nvspscreenshot64.dll
7b8b6ce9e4f48ae53f55ed74e1df2285bfa6c2ea2e5e28e920810c02c87a5ebd
Identity
| Property | Value |
|---|---|
| Architecture | AMD64 |
| Source size | 1,545,840 bytes |
| Preferred image base | 0x180000000 |
| Entry RVA | 0x1600 |
| Imports / exports | 175 / 1 |
| Exception/unwind ranges | 3,399 |
| Executable raw bytes | 1,234,432 |
Physical paths:
NVIDIA App\ShadowPlay\nvspscreenshot64.dll
Decompilation coverage
Complete: 6,366 successful reconstructions, 0 failures, 6,366 attempted entries, 6,366 reported discovered entries.
Counts refer to automated analysis, not manual review or recovered source code. Function boundaries can change during analysis.
Sections
| Section | RVA | Raw offset | Raw bytes | Virtual bytes | R / W / X | Entropy |
|---|---|---|---|---|---|---|
.text |
0x1000 |
1024 |
1,234,432 | 1,234,372 | yes / no / yes | 5.3002 |
.rdata |
0x12f000 |
1235456 |
216,576 | 216,134 | yes / no / no | 4.6124 |
.data |
0x164000 |
1452032 |
13,312 | 26,008 | yes / yes / no | 2.932 |
.pdata |
0x16b000 |
1465344 |
45,568 | 45,156 | yes / no / no | 5.7017 |
.idata |
0x177000 |
1510912 |
9,216 | 8,909 | yes / no / no | 3.7094 |
.gfids |
0x17a000 |
1520128 |
4,096 | 3,588 | yes / no / no | 2.7963 |
.00cfg |
0x17b000 |
1524224 |
512 | 373 | yes / no / no | 0.3697 |
.tls |
0x17c000 |
1524736 |
1,024 | 777 | yes / yes / no | 0.0112 |
.rsrc |
0x17d000 |
1525760 |
1,024 | 932 | yes / no / no | 3.0771 |
.reloc |
0x17e000 |
1526784 |
8,704 | 8,345 | yes / no / no | 3.2656 |
PE mitigation flags
| Flag | Present |
|---|---|
| dynamic_base | true |
| high_entropy_va | true |
| nx_compat | true |
| guard_cf_flag | true |
| no_seh | false |
| appcontainer | false |
| force_integrity | false |
Evidence
Large artifacts require Git LFS. A filename hash identifies the original PE; the content of a generated artifact has a different digest.