{
  "path": "NVIDIA App\\NvBackend\\Plugins\\LocalUser\\NvBackend64.dll",
  "sha256": "7a84c83e7437cf63c94f9edd389f4b1e6f072ef1b7bb6fa1013a22e670132a50",
  "method": "Capstone linear sweep over raw bytes of all IMAGE_SCN_MEM_EXECUTE sections; skipdata enabled; no reachability proof",
  "sections": [
    {
      "name": ".text",
      "raw_bytes": 6316032,
      "processed_bytes": 6316032,
      "instructions": 1570736,
      "skipdata_bytes": 1880
    }
  ],
  "utc": "2026-11-11T21:40:59.560047+00:00",
  "instructions": 1570736,
  "skipdata_bytes": 1880,
  "calls": 136256,
  "api_reference_counts": {
    "KERNEL32.dll!RtlVirtualUnwind": 29,
    "KERNEL32.dll!MultiByteToWideChar": 32,
    "KERNEL32.dll!WideCharToMultiByte": 17,
    "KERNEL32.dll!GetLastError": 245,
    "SHELL32.dll!SHGetKnownFolderPath": 2,
    "ole32.dll!CoTaskMemFree": 2,
    "KERNEL32.dll!FreeLibrary": 28,
    "KERNEL32.dll!GetProcAddress": 97,
    "WS2_32.dll!WSACleanup": 7,
    "WS2_32.dll!WSAStartup": 4,
    "ADVAPI32.dll!RegCreateKeyExW": 2,
    "ADVAPI32.dll!RegCloseKey": 20,
    "KERNEL32.dll!WaitForMultipleObjects": 8,
    "KERNEL32.dll!GetCurrentProcessId": 6,
    "KERNEL32.dll!ProcessIdToSessionId": 2,
    "KERNEL32.dll!GetNativeSystemInfo": 3,
    "KERNEL32.dll!GetVersionExW": 8,
    "KERNEL32.dll!GlobalMemoryStatusEx": 3,
    "KERNEL32.dll!GetUserDefaultUILanguage": 7,
    "KERNEL32.dll!GetSystemPowerStatus": 1,
    "USER32.dll!DefWindowProcW": 5,
    "KERNEL32.dll!CloseHandle": 93,
    "USER32.dll!UnhookWinEvent": 2,
    "USER32.dll!GetWindowLongPtrW": 2,
    "USER32.dll!GetWindowThreadProcessId": 2,
    "KERNEL32.dll!OpenProcess": 2,
    "KERNEL32.dll!QueryFullProcessImageNameW": 2,
    "KERNEL32.dll!GetProcessTimes": 1,
    "USER32.dll!SetWinEventHook": 1,
    "USER32.dll!EnumWindows": 1,
    "KERNEL32.dll!Sleep": 5,
    "USER32.dll!MonitorFromWindow": 1,
    "USER32.dll!GetMonitorInfoW": 1,
    "USER32.dll!UnregisterDeviceNotification": 4,
    "USER32.dll!RegisterDeviceNotificationW": 4,
    "KERNEL32.dll!InitOnceComplete": 3,
    "KERNEL32.dll!InitOnceBeginInitialize": 2,
    "KERNEL32.dll!CreatePipe": 1,
    "KERNEL32.dll!SetHandleInformation": 1,
    "KERNEL32.dll!TerminateProcess": 5,
    "KERNEL32.dll!ReadFile": 7,
    "KERNEL32.dll!CreateFileW": 18,
    "KERNEL32.dll!CreateFileMappingW": 2,
    "KERNEL32.dll!MapViewOfFile": 3,
    "KERNEL32.dll!UnmapViewOfFile": 4,
    "SHELL32.dll!SHGetFolderPathW": 8,
