{ "path": "NvContainer\\Watchdog\\NvPluginWatchdog.dll", "sha256": "92fc33f9a2d3add07058ec5fd470b6653609fd59067c50020d4c6f02b797ad5d", "method": "Capstone linear sweep over raw bytes of all IMAGE_SCN_MEM_EXECUTE sections; skipdata enabled; no reachability proof", "sections": [ { "name": ".text", "raw_bytes": 988160, "processed_bytes": 988160, "instructions": 293354, "skipdata_bytes": 10 } ], "utc": "2026-11-11T21:40:16.850231+00:00", "instructions": 293354, "skipdata_bytes": 10, "calls": 15553, "api_reference_counts": { "ADVAPI32.dll!RegQueryValueExW": 2, "ADVAPI32.dll!RegCloseKey": 8, "KERNEL32.dll!GetCommandLineW": 4, "SHELL32.dll!CommandLineToArgvW": 3, "KERNEL32.dll!LocalFree": 101, "KERNEL32.dll!CloseHandle": 94, "ADVAPI32.dll!RegGetValueW": 15, "KERNEL32.dll!ExpandEnvironmentStringsW": 6, "KERNEL32.dll!GetSystemTimeAsFileTime": 9, "KERNEL32.dll!GetExitCodeProcess": 2, "KERNEL32.dll!GetLastError": 225, "KERNEL32.dll!GetSystemDirectoryW": 18, "KERNEL32.dll!LoadLibraryW": 2, "KERNEL32.dll!GetProcAddress": 95, "KERNEL32.dll!FreeLibrary": 32, "KERNEL32.dll!GetTickCount": 2, "KERNEL32.dll!CreateFileW": 18, "KERNEL32.dll!GetProcessId": 2, "KERNEL32.dll!GetCurrentProcessId": 5, "KERNEL32.dll!CreateEventW": 7, "KERNEL32.dll!TerminateProcess": 6, "ADVAPI32.dll!LogonUserW": 2, "KERNEL32.dll!GetCurrentProcess": 7, "ADVAPI32.dll!OpenProcessToken": 2, "ADVAPI32.dll!DuplicateTokenEx": 2, "ADVAPI32.dll!SetTokenInformation": 2, "KERNEL32.dll!ResetEvent": 4, "KERNEL32.dll!GetBinaryTypeW": 2, "ADVAPI32.dll!CreateProcessAsUserW": 2, "KERNEL32.dll!SetEvent": 10, "KERNEL32.dll!WaitForSingleObject": 7, "KERNEL32.dll!GetProcessTimes": 2, "ADVAPI32.dll!AllocateAndInitializeSid": 4, "ADVAPI32.dll!SetEntriesInAclW": 3, "KERNEL32.dll!LocalAlloc": 60, "ADVAPI32.dll!InitializeSecurityDescriptor": 3, "ADVAPI32.dll!SetSecurityDescriptorDacl": 3, "ADVAPI32.dll!LookupAccountNameW": 2, "ADVAPI32.dll!FreeSid": 2, "ADVAPI32.dll!RegEnumKeyExW": 3, "SHLWAPI.dll!PathFileExistsW": 2, "KERNEL32.dll!WaitForMultipleObjects": 4, "ADVAPI32.dll!RegOpenKeyExW": 6, "KERNEL32.dll!GetModuleFileNameW": 13, "KERNEL32.dll!CreateThread": 3, "KERNEL32.dll!GetFileAttributesW": 15, "KERNEL32.dll!SetLastError": 97, "KERNEL32.dll!GetModuleHandleW": 9, "KERNEL32.dll!VerSetConditionMask": 6, "KERNEL32.dll!VerifyVersionInfoW": 4, "KERNEL32.dll!GetFullPathNameW": 4, "KERNEL32.dll!LoadLibraryExW": 31, "KERNEL32.dll!GetModuleFileNameA": 2, "KERNEL32.dll!CreateProcessA": 2, "KERNEL32.dll!CreateProcessW": 2, "KERNEL32.dll!CreateDirectoryW": 3, "ADVAPI32.dll!RegCreateKeyExW": 3, "ADVAPI32.dll!RegDeleteValueW": 3, "KERNEL32.dll!FindCloseChangeNotification": 2, "KERNEL32.dll!FindFirstChangeNotificationW": 2, "KERNEL32.dll!FindNextChangeNotification": 2, "KERNEL32.dll!CreateTimerQueueTimer": 2, "KERNEL32.dll!GetSystemTime": 2, "KERNEL32.dll!DeleteFileW": 3, "KERNEL32.dll!FindClose": 