{
  "path": "NVIDIA App\\ShadowPlay\\nvspapi64.dll",
  "sha256": "25b2b108a502619e6f2248abaddb52b0f81667b60adb7c371d416eb12c7c9be1",
  "method": "Capstone linear sweep over raw bytes of all IMAGE_SCN_MEM_EXECUTE sections; skipdata enabled; no reachability proof",
  "sections": [
    {
      "name": ".text",
      "raw_bytes": 2562560,
      "processed_bytes": 2562560,
      "instructions": 1238190,
      "skipdata_bytes": 242
    }
  ],
  "utc": "2026-11-11T21:40:37.755374+00:00",
  "instructions": 1238190,
  "skipdata_bytes": 242,
  "calls": 34670,
  "api_reference_counts": {
    "KERNEL32.dll!InitializeCriticalSection": 20,
    "KERNEL32.dll!InitializeCriticalSectionEx": 9,
    "KERNEL32.dll!GetLastError": 305,
    "KERNEL32.dll!FreeLibrary": 63,
    "KERNEL32.dll!GetCurrentProcessId": 33,
    "KERNEL32.dll!GetCurrentProcess": 14,
    "KERNEL32.dll!GetSystemDirectoryW": 23,
    "KERNEL32.dll!GetProcAddress": 130,
    "KERNEL32.dll!CloseHandle": 134,
    "USER32.dll!EnumDisplayDevicesA": 3,
    "KERNEL32.dll!Sleep": 12,
    "KERNEL32.dll!CreateEventExA": 3,
    "KERNEL32.dll!WaitForSingleObject": 32,
    "KERNEL32.dll!EnterCriticalSection": 151,
    "KERNEL32.dll!DeleteCriticalSection": 38,
    "KERNEL32.dll!LeaveCriticalSection": 155,
    "KERNEL32.dll!CreateEventA": 14,
    "KERNEL32.dll!SetEvent": 29,
    "KERNEL32.dll!WaitForMultipleObjects": 11,
    "KERNEL32.dll!WideCharToMultiByte": 11,
    "KERNEL32.dll!GetThreadId": 14,
    "KERNEL32.dll!GetCurrentThreadId": 19,
    "USER32.dll!PostThreadMessageA": 9,
    "KERNEL32.dll!ResetEvent": 8,
    "KERNEL32.dll!CreateThread": 7,
    "ole32.dll!CoTaskMemFree": 10,
    "SHELL32.dll!SHGetFolderPathW": 3,
    "SHELL32.dll!SHGetFolderPathA": 6,
    "KERNEL32.dll!CreateFileA": 7,
    "KERNEL32.dll!GetTickCount": 5,
    "OLEAUT32.dll!SysAllocString": 6,
    "OLEAUT32.dll!SysFreeString": 12,
    "KERNEL32.dll!GetProcessHeap": 25,
    "KERNEL32.dll!HeapFree": 21,
    "ADVAPI32.dll!OpenSCManagerW": 3,
    "ADVAPI32.dll!OpenServiceW": 3,
    "ADVAPI32.dll!QueryServiceStatus": 3,
    "ADVAPI32.dll!CloseServiceHandle": 6,
    "KERNEL32.dll!OpenEventA": 8,
    "KERNEL32.dll!GlobalMemoryStatusEx": 2,
    "SHLWAPI.dll!PathFileExistsW": 5,
    "KERNEL32.dll!GetTempPathW": 3,
    "KERNEL32.dll!MoveFileExW": 3,
    "KERNEL32.dll!DeleteFileW": 2,
    "OLEAUT32.dll!VariantClear": 6,
    "OLEAUT32.dll!SysAllocStringLen": 4,
    "OLEAUT32.dll!VariantCopy": 5,