    "KERNEL32.dll!GetSystemTimeAsFileTime": 7,
    "KERNEL32.dll!WritePrivateProfileStringW": 1,
    "KERNEL32.dll!GetFileAttributesW": 12,
    "USER32.dll!UnregisterClassW": 2,
    "USER32.dll!DestroyWindow": 2,
    "KERNEL32.dll!GetCurrentThreadId": 12,
    "USER32.dll!RegisterClassExW": 1,
    "USER32.dll!CreateWindowExW": 1,
    "USER32.dll!MsgWaitForMultipleObjectsEx": 1,
    "USER32.dll!TranslateMessage": 1,
    "USER32.dll!DispatchMessageW": 1,
    "USER32.dll!PeekMessageW": 1,
    "KERNEL32.dll!SetLastError": 48,
    "USER32.dll!SetWindowLongPtrW": 1,
    "SHLWAPI.dll!UrlUnescapeW": 1,
    "KERNEL32.dll!LocalFree": 54,
    "ADVAPI32.dll!ConvertStringSidToSidW": 2,
    "ADVAPI32.dll!SetEntriesInAclW": 2,
    "ADVAPI32.dll!InitializeSecurityDescriptor": 2,
    "ADVAPI32.dll!SetSecurityDescriptorDacl": 2,
    "ADVAPI32.dll!RegOpenKeyExW": 17,
    "ADVAPI32.dll!RegQueryValueExW": 17,
    "KERNEL32.dll!DeleteFileW": 3,
    "KERNEL32.dll!ExpandEnvironmentStringsW": 1,
    "KERNEL32.dll!FindFirstFileW": 6,
    "KERNEL32.dll!FindClose": 12,
    "KERNEL32.dll!GetLogicalDrives": 1,
    "KERNEL32.dll!GetDriveTypeW": 3,
    "KERNEL32.dll!FindNextFileW": 6,
    "ADVAPI32.dll!CryptReleaseContext": 16,
    "ADVAPI32.dll!CryptAcquireContextW": 8,
    "ADVAPI32.dll!CryptGenRandom": 3,
    "KERNEL32.dll!OpenFileMappingW": 1,
    "KERNEL32.dll!VirtualQuery": 1,
    "VERSION.dll!GetFileVersionInfoSizeW": 2,
    "VERSION.dll!GetFileVersionInfoW": 2,
    "VERSION.dll!VerQueryValueW": 3,
    "SETUPAPI.dll!SetupDiGetClassDevsW": 4,
    "SETUPAPI.dll!SetupDiEnumDeviceInfo": 4,
    "SETUPAPI.dll!SetupDiGetDeviceRegistryPropertyW": 3,
    "OLEAUT32.dll!SysFreeString": 3,
    "OLEAUT32.dll!SysAllocString": 3,
    "OLEAUT32.dll!VariantClear": 10,
    "ole32.dll!CoUninitialize": 3,
    "ole32.dll!CoInitialize": 2,
    "OLEAUT32.dll!VariantInit": 7,
    "ole32.dll!CoCreateInstance": 2,
    "ole32.dll!CoSetProxyBlanket": 1,
    "OLEAUT32.dll!SysStringLen": 3,
    "OLEAUT32.dll!VariantCopy": 1,
    "OLEAUT32.dll!SafeArrayGetLBound": 1,
    "OLEAUT32.dll!SafeArrayGetElement": 1,
    "OLEAUT32.dll!VariantChangeType": 2,
    "KERNEL32.dll!lstrlenW": 4,
    "KERNEL32.dll!InitializeCriticalSectionEx": 2,
    "KERNEL32.dll!GetTickCount": 4,
    "KERNEL32.dll!GetWindowsDirectoryW": 2,
    "KERNEL32.dll!GetFileAttributesExW": 5,
    "USER32.dll!GetSystemMetrics": 7,
    "KERNEL32.dll!GetSystemDefaultLangID": 1,
    "KERNEL32.dll!GetSystemDirectoryW": 5,
