\"from\":6501161921,\"to\":6501163856,\"type\":\"CALL\"},{\"from\":6501162005,\"to\":6523432016,\"type\":\"CALL\"},{\"from\":6501162031,\"to\":6511423872,\"type\":\"CALL\"},{\"from\":6501162055,\"to\":6442840976,\"type\":\"CALL\"},{\"from\":6501162076,\"to\":6511423872,\"type\":\"CALL\"},{\"from\":6501162099,\"to\":6442840976,\"type\":\"CALL\"},{\"from\":6501162119,\"to\":6511423872,\"type\":\"CALL\"},{\"from\":6501162136,\"to\":6511423872,\"type\":\"CALL\"},{\"from\":6501162153,\"to\":6442840976,\"type\":\"CALL\"},{\"from\":6501162163,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6501162278,\"to\":6740378384,\"type\":\"CALL\"},{\"from\":6501162286,\"to\":6501162322,\"type\":\"CODE\"},{\"from\":6501162300,\"to\":6523198208,\"type\":\"CALL\"},{\"from\":6501162305,\"to\":6740378384,\"type\":\"CALL\"},{\"from\":6501162317,\"to\":6523198208,\"type\":\"CALL\"},{\"from\":6501162324,\"to\":6740380040,\"type\":\"CALL\"},{\"from\":6501162439,\"to\":6512942288,\"type\":\"CALL\"},{\"from\":6501162468,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6501162506,\"to\":6512942288,\"type\":\"CALL\"},{\"from\":6501162532,\"to\":6511423872,\"type\":\"CALL\"},{\"from\":6501162562,\"to\":6511423872,\"type\":\"CALL\"},{\"from\":6501162587,\"to\":6501167024,\"type\":\"CALL\"},{\"from\":6501162592,\"to\":6501161767,\"type\":\"CODE\"},{\"from\":6501162607,\"to\":6542089024,\"type\":\"CALL\"}],\"datarefs\":[{\"from\":6501161673,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6501161783,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6501161863,\"to\":6741832416,\"type\":\"DATA\"},{\"from\":6501162019,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6501162046,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6501162064,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6501162090,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6501162107,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6501162124,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6501162141,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6501162177,\"to\":6501169056,\"type\":\"DATA\"},{\"from\":6501162188,\"to\":6501169152,\"type\":\"DATA\"},{\"from\":6501162199,\"to\":6511490512,\"type\":\"DATA\"},{\"from\":6501162210,\"to\":6501167344,\"type\":\"DATA\"},{\"from\":6501162411,\"to\":6713497848,\"type\":\"DATA\"},{\"from\":6501162418,\"to\":6713497800,\"type\":\"DATA\"},{\"from\":6501162478,\"to\":6712266840,\"type\":\"DATA\"},{\"from\":6501162485,\"to\":6723611952,\"type\":\"DATA\"},{\"from\":6501162517,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6501162537,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6501162576,\"to\":6501166512,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6501161831,\"to\":6501161775,\"type\":\"CODE\"},{\"from\":6501161851,\"to\":6501161767,\"type\":\"CODE\"},{\"from\":6501162286,\"to\":6501162322,\"type\":\"CODE\"},{\"from\":6501162592,\"to\":6501161767,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":4,\"outdegree\":26,\"nlocals\":7,\"nargs\":4,\"stackvars\":[{\"name\":\"var_98h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-152}},{\"name\":\"var_90h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-144}},{\"name\":\"var_88h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-136}},{\"name\":\"var_70h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-112}},{\"name\":\"var_50h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-80}},{\"name\":\"var_48h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-72}},{\"name\":\"var_8h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":8}},{\"name\":\"arg_50h\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":80}}],\"regvars\":[{\"name\":\"arg3\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"r8\"}},{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"confidence":"observed","authority":"shipped-artifact","environment":null,"limitations":["The executable version and supported formats are reported as unknown because no reliable version probe was performed.","A non-zero process exit is preserved as an observed command result.","Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.","When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call."],"relationship_coverage":null,"locations":[{"kind":"artifact-path","path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"}],"evidence_links":[]},"meta":{"command":"execute-rizin-command","duration":"5302ms"}}