{ "path": "NVIDIA App\\ShadowPlay\\NVSPCAPS\\_nvspcaps64.dll", "sha256": "0c8f771fa27f073701e99f1b3d49d45e6f99f1c2bba4291fa6003409a1c7ae1d", "method": "Capstone linear sweep over raw bytes of all IMAGE_SCN_MEM_EXECUTE sections; skipdata enabled; no reachability proof", "sections": [ { "name": ".text", "raw_bytes": 3005440, "processed_bytes": 3005440, "instructions": 1439711, "skipdata_bytes": 452 } ], "utc": "2026-11-11T21:40:44.422343+00:00", "instructions": 1439711, "skipdata_bytes": 452, "calls": 40319, "api_reference_counts": { "KERNEL32.dll!InitializeCriticalSection": 29, "KERNEL32.dll!GetProcessHeap": 20, "KERNEL32.dll!InitializeCriticalSectionEx": 14, "KERNEL32.dll!GetLastError": 448, "KERNEL32.dll!CloseHandle": 197, "USER32.dll!EnumDisplayDevicesA": 5, "KERNEL32.dll!Sleep": 15, "KERNEL32.dll!FreeLibrary": 76, "KERNEL32.dll!GetCurrentProcessId": 19, "KERNEL32.dll!GetCurrentProcess": 14, "KERNEL32.dll!GetSystemDirectoryW": 22, "KERNEL32.dll!GetProcAddress": 142, "KERNEL32.dll!CreateWaitableTimerA": 5, "KERNEL32.dll!SetWaitableTimer": 9, "KERNEL32.dll!CancelWaitableTimer": 7, "KERNEL32.dll!LocalAlloc": 61, "KERNEL32.dll!LocalFree": 119, "KERNEL32.dll!GetFileAttributesW": 10, "KERNEL32.dll!SetLastError": 116, "KERNEL32.dll!GetModuleHandleW": 17, "KERNEL32.dll!GetModuleFileNameW": 17, "KERNEL32.dll!VerSetConditionMask": 6, "KERNEL32.dll!VerifyVersionInfoW": 4, "KERNEL32.dll!GetFullPathNameW": 3, "KERNEL32.dll!LoadLibraryExW": 31, "KERNEL32.dll!CreateFileW": 14, "KERNEL32.dll!GetModuleFileNameA": 4, "KERNEL32.dll!CreateProcessA": 5, "KERNEL32.dll!CreateProcessW": 2, "SHELL32.dll!SHGetFolderPathW": 2, "ole32.dll!CoTaskMemFree": 17, "SHELL32.dll!SHGetFolderPathA": 9, "KERNEL32.dll!CreateFileA": 7, "KERNEL32.dll!GetCurrentThreadId": 24, "KERNEL32.dll!EnterCriticalSection": 262, "KERNEL32.dll!LeaveCriticalSection": 294, "KERNEL32.dll!DeleteCriticalSection": 61, "KERNEL32.dll!ReleaseSemaphore": 2, "KERNEL32.dll!WaitForMultipleObjects": 15, "KERNEL32.dll!SetEvent": 35, "KERNEL32.dll!CreateEventA": 23, "KERNEL32.dll!CreateSemaphoreA": 3, "KERNEL32.dll!WaitForSingleObject": 36, "USER32.dll!IsWindow": 11, "USER32.dll!PostMessageA": 13, "OLEAUT32.dll!SysAllocString": 11, "OLEAUT32.dll!SysFreeString": 21, "OLEAUT32.dll!SysAllocStringLen": 7, "KERNEL32.dll!ResetEvent": 13, "OLEAUT32.dll!VariantInit": 4, "OLEAUT32.dll!VariantCopy": 2, "KERNEL32.dll!InitializeSRWLock": 2, "KERNEL32.dll!AcquireSRWLockExclusive": 9, "KERNEL32.dll!ReleaseSRWLockExclusive": 8, "KERNEL32.dll!AcquireSRWLockShared": 2, "KERNEL32.dll!ReleaseSRWLockShared": 3, "KERNEL32.dll!TryEnterCriticalSection": 