    "OLEAUT32.dll!VariantInit": 6,
    "KERNEL32.dll!GetTickCount64": 2,
    "KERNEL32.dll!GetModuleFileNameW": 18,
    "KERNEL32.dll!TryEnterCriticalSection": 3,
    "USER32.dll!IsWindow": 10,
    "USER32.dll!PostMessageA": 12,
    "KERNEL32.dll!GetProcessTimes": 4,
    "KERNEL32.dll!GetModuleHandleA": 6,
    "USER32.dll!RegisterClassExA": 2,
    "USER32.dll!CreateWindowExA": 2,
    "USER32.dll!ChangeWindowMessageFilterEx": 3,
    "USER32.dll!GetMessageA": 5,
    "USER32.dll!TranslateMessage": 3,
    "USER32.dll!DispatchMessageA": 3,
    "USER32.dll!DestroyWindow": 3,
    "USER32.dll!UnregisterClassA": 6,
    "USER32.dll!DefWindowProcA": 2,
    "KERNEL32.dll!LocalAlloc": 61,
    "ADVAPI32.dll!CreateWellKnownSid": 2,
    "ADVAPI32.dll!ImpersonateSelf": 2,
    "KERNEL32.dll!GetCurrentThread": 6,
    "ADVAPI32.dll!OpenThreadToken": 2,
    "ADVAPI32.dll!CreateRestrictedToken": 2,
    "ADVAPI32.dll!SetThreadToken": 5,
    "KERNEL32.dll!LocalFree": 117,
    "ADVAPI32.dll!RevertToSelf": 4,
    "KERNEL32.dll!GetFileSizeEx": 5,
    "KERNEL32.dll!CopyFileA": 3,
    "ADVAPI32.dll!GetSecurityDescriptorDacl": 9,
    "KERNEL32.dll!CreateDirectoryA": 5,
    "ADVAPI32.dll!AllocateAndInitializeSid": 4,
    "ADVAPI32.dll!SetEntriesInAclA": 3,
    "ADVAPI32.dll!InitializeSecurityDescriptor": 5,
    "ADVAPI32.dll!SetSecurityDescriptorDacl": 5,
    "ADVAPI32.dll!FreeSid": 4,
    "ADVAPI32.dll!GetUserNameA": 2,
    "ADVAPI32.dll!GetUserNameW": 3,
    "KERNEL32.dll!GetModuleHandleW": 14,
    "KERNEL32.dll!GetLocalTime": 4,
    "KERNEL32.dll!OutputDebugStringA": 2,
    "ADVAPI32.dll!RegOpenKeyExA": 19,
    "ADVAPI32.dll!RegQueryValueExA": 14,
    "ADVAPI32.dll!RegCloseKey": 14,
    "KERNEL32.dll!MoveFileExA": 3,
    "KERNEL32.dll!GetFileAttributesA": 6,
    "KERNEL32.dll!GetFinalPathNameByHandleA": 2,
    "KERNEL32.dll!DeleteFileA": 2,
    "KERNEL32.dll!WriteFile": 16,
    "KERNEL32.dll!CreateEventW": 17,
    "USER32.dll!wsprintfW": 3,
    "KERNEL32.dll!ReadFile": 11,
    "KERNEL32.dll!CreateFileW": 13,
    "KERNEL32.dll!WaitNamedPipeW": 3,
    "KERNEL32.dll!GetModuleHandleExW": 10,
    "KERNEL32.dll!GetSystemInfo": 3,
    "KERNEL32.dll!QueryPerformanceFrequency": 4,
    "KERNEL32.dll!QueryPerformanceCounter": 9,
    "KERNEL32.dll!LoadLibraryA": 5,
    "KERNEL32.dll!OpenProcess": 9,
    "KERNEL32.dll!UnmapViewOfFile": 3,
    "KERNEL32.dll!FlushFileBuffers": 5,
    "KERNEL32.dll!DisconnectNamedPipe": 3,