    "USER32.dll!EnumDisplaySettingsW": 3,
    "USER32.dll!EnumDisplayDevicesW": 4,
    "KERNEL32.dll!VerSetConditionMask": 11,
    "KERNEL32.dll!VerifyVersionInfoW": 5,
    "ADVAPI32.dll!RegEnumKeyExW": 8,
    "KERNEL32.dll!lstrcmpiW": 1,
    "USER32.dll!EnumDisplaySettingsExW": 2,
    "VERSION.dll!GetFileVersionInfoSizeA": 1,
    "VERSION.dll!GetFileVersionInfoA": 1,
    "KERNEL32.dll!GetSystemDirectoryA": 2,
    "SETUPAPI.dll!SetupDiDestroyDeviceInfoList": 5,
    "ole32.dll!StringFromGUID2": 3,
    "KERNEL32.dll!GetModuleHandleW": 6,
    "KERNEL32.dll!GlobalAlloc": 1,
    "SETUPAPI.dll!SetupDiEnumDeviceInterfaces": 2,
    "SETUPAPI.dll!SetupDiGetDeviceInterfaceDetailW": 3,
    "KERNEL32.dll!GlobalFree": 1,
    "KERNEL32.dll!GetVolumeInformationW": 1,
    "KERNEL32.dll!GetDiskFreeSpaceExW": 1,
    "KERNEL32.dll!DeviceIoControl": 14,
    "KERNEL32.dll!GetCurrentProcess": 6,
    "KERNEL32.dll!GetProcessAffinityMask": 1,
    "KERNEL32.dll!GetCurrentThread": 2,
    "KERNEL32.dll!SetThreadAffinityMask": 2,
    "KERNEL32.dll!LocalAlloc": 22,
    "KERNEL32.dll!GetModuleFileNameW": 2,
    "KERNEL32.dll!GetFullPathNameW": 5,
    "KERNEL32.dll!LoadLibraryExW": 13,
    "KERNEL32.dll!GetModuleFileNameA": 1,
    "KERNEL32.dll!CreateProcessW": 1,
    "KERNEL32.dll!CreateEventW": 2,
    "KERNEL32.dll!ResetEvent": 2,
    "KERNEL32.dll!SetEvent": 2,
    "ADVAPI32.dll!RegDeleteValueW": 1,
    "ADVAPI32.dll!RegQueryInfoKeyW": 2,
    "WS2_32.dll!ntohl": 1,
    "ADVAPI32.dll!RegEnumValueW": 1,
    "ADVAPI32.dll!RegSetValueExW": 1,
    "KERNEL32.dll!WaitForSingleObject": 10,
    "KERNEL32.dll!WakeAllConditionVariable": 3,
    "KERNEL32.dll!WakeConditionVariable": 1,
    "KERNEL32.dll!SleepConditionVariableSRW": 4,
    "KERNEL32.dll!QueryPerformanceCounter": 4,
    "KERNEL32.dll!QueryPerformanceFrequency": 2,
    "KERNEL32.dll!ReleaseSRWLockExclusive": 5,
    "KERNEL32.dll!AcquireSRWLockExclusive": 6,
    "KERNEL32.dll!TryAcquireSRWLockExclusive": 2,
    "KERNEL32.dll!WaitForSingleObjectEx": 1,
    "KERNEL32.dll!GetExitCodeThread": 2,
    "KERNEL32.dll!GetStringTypeW": 4,
    "KERNEL32.dll!GetLocaleInfoEx": 1,
    "KERNEL32.dll!FormatMessageA": 2,
    "KERNEL32.dll!CreateSymbolicLinkW": 2,
    "KERNEL32.dll!GetFileInformationByHandleEx": 7,
    "KERNEL32.dll!GetFileInformationByHandle": 3,
    "KERNEL32.dll!SetFileInformationByHandle": 5,
    "KERNEL32.dll!AreFileApisANSI": 1,
    "KERNEL32.dll!CopyFileW": 3,
