{"ok":true,"data":{"evidence_id":"ev_0060dde16419bfb42735208a96a17618c0582ff5407d60ee3e684637297cd19b","subject":{"name":"Tabbit.dll","digest":{"sha256":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c"},"local_path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","format":"unknown","architecture":null},"provider":{"id":"rizin","name":"Rizin","version":null},"analysis_profile":null,"predicate_type":"rea.reverse-engineering.command-observation","operation":"execute_rizin_command","parameters":{"path":"C:/Users/tjzhong/AppData/Local/Tabbit/Application/1.18.21.0/Tabbit.dll","command":"e scr.color=0;af @ 0x1837fe860;pdgo @ 0x1837fe860;afij @ 0x1837fe860","provider_executable":"C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe","command_arguments":["-N","-q","-c","e scr.color=0;af @ 0x1837fe860;pdgo @ 0x1837fe860;afij @ 0x1837fe860","C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"]},"raw_result":{"stdout":" |\r\n 0x1837fe860 |void fcn.1837fe860(int64_t arg1)\r\n |{\r\n | int32_t iVar1;\r\n | int32_t *piVar2;\r\n | uint64_t uVar3;\r\n | int32_t *piVar4;\r\n | undefined8 uVar5;\r\n | undefined8 uVar6;\r\n | code *pcVar7;\r\n | uint64_t uVar8;\r\n | undefined8 uVar9;\r\n | undefined8 *puVar10;\r\n | undefined8 *puVar11;\r\n | undefined8 *puVar12;\r\n | int64_t iVar13;\r\n | undefined8 *puVar14;\r\n | undefined8 *puVar15;\r\n | undefined auStack_88 [40];\r\n | int64_t var_60h;\r\n | int64_t var_40h;\r\n | int64_t var_38h;\r\n | \r\n 0x1837fe874 | var_38h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_88;\r\n 0x1837fe883 | if (*(char *)(arg1 + 0x8211) == '\\0') {\r\n 0x1837fe88c | *(undefined *)(arg1 + 0x8211) = 1;\r\n 0x1837fe893 | func_0x000184cb7790(arg1 + 0x8218);\r\n 0x1837fe89f | func_0x000180f718e0(arg1 + 0xa8);\r\n 0x1837fe8ab | func_0x000180f718e0(arg1 + 0x108);\r\n 0x1837fe8b7 | func_0x000180f718e0(arg1 + 0x168);\r\n 0x1837fe8ca | *(undefined *)(*(int64_t *)(arg1 + 0x8278) + 4) = 1;\r\n 0x1837fe8d3 | piVar4 = (int32_t *)func_0x000185f006b8(8);\r\n 0x1837fe8d8 | *piVar4 = 0;\r\n 0x1837fe8de | *(undefined *)(piVar4 + 1) = 0;\r\n 0x1837fe8e5 | if (piVar4 != (int32_t *)0x0) {\r\n 0x1837fe8ec | LOCK();\r\n 0x1837fe8ec | iVar1 = *piVar4;\r\n 0x1837fe8ec | *piVar4 = *piVar4 + 1;\r\n 0x1837fe8ec | UNLOCK();\r\n 0x1837fe8f6 | if (iVar1 == 0x7fffffff) goto code_r0x0001837febeb;\r\n | }\r\n 0x1837fe8fc | piVar2 = *(int32_t **)(arg1 + 0x8278);\r\n 0x1837fe903 | *(int32_t **)(arg1 + 0x8278) = piVar4;\r\n 0x1837fe90d | if (piVar2 != (int32_t *)0x0) {\r\n 0x1837fe90f | LOCK();\r\n 0x1837fe90f | *piVar2 = *piVar2 + -1;\r\n 0x1837fe90f | UNLOCK();\r\n 0x1837fe912 | if (*piVar2 == 0) {\r\n 0x1837fea4a | func_0x0001841dcbe0(piVar2, 8);\r\n | }\r\n | }\r\n 0x1837fe926 | func_0x0001837fec00(arg1, arg1 + 0x48, arg1 + 0x8212);\r\n 0x1837fe939 | func_0x0001837fec00(arg1, arg1 + 0x68, arg1 + 0x8213);\r\n 0x1837fe94f | func_0x0001837fec00(arg1, arg1 + 0x88, arg1 + 