3, "ADVAPI32.dll!OpenEventLogA": 2, "ADVAPI32.dll!CloseEventLog": 3, "ADVAPI32.dll!ReadEventLogA": 2, "KERNEL32.dll!GetFileAttributesA": 7, "KERNEL32.dll!GetExitCodeProcess": 3, "KERNEL32.dll!GetTickCount": 9, "USER32.dll!WaitForInputIdle": 3, "KERNEL32.dll!TerminateProcess": 7, "USER32.dll!FindWindowW": 6, "KERNEL32.dll!OpenEventA": 17, "USER32.dll!GetForegroundWindow": 9, "KERNEL32.dll!OpenProcess": 20, "KERNEL32.dll!HeapFree": 13, "KERNEL32.dll!QueryPerformanceFrequency": 7, "KERNEL32.dll!QueryPerformanceCounter": 12, "KERNEL32.dll!CreateEventW": 5, "USER32.dll!FindWindowA": 9, "KERNEL32.dll!VirtualFree": 3, "KERNEL32.dll!GetSystemTimeAsFileTime": 16, "USER32.dll!GetSystemMetrics": 6, "USER32.dll!EnumDisplaySettingsA": 5, "KERNEL32.dll!CreateNamedPipeW": 4, "KERNEL32.dll!GetProcessTimes": 5, "KERNEL32.dll!ConnectNamedPipe": 3, "KERNEL32.dll!CancelIoEx": 3, "KERNEL32.dll!GetOverlappedResult": 5, "KERNEL32.dll!DisconnectNamedPipe": 4, "KERNEL32.dll!GetModuleHandleExW": 13, "KERNEL32.dll!FreeLibraryAndExitThread": 3, "KERNEL32.dll!GetNamedPipeClientProcessId": 2, "KERNEL32.dll!WriteFile": 12, "KERNEL32.dll!ReadFile": 8, "KERNEL32.dll!CreateThread": 5, "CRYPT32.dll!CertGetNameStringW": 5, "CRYPT32.dll!CryptQueryObject": 2, "CRYPT32.dll!CryptMsgGetParam": 3, "CRYPT32.dll!CertFindCertificateInStore": 2, "CRYPT32.dll!CertFreeCertificateContext": 2, "CRYPT32.dll!CryptMsgClose": 2, "CRYPT32.dll!CertCloseStore": 2, "KERNEL32.dll!QueryFullProcessImageNameW": 4, "SHLWAPI.dll!PathFindFileNameW": 2, "KERNEL32.dll!ExpandEnvironmentStringsW": 2, "KERNEL32.dll!RtlCaptureStackBackTrace": 2, "USER32.dll!GetDisplayConfigBufferSizes": 3, "USER32.dll!QueryDisplayConfig": 3, "KERNEL32.dll!LoadLibraryA": 10, "KERNEL32.dll!WideCharToMultiByte": 15, "KERNEL32.dll!GetThreadId": 10, "USER32.dll!PostThreadMessageA": 7, "USER32.dll!RegisterDeviceNotificationA": 3, "KERNEL32.dll!GetModuleHandleA": 2, "USER32.dll!RegisterClassExA": 2, "USER32.dll!CreateWindowExA": 2, "USER32.dll!GetMessageA": 3, "USER32.dll!TranslateMessage": 2, "USER32.dll!DispatchMessageA": 2, "USER32.dll!UnregisterDeviceNotification": 3, "USER32.dll!DestroyWindow": 2, "USER32.dll!UnregisterClassA": 8, "USER32.dll!PostQuitMessage": 2, "USER32.dll!DefWindowProcA": 2, "KERNEL32.dll!GetCommandLineA": 4, "ADVAPI32.dll!CreateWellKnownSid": 2, "ADVAPI32.dll!ImpersonateSelf": 2, "KERNEL32.dll!GetCurrentThread": 6, "ADVAPI32.dll!OpenThreadToken": 2, "ADVAPI32.dll!CreateRestrictedToken": 2, "ADVAPI32.dll!SetThreadToken": 5, "ADVAPI32.dll!RevertToSelf": 4, "KERNEL32.dll!GetFileSizeEx": 5, "KERNEL32.dll!CopyFileA": 3, "ADVAPI32.dll!GetSecurityDescriptorDacl": 