    "KERNEL32.dll!CreateDirectoryW": 2,
    "KERNEL32.dll!CreateHardLinkW": 1,
    "KERNEL32.dll!FindFirstFileExW": 2,
    "KERNEL32.dll!MoveFileExW": 1,
    "KERNEL32.dll!RtlPcToFileHeader": 2,
    "KERNEL32.dll!RaiseException": 5,
    "KERNEL32.dll!DeleteCriticalSection": 11,
    "KERNEL32.dll!EnterCriticalSection": 17,
    "KERNEL32.dll!LeaveCriticalSection": 22,
    "KERNEL32.dll!EncodePointer": 3,
    "KERNEL32.dll!LCMapStringEx": 4,
    "KERNEL32.dll!GetCPInfo": 5,
    "KERNEL32.dll!CompareStringEx": 1,
    "KERNEL32.dll!SetUnhandledExceptionFilter": 3,
    "KERNEL32.dll!UnhandledExceptionFilter": 3,
    "KERNEL32.dll!IsProcessorFeaturePresent": 5,
    "KERNEL32.dll!RtlCaptureContext": 4,
    "KERNEL32.dll!RtlLookupFunctionEntry": 5,
    "KERNEL32.dll!IsDebuggerPresent": 3,
    "KERNEL32.dll!InitializeSListHead": 1,
    "KERNEL32.dll!RtlUnwindEx": 3,
    "KERNEL32.dll!InterlockedFlushSList": 1,
    "KERNEL32.dll!TlsAlloc": 2,
    "KERNEL32.dll!TlsFree": 2,
    "KERNEL32.dll!TlsGetValue": 2,
    "KERNEL32.dll!TlsSetValue": 2,
    "KERNEL32.dll!InitializeCriticalSectionAndSpinCount": 2,
    "KERNEL32.dll!ExitThread": 2,
    "KERNEL32.dll!FreeLibraryAndExitThread": 1,
    "KERNEL32.dll!GetModuleHandleExW": 3,
    "KERNEL32.dll!CreateThread": 1,
    "KERNEL32.dll!SetEndOfFile": 1,
    "KERNEL32.dll!ExitProcess": 1,
    "KERNEL32.dll!HeapFree": 1,
    "KERNEL32.dll!HeapAlloc": 2,
    "KERNEL32.dll!EnumSystemLocalesW": 4,
    "KERNEL32.dll!CompareStringW": 1,
    "KERNEL32.dll!FlsAlloc": 1,
    "KERNEL32.dll!FlsFree": 1,
    "KERNEL32.dll!FlsGetValue": 1,
    "KERNEL32.dll!FlsSetValue": 1,
    "KERNEL32.dll!GetDateFormatW": 1,
    "KERNEL32.dll!GetLocaleInfoW": 11,
    "KERNEL32.dll!GetTimeFormatW": 1,
    "KERNEL32.dll!GetUserDefaultLCID": 2,
    "KERNEL32.dll!IsValidLocale": 2,
    "KERNEL32.dll!LCMapStringW": 1,
    "KERNEL32.dll!HeapReAlloc": 1,
    "KERNEL32.dll!GetConsoleMode": 3,
    "KERNEL32.dll!ReadConsoleW": 2,
    "KERNEL32.dll!GetStartupInfoW": 1,
    "KERNEL32.dll!GetFileType": 6,
    "KERNEL32.dll!GetStdHandle": 7,
    "KERNEL32.dll!FlushFileBuffers": 2,
    "KERNEL32.dll!GetConsoleOutputCP": 1,
    "KERNEL32.dll!WriteFile": 9,
    "KERNEL32.dll!SetFilePointerEx": 5,
    "KERNEL32.dll!GetFileSizeEx": 1,
    "KERNEL32.dll!GetTimeZoneInformation": 1,
    "KERNEL32.dll!SetConsoleCtrlHandler": 1,
    "KERNEL32.dll!SetStdHandle": 2,
    "KERNEL32.dll!GetOEMCP": 1,
    "KERNEL32.dll!GetACP": 4,
