AppDiscovery.dll
ee57869caf91ca90b55c43a549edbe255e9c2822f36bf26a8de578387df10870
Identity
| Property | Value |
|---|---|
| Architecture | AMD64 |
| Source size | 1,699,952 bytes |
| Preferred image base | 0x180000000 |
| Entry RVA | 0x1710 |
| Imports / exports | 394 / 1 |
| Exception/unwind ranges | 4,450 |
| Executable raw bytes | 1,355,776 |
Physical paths:
NVIDIA App\CEF\plugins\NVIDIA App\AppDiscovery.dll
Decompilation coverage
Complete with errors: 8,533 successful reconstructions, 3 failures, 8,536 attempted entries, 8,536 reported discovered entries.
Counts refer to automated analysis, not manual review or recovered source code. Function boundaries can change during analysis.
Sections
| Section | RVA | Raw offset | Raw bytes | Virtual bytes | R / W / X | Entropy |
|---|---|---|---|---|---|---|
.text |
0x1000 |
1024 |
1,355,776 | 1,355,503 | yes / no / yes | 5.0022 |
.rdata |
0x14c000 |
1356800 |
211,968 | 211,847 | yes / no / no | 4.821 |
.data |
0x180000 |
1568768 |
18,944 | 24,625 | yes / yes / no | 3.965 |
.pdata |
0x187000 |
1587712 |
59,392 | 59,040 | yes / no / no | 5.7508 |
.idata |
0x196000 |
1647104 |
27,136 | 26,793 | yes / no / no | 4.3415 |
.gfids |
0x19d000 |
1674240 |
4,096 | 4,044 | yes / no / no | 3.3157 |
.giats |
0x19e000 |
1678336 |
512 | 276 | yes / no / no | 0.1537 |
.tls |
0x19f000 |
1678848 |
1,024 | 777 | yes / yes / no | 0.0112 |
.00cfg |
0x1a0000 |
1679872 |
512 | 373 | yes / no / no | 0.4319 |
.rsrc |
0x1a1000 |
1680384 |
2,048 | 1,558 | yes / no / no | 3.3489 |
.reloc |
0x1a2000 |
1682432 |
7,168 | 7,003 | yes / no / no | 2.442 |
PE mitigation flags
| Flag | Present |
|---|---|
| dynamic_base | true |
| high_entropy_va | true |
| nx_compat | true |
| guard_cf_flag | true |
| no_seh | false |
| appcontainer | false |
| force_integrity | false |
Extracted native interfaces
| Name | Command | Notification | Description |
|---|---|---|---|
AppActionNotification |
True | False | Installation status notifications for a given app |
InstallApp |
True | False | |
UninstallApp |
True | False | |
GetAppStatus |
True | False | |
GetAppsStatus |
True | False | |
LaunchApp |
True | False |
Evidence
Large artifacts require Git LFS. A filename hash identifies the original PE; the content of a generated artifact has a different digest.