0x8214);\r\n 0x1837fe966 | if ((uint32_t)*(int64_t *)(arg1 + 8) < 0xfffffff4 && *(int64_t *)(arg1 + 8) != 0) {\r\n 0x1837fe968 | func_0x000184d01b00();\r\n 0x1837fe96d | uVar5 = *(undefined8 *)(arg1 + 8);\r\n 0x1837fe979 | if (*(int64_t *)0x191e21558 == 0) {\r\n 0x1837feb9c | uVar6 = (*(code *)0x11c21ca0)(0);\r\n 0x1837febac | pcVar7 = (code *)(*(code *)0x11c21da6)(uVar6, 0x1911fc1e0);\r\n 0x1837febb5 | if (pcVar7 == (code *)0x0) {\r\n 0x1837febee | uVar6 = 0;\r\n |code_r0x0001837febcc:\r\n 0x1837febcc | uVar9 = 0;\r\n | } else {\r\n 0x1837febc1 | if (pcVar7 != sym.Tabbit.dll_GetHandleVerifier) {\r\n 0x1837febc3 | uVar6 = (*(code *)0x185f59da0)();\r\n 0x1837febc3 | goto code_r0x0001837febcc;\r\n | }\r\n 0x1837febd8 | uVar6 = 0;\r\n 0x1837febda | uVar9 = 1;\r\n | }\r\n 0x1837febce | func_0x000180f43100(uVar6, uVar9);\r\n | }\r\n 0x1837fe98f | (*(code *)0x185f59da0)(*(int64_t *)0x191e21558, uVar5);\r\n 0x1837fe995 | *(undefined8 *)(arg1 + 8) = 0;\r\n | }\r\n 0x1837fe99d | puVar11 = *(undefined8 **)(arg1 + 0x81d0);\r\n 0x1837fe9ae | puVar12 = puVar11;\r\n 0x1837fe9ae | if (puVar11 != *(undefined8 **)(arg1 + 0x81d8)) {\r\n 0x1837fe9b4 | uVar3 = *(uint64_t *)(arg1 + 0x81e8);\r\n 0x1837fe9db | puVar14 = (undefined8 *)puVar11[uVar3 / 0x15];\r\n 0x1837fe9f1 | puVar10 = puVar14 + (uVar3 % 0x15) * 3;\r\n 0x1837fe9fc | uVar8 = uVar3 + *(int64_t *)(arg1 + 0x81f0);\r\n 0x1837fea2c | puVar15 = (undefined8 *)((uVar8 % 0x15) * 0x18 + puVar11[uVar8 / 0x15]);\r\n 0x1837fea33 | puVar12 = *(undefined8 **)(arg1 + 0x81d8);\r\n 0x1837fea33 | if (puVar10 != puVar15) {\r\n 0x1837fea35 | puVar11 = puVar11 + uVar3 / 0x15;\r\n | do {\r\n 0x1837fea8b | if (puVar10 == (undefined8 *)0x0) {\r\n 0x1837feb98 | // WARNING: Does not return\r\n 0x1837feb98 | pcVar7 = (code *)invalidInstructionException();\r\n 0x1837feb98 | (*pcVar7)();\r\n | }\r\n 0x1837fea95 | if (*(char *)((int64_t)puVar10 + 0x17) < '\\0') {\r\n 0x1837fea5b | func_0x0001841dcbe0(*puVar10, puVar10[2] & 0x7fffffffffffffff);\r\n 0x1837fea63 | puVar14 = (undefined8 *)*puVar11;\r\n | }\r\n 0x1837fea66 | puVar10 = puVar10 + 3;\r\n 0x1837fea76 | if ((int64_t)puVar10 - (int64_t)puVar14 == 0x1f8) {\r\n 0x1837fea78 | puVar10 = (undefined8 *)puVar11[1];\r\n 0x1837fea7c | puVar11 = puVar11 + 1;\r\n 0x1837fea80 | puVar14 = puVar10;\r\n | }\r\n 0x1837fea86 | } while (puVar10 != puVar15);\r\n 0x1837feaa5 | puVar11 = *(undefined8 **)(arg1 + 0x81d0);\r\n 0x1837feaac | puVar12 = *(undefined8 **)(arg1 + 0x81d8);\r\n | }\r\n | }\r\n 0x1837feab3 | *(undefined8 *)(arg1 + 0x81f0) = 0;\r\n 0x1837feaba | iVar13 = (int64_t)puVar12 - (int64_t)puVar11;\r\n 0x1837feac5 | while (uVar3 = iVar13 >> 3, 2 < uVar3) {\r\n 0x1837feac7 | func_0x0001841dcbe0(*puVar11, 0x1f8);\r\n 0x1837feae2 | puVar11 = (undefined8 *)(*(int64_t *)(arg1 + 0x81d0) + 8);\r\n 0x1837feae6 | *(undefined8 **)(arg1 + 0x81d0) = puVar11;\r\n 0x1837feaed | iVar13 = *(int64_t *)(arg1 + 0x81d8) - (int64_t)puVar11;\r\n | }\r\n 0x1837feafe | if (uVar3 == 1) {\r\n 0x1837feb0d | uVar5 = 10;\r\n |code_r0x0001837feb12:\r\n 0x1837feb12 | *(undefined8 *)(arg1 + 0x81e8) = uVar5;\r\n 0x1837feb04 | } else if (uVar3 == 2) {\r\n 0x1837feb06 | uVar5 = 0x15;\r\n 0x1837feb0b | goto code_r0x0001837feb12;\r\n | }\r\n 0x1837feb1c | *(undefined8 *)(arg1 + 0x8200) = 0;\r\n 0x1837feb1c | *(undefined8 *)(arg1 + 0x8208) = 0;\r\n 0x1837feb23 | iVar13 = *(int64_t *)(arg1 + 0x28);\r\n 0x1837feb2a | if (iVar13 != 0) {\r\n 0x1837feb2c | uVar5 = *(undefined8 *)(arg1 + 0x18);\r\n 0x1837feb30 | *(undefined8 *)(arg1 + 0x28) = 0;\r\n 0x1837feb46 | func_0x000184339cd0(&var_60h, 0x190151718, 0x190c22d30, 0xa9);\r\n 0x1837feb70 | var_40h = iVar13;\r\n 0x1837feb70 | (*(code *)0x185f59da0)(uVar5, &var_60h, &var_40h, 0);\r\n | }\r\n | }\r\n 0x1837feb88 | if (*(uint64_t *)0x191c71040 == (var_38h ^ (uint64_t)auStack_88)) {\r\n 0x1837feb97 | return;\r\n | }\r\n 0x1837febe3 | func_0x000185f05b40(var_38h ^ (uint64_t)auStack_88);\r\n |code_r0x0001837febeb:\r\n 0x1837febeb | pcVar7 = (code *)swi(3);\r\n 0x1837febeb | (*pcVar7)();\r\n 0x1837febeb | return;\r\n |}\r\n[{\"offset\":6501165152,\"name\":\"fcn.1837fe860\",\"size\":914,\"is-pure\":false,\"realsz\":912,\"noreturn\":false,\"stackframe\":136,\"calltype\":\"ms\",\"cost\":296,\"cc\":24,\"loops\":6,\"bits\":64,\"type\":\"fcn\",\"nbbs\":42,\"edges\":60,\"ebbs\":3,\"signature\":\"fcn.1837fe860(int64_t arg1);\",\"minbound\":6501165152,\"maxbound\":6501166066,\"callrefs\":[{\"from\":6501165210,\"to\":6522894224,\"type\":\"CALL\"},{\"from\":6501165222,\"to\":6458644704,\"type\":\"CALL\"},{\"from\":6501165234,\"to\":6458644704,\"type\":\"CALL\"},{\"from\":6501165246,\"to\":6458644704,\"type\":\"CALL\"},{\"from\":6501165267,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6501165350,\"to\":6501166080,\"type\":\"CALL\"},{\"from\":6501165369,\"to\":6501166080,\"type\":\"CALL\"},{\"from\":6501165391,\"to\":6501166080,\"type\":\"CALL\"},{\"from\":6501165416,\"to\":6523198208,\"type\":\"CALL\"},{\"from\":6501165455,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6501165635,\"to\":6501165704,\"type\":\"CODE\"},{\"from\":6501165642,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6501165647,\"to\":6501165336,\"type\":\"CODE\"},{\"from\":6501165662,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6501165719,\"to\":6501165652,\"type\":\"CODE\"},{\"from\":6501165731,\"to\":6501165747,\"type\":\"CODE\"},{\"from\":6501165775,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6501165835,\"to\":6501165842,\"type\":\"CODE\"},{\"from\":6501165908,\"to\":6512942288,\"type\":\"CALL\"},{\"from\":6501165936,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6501165980,\"to\":6740378496,\"type\":\"CALL\"},{\"from\":6501165996,\"to\":6740378584,\"type\":\"CALL\"},{\"from\":6501166019,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6501166030,\"to\":6458454272,\"type\":\"CALL\"},