NvTelemetryAPI64.dll
ab5455ea4ae1780b9badb809f0a6ead682b8d9e34f1c9c36252b906c697737f4
Identity
| Property | Value |
|---|---|
| Architecture | AMD64 |
| Source size | 4,868,208 bytes |
| Preferred image base | 0x180000000 |
| Entry RVA | 0x1440b0 |
| Imports / exports | 217 / 27 |
| Exception/unwind ranges | 11,344 |
| Executable raw bytes | 3,378,176 |
Physical paths:
NvTelemetry\NvTelemetryAPI64.dll
Decompilation coverage
Complete with errors: 10,059 successful reconstructions, 8 failures, 10,067 attempted entries, 10,067 reported discovered entries.
Counts refer to automated analysis, not manual review or recovered source code. Function boundaries can change during analysis.
Sections
| Section | RVA | Raw offset | Raw bytes | Virtual bytes | R / W / X | Entropy |
|---|---|---|---|---|---|---|
.text |
0x1000 |
1024 |
3,378,176 | 3,377,669 | yes / no / yes | 6.7711 |
.rdata |
0x33a000 |
3379200 |
1,259,520 | 1,259,410 | yes / no / no | 5.6244 |
.data |
0x46e000 |
4638720 |
27,648 | 46,164 | yes / yes / no | 4.7197 |
.pdata |
0x47a000 |
4666368 |
136,192 | 136,128 | yes / no / no | 6.2811 |
_RDATA |
0x49c000 |
4802560 |
1,024 | 640 | yes / no / no | 3.2187 |
.rsrc |
0x49d000 |
4803584 |
1,536 | 1,392 | yes / no / no | 3.8781 |
.reloc |
0x49e000 |
4805120 |
52,736 | 52,380 | yes / no / no | 5.4329 |
PE mitigation flags
| Flag | Present |
|---|---|
| dynamic_base | true |
| high_entropy_va | true |
| nx_compat | true |
| guard_cf_flag | true |
| no_seh | false |
| appcontainer | false |
| force_integrity | false |
Selected routines
| RVA | Function | Reconstruction |
|---|---|---|
0x110550 |
InitializeTelemetry |
C text |
0x110700 |
InitializeTelemetry_2 |
C text |
0x111840 |
GetUserTelemetryConsent |
C text |
0x111c60 |
GetDeviceTelemetryConsent |
C text |
Evidence
Large artifacts require Git LFS. A filename hash identifies the original PE; the content of a generated artifact has a different digest.