    "KERNEL32.dll!IsValidCodePage": 3,
    "KERNEL32.dll!GetCommandLineA": 1,
    "KERNEL32.dll!GetCommandLineW": 1,
    "KERNEL32.dll!GetEnvironmentStringsW": 2,
    "KERNEL32.dll!FreeEnvironmentStringsW": 3,
    "KERNEL32.dll!SetEnvironmentVariableW": 2,
    "KERNEL32.dll!GetProcessHeap": 1,
    "KERNEL32.dll!HeapSize": 1,
    "KERNEL32.dll!WriteConsoleW": 2,
    "KERNEL32.dll!VirtualFree": 1,
    "KERNEL32.dll!InitializeSRWLock": 2,
    "KERNEL32.dll!AcquireSRWLockShared": 1,
    "KERNEL32.dll!ReleaseSRWLockShared": 1,
    "WS2_32.dll!WSASetLastError": 12,
    "WS2_32.dll!send": 7,
    "WS2_32.dll!recv": 4,
    "WS2_32.dll!WSAGetLastError": 27,
    "WS2_32.dll!getsockopt": 5,
    "WS2_32.dll!ioctlsocket": 3,
    "WS2_32.dll!select": 2,
    "WS2_32.dll!htons": 5,
    "WS2_32.dll!getservbyname": 2,
    "WS2_32.dll!inet_addr": 5,
    "WS2_32.dll!htonl": 2,
    "WS2_32.dll!inet_ntoa": 2,
    "WS2_32.dll!getservbyport": 1,
    "WS2_32.dll!ntohs": 2,
    "WS2_32.dll!gethostbyaddr": 1,
    "KERNEL32.dll!LoadLibraryA": 3,
    "WS2_32.dll!gethostbyname": 5,
    "USER32.dll!GetProcessWindowStation": 1,
    "USER32.dll!GetUserObjectInformationW": 2,
    "ADVAPI32.dll!RegisterEventSourceW": 1,
    "ADVAPI32.dll!ReportEventW": 1,
    "ADVAPI32.dll!DeregisterEventSource": 1,
    "USER32.dll!MessageBoxW": 1,
    "KERNEL32.dll!GetEnvironmentVariableW": 5,
    "KERNEL32.dll!ReleaseSemaphore": 4,
    "KERNEL32.dll!InitializeCriticalSection": 3,
    "KERNEL32.dll!CreateSemaphoreA": 2,
    "KERNEL32.dll!GetSystemTime": 1,
    "KERNEL32.dll!SystemTimeToFileTime": 2,
    "WS2_32.dll!closesocket": 4,
    "WS2_32.dll!setsockopt": 9,
    "WS2_32.dll!connect": 2,
    "WS2_32.dll!socket": 5,
    "CRYPT32.dll!CertGetCertificateContextProperty": 6,
    "ADVAPI32.dll!CryptCreateHash": 3,
    "ADVAPI32.dll!CryptSetHashParam": 2,
    "ADVAPI32.dll!CryptSignHashW": 2,
    "ADVAPI32.dll!CryptDestroyHash": 5,
    "ADVAPI32.dll!CryptDestroyKey": 4,
    "CRYPT32.dll!CertFreeCertificateContext": 8,
    "CRYPT32.dll!CertEnumCertificatesInStore": 6,
    "CRYPT32.dll!CertFindCertificateInStore": 3,
    "CRYPT32.dll!CertCloseStore": 4,
    "ADVAPI32.dll!CryptGetUserKey": 1,
    "ADVAPI32.dll!CryptExportKey": 2,
    "ADVAPI32.dll!CryptEnumProvidersW": 4,
    "ADVAPI32.dll!CryptGetProvParam": 2,
    "CRYPT32.dll!CertDuplicateCertificateContext": 1,
    "CRYPT32.dll!CertOpenStore": 1,
    "ADVAPI32.dll!CryptDecrypt": 1,