{\"from\":6501166035,\"to\":6501165439,\"type\":\"CODE\"},{\"from\":6501166044,\"to\":6501166030,\"type\":\"CODE\"},{\"from\":6501166054,\"to\":6542089024,\"type\":\"CALL\"},{\"from\":6501166064,\"to\":6501166028,\"type\":\"CODE\"}],\"datarefs\":[{\"from\":6501165165,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6501165425,\"to\":6742480216,\"type\":\"DATA\"},{\"from\":6501165439,\"to\":6742480216,\"type\":\"DATA\"},{\"from\":6501165880,\"to\":6712268568,\"type\":\"DATA\"},{\"from\":6501165887,\"to\":6723611952,\"type\":\"DATA\"},{\"from\":6501165950,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6501165986,\"to\":6729744864,\"type\":\"DATA\"},{\"from\":6501166007,\"to\":6491546928,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6501165635,\"to\":6501165704,\"type\":\"CODE\"},{\"from\":6501165647,\"to\":6501165336,\"type\":\"CODE\"},{\"from\":6501165719,\"to\":6501165652,\"type\":\"CODE\"},{\"from\":6501165731,\"to\":6501165747,\"type\":\"CODE\"},{\"from\":6501165835,\"to\":6501165842,\"type\":\"CODE\"},{\"from\":6501166035,\"to\":6501165439,\"type\":\"CODE\"},{\"from\":6501166044,\"to\":6501166030,\"type\":\"CODE\"},{\"from\":6501166064,\"to\":6501166028,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":8,\"outdegree\":20,\"nlocals\":3,\"nargs\":1,\"stackvars\":[{\"name\":\"var_60h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-96}},{\"name\":\"var_40h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-64}},{\"name\":\"var_38h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-56}}],\"regvars\":[{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"normalized_result":{"stdout":" |\r\n 0x1837fe860 |void fcn.1837fe860(int64_t arg1)\r\n |{\r\n | int32_t iVar1;\r\n | int32_t *piVar2;\r\n | uint64_t uVar3;\r\n | int32_t *piVar4;\r\n | undefined8 uVar5;\r\n | undefined8 uVar6;\r\n | code *pcVar7;\r\n | uint64_t uVar8;\r\n | undefined8 uVar9;\r\n | undefined8 *puVar10;\r\n | undefined8 *puVar11;\r\n | undefined8 *puVar12;\r\n | int64_t iVar13;\r\n | undefined8 *puVar14;\r\n | undefined8 *puVar15;\r\n | undefined auStack_88 [40];\r\n | int64_t var_60h;\r\n | int64_t var_40h;\r\n | int64_t var_38h;\r\n | \r\n 0x1837fe874 | var_38h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_88;\r\n 0x1837fe883 | if (*(char *)(arg1 + 0x8211) == '\\0') {\r\n 0x1837fe88c | *(undefined *)(arg1 + 0x8211) = 1;\r\n 0x1837fe893 | func_0x000184cb7790(arg1 + 0x8218);\r\n 0x1837fe89f | func_0x000180f718e0(arg1 + 0xa8);\r\n 0x1837fe8ab | func_0x000180f718e0(arg1 + 0x108);\r\n 0x1837fe8b7 | func_0x000180f718e0(arg1 + 0x168);\r\n 0x1837fe8ca | *(undefined *)(*(int64_t *)(arg1 + 0x8278) + 4) = 1;\r\n 0x1837fe8d3 | piVar4 = (int32_t *)func_0x000185f006b8(8);\r\n 0x1837fe8d8 | *piVar4 = 0;\r\n 0x1837fe8de | *(undefined *)(piVar4 + 1) = 0;\r\n 0x1837fe8e5 | if (piVar4 != (int32_t *)0x0) {\r\n 0x1837fe8ec | LOCK();\r\n 0x1837fe8ec | iVar1 = *piVar4;\r\n 0x1837fe8ec | *piVar4 = *piVar4 + 1;\r\n 0x1837fe8ec | UNLOCK();\r\n 0x1837fe8f6 | if (iVar1 == 0x7fffffff) goto code_r0x0001837febeb;\r\n | }\r\n 0x1837fe8fc | piVar2 = *(int32_t **)(arg1 + 0x8278);\r\n 0x1837fe903 | *(int32_t **)(arg1 + 0x8278) = piVar4;\r\n 0x1837fe90d | if (piVar2 != (int32_t *)0x0) {\r\n 0x1837fe90f | LOCK();\r\n 0x1837fe90f | *piVar2 = *piVar2 + -1;\r\n 0x1837fe90f | UNLOCK();\r\n 0x1837fe912 | if (*piVar2 == 0) {\r\n 0x1837fea4a | func_0x0001841dcbe0(piVar2, 8);\r\n | }\r\n | }\r\n 0x1837fe926 | func_0x0001837fec00(arg1, arg1 + 0x48, arg1 + 0x8212);\r\n 0x1837fe939 | func_0x0001837fec00(arg1, arg1 + 0x68, arg1 + 0x8213);\r\n 0x1837fe94f | func_0x0001837fec00(arg1, arg1 + 0x88, arg1 + 0x8214);\r\n 0x1837fe966 | if ((uint32_t)*(int64_t *)(arg1 + 8) < 0xfffffff4 && *(int64_t *)(arg1 + 8) != 0) {\r\n 0x1837fe968 | func_0x000184d01b00();\r\n 0x1837fe96d | uVar5 = *(undefined8 *)(arg1 + 8);\r\n 0x1837fe979 | if (*(int64_t *)0x191e21558 == 0) {\r\n 0x1837feb9c | uVar6 = (*(code *)0x11c21ca0)(0);\r\n 0x1837febac | pcVar7 = (code *)(*(code *)0x11c21da6)(uVar6, 0x1911fc1e0);\r\n 0x1837febb5 | if (pcVar7 == (code *)0x0) {\r\n 0x1837febee | uVar6 = 0;\r\n |code_r0x0001837febcc:\r\n 0x1837febcc | uVar9 = 0;\r\n | } else {\r\n 0x1837febc1 | if (pcVar7 != sym.Tabbit.dll_GetHandleVerifier) {\r\n 0x1837febc3 | uVar6 = (*(code *)0x185f59da0)();\r\n 0x1837febc3 | goto code_r0x0001837febcc;\r\n | }\r\n 0x1837febd8 | uVar6 = 0;\r\n 0x1837febda | uVar9 = 1;\r\n | }\r\n 0x1837febce | func_0x000180f43100(uVar6, uVar9);\r\n | }\r\n 0x1837fe98f | (*(code *)0x185f59da0)(*(int64_t *)0x191e21558, uVar5);\r\n 0x1837fe995 | *(undefined8 *)(arg1 + 8) = 0;\r\n | }\r\n 0x1837fe99d | puVar11 = *(undefined8 **)(arg1 + 0x81d0);\r\n 0x1837fe9ae | puVar12 = puVar11;\r\n 0x1837fe9ae | if (puVar11 != *(undefined8 **)(arg1 + 0x81d8)) {\r\n 0x1837fe9b4 | uVar3 = *(uint64_t *)(arg1 + 0x81e8);\r\n 0x1837fe9db | puVar14 = (undefined8 *)puVar11[uVar3 / 0x15];\r\n 0x1837fe9f1 | puVar10 = puVar14 + (uVar3 % 0x15) * 3;\r\n 0x1837fe9fc | uVar8 = uVar3 + *(int64_t *)(arg1 + 0x81f0);\r\n 0x1837fea2c | puVar15 = (undefined8 *)((uVar8 % 0x15) * 0x18 + puVar11[uVar8 / 0x15]);\r\n 0x1837fea33 | puVar12 = *(undefined8 **)(arg1 + 0x81d8);\r\n 0x1837fea33 | if (puVar10 != puVar15) {\r\n 0x1837fea35 | puVar11 = puVar11 + uVar3 / 0x15;\r\n | do {\r\n 0x1837fea8b | if (puVar10 == (undefined8 *)0x0) {\r\n 0x1837feb98 | // WARNING: Does not return\r\n 0x1837feb98 | pcVar7 = (code *)invalidInstructionException();\r\n 0x1837feb98 | (*pcVar7)();\r\n | }\r\n 0x1837fea95 | if (*(char *)((int64_t)puVar10 + 0x17) < '\\0') {\r\n 0x1837fea5b | func_0x0001841dcbe0(*puVar10, puVar10[2] & 0x7fffffffffffffff);\r\n 0x1837fea63 | puVar14 = (undefined8 *)*puVar11;\r\n | }\r\n 0x1837fea66 | puVar10 = puVar10 + 3;\r\n 0x1837fea76 | if ((int64_t)puVar10 - (int64_t)puVar14 == 0x1f8) {\r\n 0x1837fea78 | puVar10 = (undefined8 *)puVar11[1];\r\n 0x1837fea7c | puVar11 = puVar11 + 1;\r\n 0x1837fea80 | puVar14 = puVar10;\r\n | }\r\n 0x1837fea86 | } while (puVar10 != puVar15);\r\n 0x1837feaa5 | puVar11 = *(undefined8 **)(arg1 + 0x81d0);\r\n 0x1837feaac | puVar12 = *(undefined8 **)(arg1 + 0x81d8);\r\n | }\r\n | }\r\n 0x1837feab3 | *(undefined8 *)(arg1 + 0x81f0) = 0;\r\n 0x1837feaba | iVar13 = (int64_t)puVar12 - (int64_t)puVar11;\r\n 0x1837feac5 | while (uVar3 = iVar13 >> 3, 2 < uVar3) {\r\n 0x1837feac7 | func_0x0001841dcbe0(*puVar11, 0x1f8);\r\n 0x1837feae2 | puVar11 = (undefined8 *)(*(int64_t *)(arg1 + 0x81d0) + 8);\r\n 0x1837feae6 | *(undefined8 **)(arg1 + 0x81d0) = puVar11;\r\n 0x1837feaed | iVar13 = *(int64_t *)(arg1 + 0x81d8) - (int64_t)puVar11;\r\n | }\r\n 0x1837feafe | if (uVar3 == 1) {\r\n 0x1837feb0d | uVar5 = 10;\r\n |code_r0x0001837feb12:\r\n 0x1837feb12 | *(undefined8 *)(arg1 + 0x81e8) = uVar5;\r\n 0x1837feb04 | } else if (uVar3 == 2) {\r\n 0x1837feb06 | uVar5 = 0x15;\r\n 0x1837feb0b | goto code_r0x0001837feb12;\r\n | }\r\n 0x1837feb1c | *(undefined8 *)(arg1 + 0x8200) = 0;\r\n 0x1837feb1c | *(undefined8 *)(arg1 + 0x8208) = 0;\r\n 0x1837feb23 | iVar13 = *(int64_t *)(arg1 + 0x28);\r\n 0x1837feb2a | if (iVar13 != 0) {\r\n 0x1837feb2c | uVar5 = *(undefined8 *)(arg1 + 0x18);\r\n 0x1837feb30 | *(undefined8 *)(arg1 + 0x28) = 0;\r\n 0x1837feb46 | func_0x000184339cd0(&var_60h, 0x190151718, 0x190c22d30, 0xa9);\r\n 0x1837feb70 | var_40h = iVar13;\r\n 0x1837feb70 | (*(code *)0x185f59da0)(uVar5, &var_60h, &var_40h, 0);\r\n | }\r\n | }\r\n 0x1837feb88 | if (*(uint64_t *)0x191c71040 == (var_38h ^ (uint64_t)auStack_88)) {\r\n 0x1837feb97 | return;\r\n | }\r\n 0x1837febe3 | func_0x000185f05b40(var_38h ^ (uint64_t)auStack_88);\r\n |code_r0x0001837febeb:\r\n 0x1837febeb | pcVar7 = (code *)swi(3);\r\n 0x1837febeb | (*pcVar7)();\r\n 0x1837febeb | return;\r\n |}\r\n[{\"offset\":6501165152,\"name\":\"fcn.1837fe860\",\"size\":914,\"is-pure\":false,\"realsz\":912,\"noreturn\":false,\"stackframe\":136,\"calltype\":\"ms\",\"cost\":296,\"cc\":24,\"loops\":6,\"bits\":64,\"type\":\"fcn\",\"nbbs\":42,\"edges\":60,\"ebbs\":3,\"signature\":\"fcn.1837fe860(int64_t arg1);\",\"minbound\":6501165152,\"maxbound\":6501166066,\"callrefs\":[{\"from\":6501165210,\"to\":6522894224,\"type\":\"CALL\"},{\"from\":6501165222,\"to\":6458644704,\"type\":\"CALL\"},{\"from\":6501165234,\"to\":6458644704,\"type\":\"CALL\"},{\"from\":6501165246,\"to\":6458644704,\"type\":\"CALL\"},{\"from\":6501165267,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6501165350,\"to\":6501166080,\"type\":\"CALL\"},{\"from\":6501165369,\"to\":6501166080,\"type\":\"CALL\"},{\"from\":6501165391,\"to\":6501166080,\"type\":\"CALL\"},{\"from\":6501165416,\"to\":6523198208,\"type\":\"CALL\"},{\"from\":6501165455,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6501165635,\"to\":6501165704,\"type\":\"CODE\"},{\"from\":6501165642,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6501165