9, "KERNEL32.dll!CreateDirectoryA": 9, "ADVAPI32.dll!AllocateAndInitializeSid": 4, "ADVAPI32.dll!SetEntriesInAclA": 3, "ADVAPI32.dll!InitializeSecurityDescriptor": 5, "ADVAPI32.dll!SetSecurityDescriptorDacl": 5, "ADVAPI32.dll!FreeSid": 4, "ADVAPI32.dll!GetUserNameA": 2, "ADVAPI32.dll!GetUserNameW": 3, "KERNEL32.dll!GetLocalTime": 6, "KERNEL32.dll!OutputDebugStringA": 2, "ADVAPI32.dll!RegOpenKeyExA": 19, "ADVAPI32.dll!RegQueryValueExA": 14, "ADVAPI32.dll!RegCloseKey": 14, "KERNEL32.dll!MoveFileExA": 3, "KERNEL32.dll!GetFinalPathNameByHandleA": 2, "KERNEL32.dll!DeleteFileA": 2, "KERNEL32.dll!GetSystemInfo": 5, "KERNEL32.dll!MultiByteToWideChar": 14, "ole32.dll!CoInitializeEx": 9, "KERNEL32.dll!DecodePointer": 8, "ole32.dll!CoUninitialize": 9, "KERNEL32.dll!HeapDestroy": 4, "KERNEL32.dll!HeapAlloc": 8, "KERNEL32.dll!FindFirstFileW": 2, "KERNEL32.dll!DeleteFileW": 2, "KERNEL32.dll!FindNextFileW": 5, "KERNEL32.dll!FindClose": 11, "USER32.dll!RedrawWindow": 7, "SETUPAPI.dll!SetupDiGetClassDevsW": 2, "SETUPAPI.dll!SetupDiEnumDeviceInfo": 3, "SETUPAPI.dll!SetupDiGetDeviceInstanceIdW": 2, "SETUPAPI.dll!SetupDiGetDeviceRegistryPropertyW": 2, "SETUPAPI.dll!SetupDiDestroyDeviceInfoList": 2, "KERNEL32.dll!GetTempPathW": 8, "KERNEL32.dll!HeapSize": 3, "KERNEL32.dll!CreateDirectoryW": 6, "KERNEL32.dll!RemoveDirectoryW": 2, "ole32.dll!CoCreateInstance": 8, "OLEAUT32.dll!VariantClear": 7, "KERNEL32.dll!HeapReAlloc": 3, "ole32.dll!PropVariantClear": 8, "ADVAPI32.dll!RegCreateKeyExA": 6, "ADVAPI32.dll!RegCopyTreeA": 2, "ADVAPI32.dll!RegQueryValueExW": 3, "ADVAPI32.dll!RegSetValueExA": 5, "ADVAPI32.dll!RegDeleteKeyExA": 3, "ADVAPI32.dll!RegDeleteKeyValueA": 2, "KERNEL32.dll!SetCurrentDirectoryA": 2, "ADVAPI32.dll!OpenProcessToken": 3, "ADVAPI32.dll!DuplicateTokenEx": 2, "ADVAPI32.dll!GetLengthSid": 4, "ADVAPI32.dll!SetTokenInformation": 2, "USER32.dll!FindWindowExW": 6, "USER32.dll!GetShellWindow": 3, "USER32.dll!EnumWindows": 4, "USER32.dll!EnumDisplaySettingsExA": 3, "ADVAPI32.dll!OpenSCManagerA": 2, "ADVAPI32.dll!CloseServiceHandle": 2, "KERNEL32.dll!GetSystemDirectoryA": 2, "KERNEL32.dll!GetVolumeInformationA": 2, "KERNEL32.dll!GetVersionExA": 6, "USER32.dll!GetWindowThreadProcessId": 14, "KERNEL32.dll!ProcessIdToSessionId": 2, "KERNEL32.dll!WTSGetActiveConsoleSessionId": 2, "USER32.dll!SendMessageA": 2, "SHELL32.dll!SHGetPropertyStoreFromParsingName": 2, "USER32.dll!wsprintfW": 4, "KERNEL32.dll!GetSystemTime": 2, "USER32.dll!GetWindowLongA": 4, "USER32.dll!IsWindowVisible": 7, "USER32.dll!GetWindow": 4, "USER32.dll!GetDesktopWindow": 2, "USER32.dll!GetWindowRect": 2, "USER32.dll!GetWindowDisplayAffinity": 