DriverInstall.dll
429f7cccf4828a0cfd17962a50bb6d5b8bbe14a0666d6d36ca0a7173a4303fa1
Identity
| Property | Value |
|---|---|
| Architecture | AMD64 |
| Source size | 1,692,272 bytes |
| Preferred image base | 0x180000000 |
| Entry RVA | 0x16a0 |
| Imports / exports | 385 / 1 |
| Exception/unwind ranges | 4,343 |
| Executable raw bytes | 1,351,168 |
Physical paths:
NVIDIA App\CEF\plugins\NVIDIA App\DriverInstall.dll
Decompilation coverage
Complete with errors: 8,408 successful reconstructions, 3 failures, 8,411 attempted entries, 8,411 reported discovered entries.
Counts refer to automated analysis, not manual review or recovered source code. Function boundaries can change during analysis.
Sections
| Section | RVA | Raw offset | Raw bytes | Virtual bytes | R / W / X | Entropy |
|---|---|---|---|---|---|---|
.text |
0x1000 |
1024 |
1,351,168 | 1,350,966 | yes / no / yes | 4.996 |
.rdata |
0x14b000 |
1352192 |
212,480 | 212,248 | yes / no / no | 4.7962 |
.data |
0x17f000 |
1564672 |
18,432 | 23,313 | yes / yes / no | 3.9527 |
.pdata |
0x185000 |
1583104 |
57,856 | 57,624 | yes / no / no | 5.7634 |
.idata |
0x194000 |
1640960 |
26,112 | 26,039 | yes / no / no | 4.3412 |
.gfids |
0x19b000 |
1667072 |
4,096 | 4,068 | yes / no / no | 3.2904 |
.giats |
0x19c000 |
1671168 |
512 | 276 | yes / no / no | 0.1701 |
.tls |
0x19d000 |
1671680 |
1,024 | 777 | yes / yes / no | 0.0112 |
.00cfg |
0x19e000 |
1672704 |
512 | 373 | yes / no / no | 0.3899 |
.rsrc |
0x19f000 |
1673216 |
1,536 | 1,518 | yes / no / no | 4.0747 |
.reloc |
0x1a0000 |
1674752 |
7,168 | 7,000 | yes / no / no | 2.4496 |
PE mitigation flags
| Flag | Present |
|---|---|
| dynamic_base | true |
| high_entropy_va | true |
| nx_compat | true |
| guard_cf_flag | true |
| no_seh | false |
| appcontainer | false |
| force_integrity | false |
Extracted native interfaces
| Name | Command | Notification | Description |
|---|---|---|---|
InstallAsync |
True | False | Install driver endpoint |
SetState |
True | False | Set next action for installer. |
GetState |
True | False | Request last state, pushes state to RegisterFormNotification also. |
RegisterProgressNotification |
True | False | Progress callback. |
RegisterFormNotification |
True | False | Show form callback. |
Evidence
Large artifacts require Git LFS. A filename hash identifies the original PE; the content of a generated artifact has a different digest.