647,\"to\":6501165336,\"type\":\"CODE\"},{\"from\":6501165662,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6501165719,\"to\":6501165652,\"type\":\"CODE\"},{\"from\":6501165731,\"to\":6501165747,\"type\":\"CODE\"},{\"from\":6501165775,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6501165835,\"to\":6501165842,\"type\":\"CODE\"},{\"from\":6501165908,\"to\":6512942288,\"type\":\"CALL\"},{\"from\":6501165936,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6501165980,\"to\":6740378496,\"type\":\"CALL\"},{\"from\":6501165996,\"to\":6740378584,\"type\":\"CALL\"},{\"from\":6501166019,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6501166030,\"to\":6458454272,\"type\":\"CALL\"},{\"from\":6501166035,\"to\":6501165439,\"type\":\"CODE\"},{\"from\":6501166044,\"to\":6501166030,\"type\":\"CODE\"},{\"from\":6501166054,\"to\":6542089024,\"type\":\"CALL\"},{\"from\":6501166064,\"to\":6501166028,\"type\":\"CODE\"}],\"datarefs\":[{\"from\":6501165165,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6501165425,\"to\":6742480216,\"type\":\"DATA\"},{\"from\":6501165439,\"to\":6742480216,\"type\":\"DATA\"},{\"from\":6501165880,\"to\":6712268568,\"type\":\"DATA\"},{\"from\":6501165887,\"to\":6723611952,\"type\":\"DATA\"},{\"from\":6501165950,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6501165986,\"to\":6729744864,\"type\":\"DATA\"},{\"from\":6501166007,\"to\":6491546928,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6501165635,\"to\":6501165704,\"type\":\"CODE\"},{\"from\":6501165647,\"to\":6501165336,\"type\":\"CODE\"},{\"from\":6501165719,\"to\":6501165652,\"type\":\"CODE\"},{\"from\":6501165731,\"to\":6501165747,\"type\":\"CODE\"},{\"from\":6501165835,\"to\":6501165842,\"type\":\"CODE\"},{\"from\":6501166035,\"to\":6501165439,\"type\":\"CODE\"},{\"from\":6501166044,\"to\":6501166030,\"type\":\"CODE\"},{\"from\":6501166064,\"to\":6501166028,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":8,\"outdegree\":20,\"nlocals\":3,\"nargs\":1,\"stackvars\":[{\"name\":\"var_60h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-96}},{\"name\":\"var_40h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-64}},{\"name\":\"var_38h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-56}}],\"regvars\":[{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"confidence":"observed","authority":"shipped-artifact","environment":null,"limitations":["The executable version and supported formats are reported as unknown because no reliable version probe was performed.","A non-zero process exit is preserved as an observed command result.","Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.","When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call."],"relationship_coverage":null,"locations":[{"kind":"artifact-path","path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"}],"evidence_links":[]},"meta":{"command":"execute-rizin-command","duration":"5212ms"}}