2, "KERNEL32.dll!QueryFullProcessImageNameA": 3, "USER32.dll!EnumChildWindows": 2, "USER32.dll!GetWindowTextW": 2, "KERNEL32.dll!K32GetModuleFileNameExW": 1, "KERNEL32.dll!CreateToolhelp32Snapshot": 1, "KERNEL32.dll!Process32FirstW": 1, "KERNEL32.dll!Process32NextW": 1, "KERNEL32.dll!Module32FirstW": 1, "KERNEL32.dll!Module32NextW": 1, "KERNEL32.dll!K32GetProcessMemoryInfo": 1, "KERNEL32.dll!K32GetProcessImageFileNameA": 1, "ADVAPI32.dll!ConvertStringSecurityDescriptorToSecurityDescriptorW": 1, "ADVAPI32.dll!ConvertStringSidToSidW": 1, "SHELL32.dll!SHGetKnownFolderPath": 1, "OLEAUT32.dll!GetErrorInfo": 2, "OLEAUT32.dll!SetErrorInfo": 3, "OLEAUT32.dll!VariantChangeType": 2, "OLEAUT32.dll!CreateErrorInfo": 2, "WTSAPI32.dll!WTSRegisterSessionNotification": 1, "WTSAPI32.dll!WTSUnRegisterSessionNotification": 1, "VERSION.dll!GetFileVersionInfoSizeA": 1, "VERSION.dll!GetFileVersionInfoA": 1, "VERSION.dll!VerQueryValueA": 1, "VERSION.dll!GetFileVersionInfoSizeW": 1, "VERSION.dll!GetFileVersionInfoW": 1, "VERSION.dll!VerQueryValueW": 1, "d3d11.dll!D3D11CreateDevice": 1, "dxgi.dll!CreateDXGIFactory1": 1, "KERNEL32.dll!OutputDebugStringW": 7, "KERNEL32.dll!UnmapViewOfFile": 3, "KERNEL32.dll!FlushFileBuffers": 5, "KERNEL32.dll!OpenFileMappingA": 3, "KERNEL32.dll!ReleaseMutex": 2, "KERNEL32.dll!CreateMutexA": 2, "KERNEL32.dll!OpenMutexA": 2, "KERNEL32.dll!CreateNamedPipeA": 2, "ADVAPI32.dll!GetTokenInformation": 5, "ADVAPI32.dll!CopySid": 3, "KERNEL32.dll!CreateFileMappingA": 2, "KERNEL32.dll!MapViewOfFile": 3, "KERNEL32.dll!OpenEventW": 3, "KERNEL32.dll!CreateFileMappingW": 2, "KERNEL32.dll!OpenFileMappingW": 3, "KERNEL32.dll!CreateMutexW": 2, "KERNEL32.dll!OpenMutexW": 3, "KERNEL32.dll!GetLocaleInfoEx": 3, "KERNEL32.dll!FormatMessageA": 3, "KERNEL32.dll!GetNativeSystemInfo": 2, "KERNEL32.dll!WaitForSingleObjectEx": 2, "KERNEL32.dll!GetExitCodeThread": 2, "KERNEL32.dll!SwitchToThread": 2, "KERNEL32.dll!EncodePointer": 5, "KERNEL32.dll!LCMapStringEx": 5, "KERNEL32.dll!TryAcquireSRWLockExclusive": 3, "KERNEL32.dll!WakeAllConditionVariable": 6, "KERNEL32.dll!WakeConditionVariable": 3, "KERNEL32.dll!SleepConditionVariableSRW": 8, "KERNEL32.dll!CloseThreadpoolTimer": 2, "KERNEL32.dll!CloseThreadpoolWait": 2, "KERNEL32.dll!CreateEventExW": 2, "KERNEL32.dll!CreateSemaphoreExW": 2, "KERNEL32.dll!CreateSymbolicLinkW": 2, "KERNEL32.dll!CreateThreadpoolTimer": 2, "KERNEL32.dll!CreateThreadpoolWait": 2, "KERNEL32.dll!FlushProcessWriteBuffers": 2, "KERNEL32.dll!FreeLibraryWhenCallbackReturns": 2, "KERNEL32.dll!GetCurrentProcessorNumber": 2, "KERNEL32.dll!GetFileInformationByHandleEx": 