nvsphelperplugin64.dll
43b98088129920386e56ce706e292a49283404fdffdf834db7c47f2ca6ed6fb6
Identity
| Property | Value |
|---|---|
| Architecture | AMD64 |
| Source size | 1,056,368 bytes |
| Preferred image base | 0x180000000 |
| Entry RVA | 0x1420 |
| Imports / exports | 228 / 2 |
| Exception/unwind ranges | 2,434 |
| Executable raw bytes | 829,952 |
Physical paths:
NVIDIA App\ShadowPlay\nvsphelperplugin64.dll
Decompilation coverage
Complete: 4,114 successful reconstructions, 0 failures, 4,114 attempted entries, 4,114 reported discovered entries.
Counts refer to automated analysis, not manual review or recovered source code. Function boundaries can change during analysis.
Sections
| Section | RVA | Raw offset | Raw bytes | Virtual bytes | R / W / X | Entropy |
|---|---|---|---|---|---|---|
.text |
0x1000 |
1024 |
829,952 | 829,464 | yes / no / yes | 5.1909 |
.rdata |
0xcc000 |
830976 |
153,088 | 152,619 | yes / no / no | 4.6451 |
.data |
0xf2000 |
984064 |
8,192 | 29,184 | yes / yes / no | 2.0304 |
.pdata |
0xfa000 |
992256 |
32,768 | 32,424 | yes / no / no | 5.6087 |
.idata |
0x102000 |
1025024 |
11,264 | 10,903 | yes / no / no | 3.8778 |
.gfids |
0x105000 |
1036288 |
1,536 | 1,332 | yes / no / no | 2.4161 |
.tls |
0x106000 |
1037824 |
1,024 | 782 | yes / yes / no | 0.0112 |
.00cfg |
0x107000 |
1038848 |
512 | 373 | yes / no / no | 0.4063 |
.rsrc |
0x108000 |
1039360 |
1,024 | 932 | yes / no / no | 3.0709 |
.reloc |
0x109000 |
1040384 |
5,632 | 5,436 | yes / no / no | 3.061 |
PE mitigation flags
| Flag | Present |
|---|---|
| dynamic_base | true |
| high_entropy_va | true |
| nx_compat | true |
| guard_cf_flag | true |
| no_seh | false |
| appcontainer | false |
| force_integrity | false |
Evidence
Large artifacts require Git LFS. A filename hash identifies the original PE; the content of a generated artifact has a different digest.