    "KERNEL32.dll!OpenFileMappingA": 3,
    "KERNEL32.dll!ReleaseMutex": 2,
    "KERNEL32.dll!CreateMutexA": 2,
    "KERNEL32.dll!OpenMutexA": 2,
    "KERNEL32.dll!CreateNamedPipeA": 2,
    "KERNEL32.dll!ConnectNamedPipe": 2,
    "ADVAPI32.dll!OpenProcessToken": 3,
    "ADVAPI32.dll!GetTokenInformation": 5,
    "KERNEL32.dll!HeapAlloc": 7,
    "ADVAPI32.dll!GetLengthSid": 4,
    "ADVAPI32.dll!CopySid": 3,
    "KERNEL32.dll!CreateFileMappingA": 2,
    "KERNEL32.dll!MapViewOfFile": 2,
    "KERNEL32.dll!GetModuleFileNameA": 6,
    "SHLWAPI.dll!PathFindFileNameA": 3,
    "KERNEL32.dll!WTSGetActiveConsoleSessionId": 3,
    "ADVAPI32.dll!LookupAccountNameA": 2,
    "KERNEL32.dll!GetFileAttributesW": 10,
    "KERNEL32.dll!SetLastError": 103,
    "KERNEL32.dll!VerSetConditionMask": 6,
    "KERNEL32.dll!VerifyVersionInfoW": 4,
    "KERNEL32.dll!GetFullPathNameW": 3,
    "KERNEL32.dll!LoadLibraryExW": 31,
    "KERNEL32.dll!CreateProcessA": 2,
    "KERNEL32.dll!CreateProcessW": 2,
    "KERNEL32.dll!GetCommandLineA": 4,
    "USER32.dll!EnumDisplaySettingsA": 2,
    "KERNEL32.dll!DecodePointer": 6,
    "ADVAPI32.dll!RegCreateKeyExA": 6,
    "ADVAPI32.dll!RegCopyTreeA": 2,
    "ADVAPI32.dll!RegQueryValueExW": 3,
    "ADVAPI32.dll!RegSetValueExA": 5,
    "ADVAPI32.dll!RegDeleteKeyExA": 3,
    "ADVAPI32.dll!RegDeleteKeyValueA": 2,
    "KERNEL32.dll!MultiByteToWideChar": 11,
    "KERNEL32.dll!SetCurrentDirectoryA": 2,
    "ADVAPI32.dll!DuplicateTokenEx": 2,
    "ADVAPI32.dll!SetTokenInformation": 2,
    "USER32.dll!WaitForInputIdle": 2,
    "USER32.dll!FindWindowExW": 6,
    "USER32.dll!GetShellWindow": 3,
    "USER32.dll!EnumWindows": 3,
    "USER32.dll!RedrawWindow": 2,
    "USER32.dll!FindWindowW": 4,
    "USER32.dll!EnumDisplaySettingsExA": 3,
    "ADVAPI32.dll!OpenSCManagerA": 2,
    "KERNEL32.dll!GetSystemDirectoryA": 2,
    "KERNEL32.dll!GetVolumeInformationA": 2,
    "KERNEL32.dll!GetVersionExA": 6,
    "USER32.dll!GetForegroundWindow": 2,
    "USER32.dll!GetWindowThreadProcessId": 2,
    "KERNEL32.dll!ProcessIdToSessionId": 2,
    "KERNEL32.dll!TerminateProcess": 6,
    "USER32.dll!FindWindowA": 2,
    "USER32.dll!SendMessageA": 2,
    "CRYPT32.dll!CertGetNameStringW": 5,
    "CRYPT32.dll!CryptQueryObject": 2,
    "CRYPT32.dll!CryptMsgGetParam": 3,
    "CRYPT32.dll!CertFindCertificateInStore": 2,
    "CRYPT32.dll!CertFreeCertificateContext": 2,
    "CRYPT32.dll!CryptMsgClose": 2,