    "KERNEL32.dll!LoadLibraryW": 2,
    "KERNEL32.dll!SetConsoleMode": 2,
    "KERNEL32.dll!ReadConsoleA": 1,
    "CRYPT32.dll!CertOpenSystemStoreW": 1,
    "WS2_32.dll!shutdown": 3,
    "WS2_32.dll!sendto": 4,
    "WS2_32.dll!recvfrom": 2,
    "WS2_32.dll!getsockname": 2,
    "WS2_32.dll!getpeername": 2,
    "KERNEL32.dll!OutputDebugStringW": 2,
    "ole32.dll!CoCreateGuid": 1,
    "ADVAPI32.dll!OpenProcessToken": 2,
    "ADVAPI32.dll!GetTokenInformation": 4,
    "KERNEL32.dll!GetComputerNameW": 1,
    "KERNEL32.dll!RemoveDirectoryW": 1,
    "KERNEL32.dll!SetThreadPriority": 1,
    "KERNEL32.dll!ResumeThread": 1,
    "WS2_32.dll!WSACreateEvent": 2,
    "WS2_32.dll!WSACloseEvent": 1,
    "WS2_32.dll!bind": 2,
    "WS2_32.dll!listen": 2,
    "WS2_32.dll!WSAResetEvent": 1,
    "WS2_32.dll!WSAEventSelect": 1,
    "WS2_32.dll!WSAWaitForMultipleEvents": 1,
    "WS2_32.dll!WSAEnumNetworkEvents": 1,
    "KERNEL32.dll!FileTimeToSystemTime": 2,
    "KERNEL32.dll!FormatMessageW": 1,
    "ADVAPI32.dll!CryptHashData": 1,
    "ADVAPI32.dll!CryptGetHashParam": 2,
    "WINHTTP.dll!WinHttpOpen": 1,
    "WINHTTP.dll!WinHttpCloseHandle": 8,
    "WINHTTP.dll!WinHttpSetOption": 3,
    "WINHTTP.dll!WinHttpSetStatusCallback": 1,
    "WINHTTP.dll!WinHttpConnect": 1,
    "WINHTTP.dll!WinHttpOpenRequest": 1,
    "WINHTTP.dll!WinHttpSendRequest": 1,
    "WINHTTP.dll!WinHttpReceiveResponse": 1,
    "WINHTTP.dll!WinHttpQueryDataAvailable": 1,
    "WINHTTP.dll!WinHttpReadData": 1,
    "WINHTTP.dll!WinHttpAddRequestHeaders": 1,
    "WINHTTP.dll!WinHttpQueryOption": 1,
    "WINHTTP.dll!WinHttpQueryHeaders": 2,
    "WINHTTP.dll!WinHttpCrackUrl": 1,
    "KERNEL32.dll!lstrlenA": 2,
    "KERNEL32.dll!CreateMutexW": 1,
    "KERNEL32.dll!ReleaseMutex": 1,
    "KERNEL32.dll!RtlUnwind": 1,
    "KERNEL32.dll!PeekNamedPipe": 1,
    "KERNEL32.dll!SystemTimeToTzSpecificLocalTime": 1,
    "KERNEL32.dll!GetCurrentDirectoryW": 2,
    "WS2_32.dll!InetNtopW": 1,
    "ADVAPI32.dll!ConvertSidToStringSidW": 1,
    "KERNEL32.dll!DisconnectNamedPipe": 1,
    "KERNEL32.dll!CreateFileA": 1,
    "KERNEL32.dll!WaitNamedPipeA": 1,
    "ADVAPI32.dll!SetSecurityDescriptorOwner": 1,
    "KERNEL32.dll!CreateNamedPipeA": 1,
    "KERNEL32.dll!GetOverlappedResult": 3,
    "KERNEL32.dll!CancelIo": 3,
    "KERNEL32.dll!ConnectNamedPipe": 1,
    "WS2_32.dll!accept": 1,
    "WS2_32.dll!__WSAFDIsSet": 1,
    "KERNEL32.dll!DecodePointer": 1
  },
  "complete_linear_sweep": true
}