2, "KERNEL32.dll!GetTickCount64": 2, "KERNEL32.dll!InitOnceExecuteOnce": 2, "KERNEL32.dll!SetFileInformationByHandle": 2, "KERNEL32.dll!SetThreadpoolTimer": 2, "KERNEL32.dll!SetThreadpoolWait": 2, "KERNEL32.dll!WaitForThreadpoolTimerCallbacks": 2, "KERNEL32.dll!GetStringTypeW": 5, "KERNEL32.dll!GetCPInfo": 6, "KERNEL32.dll!CompareStringEx": 3, "KERNEL32.dll!SetUnhandledExceptionFilter": 5, "KERNEL32.dll!UnhandledExceptionFilter": 4, "KERNEL32.dll!IsProcessorFeaturePresent": 7, "KERNEL32.dll!RtlCaptureContext": 6, "KERNEL32.dll!RtlLookupFunctionEntry": 7, "KERNEL32.dll!RtlVirtualUnwind": 6, "KERNEL32.dll!IsDebuggerPresent": 8, "KERNEL32.dll!GetStartupInfoW": 3, "KERNEL32.dll!InitializeSListHead": 2, "bcrypt.dll!BCryptOpenAlgorithmProvider": 1, "bcrypt.dll!BCryptSetProperty": 1, "bcrypt.dll!BCryptCloseAlgorithmProvider": 1, "bcrypt.dll!BCryptGenRandom": 1, "bcrypt.dll!BCryptCreateHash": 1, "bcrypt.dll!BCryptHashData": 1, "bcrypt.dll!BCryptFinishHash": 1, "bcrypt.dll!BCryptDestroyHash": 1, "WINTRUST.dll!WinVerifyTrust": 1, "KERNEL32.dll!RaiseException": 7, "KERNEL32.dll!RtlUnwindEx": 4, "KERNEL32.dll!RtlPcToFileHeader": 2, "KERNEL32.dll!InterlockedFlushSList": 2, "KERNEL32.dll!InterlockedPushEntrySList": 2, "KERNEL32.dll!TlsAlloc": 2, "KERNEL32.dll!TlsFree": 2, "KERNEL32.dll!TlsGetValue": 2, "KERNEL32.dll!TlsSetValue": 2, "KERNEL32.dll!InitializeCriticalSectionAndSpinCount": 3, "KERNEL32.dll!GetStdHandle": 4, "KERNEL32.dll!GetFileType": 6, "KERNEL32.dll!WriteConsoleW": 7, "KERNEL32.dll!ExitThread": 4, "KERNEL32.dll!ResumeThread": 2, "KERNEL32.dll!ExitProcess": 2, "KERNEL32.dll!SetConsoleCtrlHandler": 2, "KERNEL32.dll!EnumSystemLocalesW": 8, "KERNEL32.dll!CompareStringW": 2, "KERNEL32.dll!FlsAlloc": 2, "KERNEL32.dll!FlsFree": 2, "KERNEL32.dll!FlsGetValue": 2, "KERNEL32.dll!FlsSetValue": 2, "KERNEL32.dll!GetDateFormatW": 2, "KERNEL32.dll!GetLocaleInfoW": 12, "KERNEL32.dll!GetTimeFormatW": 2, "KERNEL32.dll!GetUserDefaultLCID": 4, "KERNEL32.dll!IsValidLocale": 3, "KERNEL32.dll!LCMapStringW": 2, "KERNEL32.dll!GetTimeZoneInformation": 2, "KERNEL32.dll!GetConsoleOutputCP": 2, "KERNEL32.dll!GetConsoleMode": 4, "KERNEL32.dll!SetFilePointerEx": 10, "KERNEL32.dll!ReadConsoleW": 2, "KERNEL32.dll!FindFirstFileExW": 4, "KERNEL32.dll!GetOEMCP": 2, "KERNEL32.dll!GetACP": 4, "KERNEL32.dll!IsValidCodePage": 4, "KERNEL32.dll!GetCommandLineW": 2, "KERNEL32.dll!FreeEnvironmentStringsW": 7, "KERNEL32.dll!GetEnvironmentStringsW": 3, "KERNEL32.dll!SetEnvironmentVariableW": 4, "KERNEL32.dll!SetStdHandle": 3, "KERNEL32.dll!SetEndOfFile": 2, "KERNEL32.dll!RtlUnwind": 2 }, "complete_linear_sweep": true }