    "CRYPT32.dll!CertCloseStore": 2,
    "KERNEL32.dll!QueryFullProcessImageNameW": 3,
    "SHLWAPI.dll!PathFindFileNameW": 2,
    "KERNEL32.dll!ExpandEnvironmentStringsW": 2,
    "KERNEL32.dll!RtlCaptureStackBackTrace": 2,
    "KERNEL32.dll!SetNamedPipeHandleState": 2,
    "KERNEL32.dll!InitializeSRWLock": 2,
    "KERNEL32.dll!AcquireSRWLockExclusive": 8,
    "KERNEL32.dll!ReleaseSRWLockExclusive": 8,
    "USER32.dll!GetWindowLongPtrW": 2,
    "USER32.dll!DefWindowProcW": 3,
    "USER32.dll!PostQuitMessage": 2,
    "USER32.dll!PostMessageW": 2,
    "USER32.dll!PeekMessageW": 2,
    "KERNEL32.dll!AcquireSRWLockShared": 2,
    "KERNEL32.dll!ReleaseSRWLockShared": 3,
    "ole32.dll!CoCreateGuid": 2,
    "USER32.dll!RegisterClassW": 2,
    "USER32.dll!CreateWindowExW": 2,
    "USER32.dll!UnregisterClassW": 3,
    "USER32.dll!SetWindowLongPtrW": 2,
    "SHELL32.dll!SHGetKnownFolderPath": 1,
    "ADVAPI32.dll!ConvertSidToStringSidA": 1,
    "ADVAPI32.dll!ConvertStringSidToSidW": 1,
    "OLEAUT32.dll!GetErrorInfo": 2,
    "OLEAUT32.dll!SetErrorInfo": 3,
    "OLEAUT32.dll!VariantChangeType": 2,
    "OLEAUT32.dll!CreateErrorInfo": 2,
    "WTSAPI32.dll!WTSQuerySessionInformationA": 1,
    "WTSAPI32.dll!WTSFreeMemory": 1,
    "VERSION.dll!GetFileVersionInfoSizeA": 1,
    "VERSION.dll!GetFileVersionInfoA": 1,
    "VERSION.dll!VerQueryValueA": 1,
    "VERSION.dll!GetFileVersionInfoSizeW": 1,
    "VERSION.dll!GetFileVersionInfoW": 1,
    "VERSION.dll!VerQueryValueW": 1,
    "KERNEL32.dll!OutputDebugStringW": 7,
    "KERNEL32.dll!GetLocaleInfoEx": 3,
    "KERNEL32.dll!FormatMessageA": 3,
    "KERNEL32.dll!EncodePointer": 5,
    "KERNEL32.dll!LCMapStringEx": 5,
    "KERNEL32.dll!GetStringTypeW": 5,
    "KERNEL32.dll!GetCPInfo": 6,
    "KERNEL32.dll!CompareStringEx": 3,
    "KERNEL32.dll!WakeAllConditionVariable": 4,
    "KERNEL32.dll!SleepConditionVariableSRW": 3,
    "KERNEL32.dll!SetUnhandledExceptionFilter": 5,
    "KERNEL32.dll!UnhandledExceptionFilter": 4,
    "KERNEL32.dll!IsProcessorFeaturePresent": 7,
    "KERNEL32.dll!RtlCaptureContext": 6,
    "KERNEL32.dll!RtlLookupFunctionEntry": 7,
    "KERNEL32.dll!RtlVirtualUnwind": 6,
    "KERNEL32.dll!IsDebuggerPresent": 8,
    "KERNEL32.dll!GetStartupInfoW": 3,
    "KERNEL32.dll!GetSystemTimeAsFileTime": 4,
    "KERNEL32.dll!InitializeSListHead": 2,
    "bcrypt.dll!BCryptOpenAlgorithmProvider": 1,
    "bcrypt.dll!BCryptSetProperty": 1,
