ShadowPlayExt.dll
1278e2dd44d3b638091913ad27719b7d8e67766a21bc34ddf882e537fb23fa30
Identity
| Property | Value |
|---|---|
| Architecture | x86 |
| Source size | 1,172,592 bytes |
| Preferred image base | 0x10000000 |
| Entry RVA | 0x4cf50 |
| Imports / exports | 209 / 5 |
| Exception/unwind ranges | 0 |
| Executable raw bytes | 798,720 |
Physical paths:
Installer2\ShadowPlay.{D93CCF6F-6877-4B4B-83B0-4AF388304402}\ShadowPlayExt.dll
Decompilation coverage
Complete with errors: 4,125 successful reconstructions, 11 failures, 4,136 attempted entries, 4,136 reported discovered entries.
Counts refer to automated analysis, not manual review or recovered source code. Function boundaries can change during analysis.
Sections
| Section | RVA | Raw offset | Raw bytes | Virtual bytes | R / W / X | Entropy |
|---|---|---|---|---|---|---|
.text |
0x1000 |
1024 |
798,720 | 798,271 | yes / no / yes | 6.5943 |
.rdata |
0xc4000 |
799744 |
254,976 | 254,508 | yes / no / no | 5.1138 |
.data |
0x103000 |
1054720 |
36,352 | 41,780 | yes / yes / no | 4.9942 |
.rsrc |
0x10e000 |
1091072 |
17,408 | 17,229 | yes / no / no | 4.7609 |
.reloc |
0x113000 |
1108480 |
53,760 | 53,552 | yes / no / no | 6.6003 |
PE mitigation flags
| Flag | Present |
|---|---|
| dynamic_base | true |
| high_entropy_va | false |
| nx_compat | true |
| guard_cf_flag | true |
| no_seh | false |
| appcontainer | false |
| force_integrity | false |
Evidence
Large artifacts require Git LFS. A filename hash identifies the original PE; the content of a generated artifact has a different digest.