    "bcrypt.dll!BCryptCloseAlgorithmProvider": 1,
    "bcrypt.dll!BCryptCreateHash": 1,
    "bcrypt.dll!BCryptHashData": 1,
    "bcrypt.dll!BCryptFinishHash": 1,
    "bcrypt.dll!BCryptDestroyHash": 1,
    "bcrypt.dll!BCryptGenerateSymmetricKey": 1,
    "bcrypt.dll!BCryptEncrypt": 1,
    "bcrypt.dll!BCryptDestroyKey": 1,
    "bcrypt.dll!BCryptGenRandom": 1,
    "KERNEL32.dll!RaiseException": 7,
    "KERNEL32.dll!K32GetProcessMemoryInfo": 1,
    "KERNEL32.dll!CreateToolhelp32Snapshot": 1,
    "KERNEL32.dll!Process32FirstW": 1,
    "KERNEL32.dll!Process32NextW": 1,
    "KERNEL32.dll!K32GetModuleFileNameExW": 1,
    "WINTRUST.dll!WinVerifyTrust": 1,
    "KERNEL32.dll!RtlUnwindEx": 4,
    "KERNEL32.dll!RtlPcToFileHeader": 2,
    "KERNEL32.dll!InterlockedFlushSList": 2,
    "KERNEL32.dll!InterlockedPushEntrySList": 2,
    "KERNEL32.dll!TlsAlloc": 2,
    "KERNEL32.dll!TlsFree": 2,
    "KERNEL32.dll!TlsGetValue": 2,
    "KERNEL32.dll!TlsSetValue": 2,
    "KERNEL32.dll!InitializeCriticalSectionAndSpinCount": 3,
    "KERNEL32.dll!GetStdHandle": 4,
    "KERNEL32.dll!GetFileType": 5,
    "KERNEL32.dll!WriteConsoleW": 7,
    "KERNEL32.dll!ExitProcess": 2,
    "KERNEL32.dll!HeapReAlloc": 2,
    "KERNEL32.dll!SetConsoleCtrlHandler": 2,
    "KERNEL32.dll!EnumSystemLocalesW": 8,
    "KERNEL32.dll!CompareStringW": 2,
    "KERNEL32.dll!FlsAlloc": 2,
    "KERNEL32.dll!FlsFree": 2,
    "KERNEL32.dll!FlsGetValue": 2,
    "KERNEL32.dll!FlsSetValue": 2,
    "KERNEL32.dll!GetDateFormatW": 2,
    "KERNEL32.dll!GetLocaleInfoW": 12,
    "KERNEL32.dll!GetTimeFormatW": 2,
    "KERNEL32.dll!GetUserDefaultLCID": 4,
    "KERNEL32.dll!IsValidLocale": 3,
    "KERNEL32.dll!LCMapStringW": 2,
    "KERNEL32.dll!GetTimeZoneInformation": 2,
    "KERNEL32.dll!FindFirstFileExW": 4,
    "KERNEL32.dll!FindNextFileW": 4,
    "KERNEL32.dll!FindClose": 10,
    "KERNEL32.dll!GetOEMCP": 2,
    "KERNEL32.dll!GetACP": 4,
    "KERNEL32.dll!IsValidCodePage": 4,
    "KERNEL32.dll!GetCommandLineW": 2,
    "KERNEL32.dll!FreeEnvironmentStringsW": 7,
    "KERNEL32.dll!GetEnvironmentStringsW": 3,
    "KERNEL32.dll!SetEnvironmentVariableW": 4,
    "KERNEL32.dll!HeapSize": 2,
    "KERNEL32.dll!SetFilePointerEx": 10,
    "KERNEL32.dll!SetStdHandle": 3,
    "KERNEL32.dll!GetConsoleOutputCP": 2,
    "KERNEL32.dll!GetConsoleMode": 4,
    "KERNEL32.dll!ReadConsoleW": 2,
    "KERNEL32.dll!RtlUnwind": 2
  },
  "complete_linear_sweep": true
}