14, "KERNEL32.dll!DeleteTimerQueueTimer": 2, "KERNEL32.dll!FindFirstFileW": 3, "KERNEL32.dll!FindNextFileW": 6, "KERNEL32.dll!GetCurrentThreadId": 5, "KERNEL32.dll!GetModuleHandleExW": 4, "ADVAPI32.dll!GetUserNameW": 2, "KERNEL32.dll!MoveFileW": 2, "KERNEL32.dll!OutputDebugStringA": 2, "KERNEL32.dll!ProcessIdToSessionId": 2, "KERNEL32.dll!Sleep": 2, "ADVAPI32.dll!RegSetKeyValueW": 4, "WTSAPI32.dll!WTSQueryUserToken": 1, "WTSAPI32.dll!WTSQuerySessionInformationW": 1, "WTSAPI32.dll!WTSFreeMemory": 1, "WTSAPI32.dll!WTSEnumerateSessionsW": 1, "WTSAPI32.dll!WTSRegisterSessionNotification": 1, "WTSAPI32.dll!WTSUnRegisterSessionNotification": 1, "USERENV.dll!CreateEnvironmentBlock": 1, "USERENV.dll!DestroyEnvironmentBlock": 1, "KERNEL32.dll!RemoveDirectoryW": 2, "KERNEL32.dll!MultiByteToWideChar": 13, "KERNEL32.dll!WideCharToMultiByte": 11, "ole32.dll!CoTaskMemFree": 3, "KERNEL32.dll!DeviceIoControl": 5, "KERNEL32.dll!CreateToolhelp32Snapshot": 1, "KERNEL32.dll!Process32FirstW": 1, "KERNEL32.dll!Process32NextW": 1, "SHELL32.dll!SHGetKnownFolderPath": 1, "KERNEL32.dll!FormatMessageA": 3, "KERNEL32.dll!GetStringTypeW": 5, "KERNEL32.dll!GetLocaleInfoEx": 3, "KERNEL32.dll!CreateSymbolicLinkW": 3, "KERNEL32.dll!GetFileInformationByHandleEx": 9, "KERNEL32.dll!GetFileInformationByHandle": 2, "KERNEL32.dll!SetFileInformationByHandle": 8, "KERNEL32.dll!CopyFileW": 4, "KERNEL32.dll!SetFileAttributesW": 2, "KERNEL32.dll!AreFileApisANSI": 2, "KERNEL32.dll!CreateDirectoryExW": 2, "KERNEL32.dll!CreateHardLinkW": 2, "KERNEL32.dll!FindFirstFileExW": 5, "KERNEL32.dll!GetCurrentDirectoryW": 2, "KERNEL32.dll!GetFinalPathNameByHandleW": 3, "KERNEL32.dll!GetFileAttributesExW": 2, "KERNEL32.dll!MoveFileExW": 2, "KERNEL32.dll!SetCurrentDirectoryW": 2, "KERNEL32.dll!SetFileTime": 2, "KERNEL32.dll!GetDiskFreeSpaceExW": 3, "KERNEL32.dll!RtlPcToFileHeader": 3, "KERNEL32.dll!RaiseException": 7, "KERNEL32.dll!DeleteCriticalSection": 7, "KERNEL32.dll!InitializeCriticalSectionEx": 2, "KERNEL32.dll!EnterCriticalSection": 8, "KERNEL32.dll!LeaveCriticalSection": 8, "KERNEL32.dll!DecodePointer": 3, "KERNEL32.dll!EncodePointer": 5, "KERNEL32.dll!LCMapStringEx": 5, "KERNEL32.dll!GetCPInfo": 6, "KERNEL32.dll!CompareStringEx": 3, "KERNEL32.dll!AcquireSRWLockExclusive": 5, "KERNEL32.dll!ReleaseSRWLockExclusive": 5, "KERNEL32.dll!WakeAllConditionVariable": 4, "KERNEL32.dll!SleepConditionVariableSRW": 3, "KERNEL32.dll!SetUnhandledExceptionFilter": 5, "KERNEL32.dll!UnhandledExceptionFilter": 4, "KERNEL32.dll!IsProcessorFeaturePresent": 7, "KERNEL32.dll!RtlCaptureContext": 6, "KERNEL32.dll!RtlLookupFunctionEntry": 7, "KERNEL32.dll!RtlVirtualUnwind": 6, "KERNEL32.dll!IsDebuggerPresent": 7, "KERNEL32.dll!GetStartupInfoW": 3, "KERNEL32.dll!QueryPerformanceCounter": 3, "KERNEL32.dll!InitializeSListHead": 2, "KERNEL32.dll!InterlockedFlushSList": 2, "KERNEL32.dll!InterlockedPushEntrySList": 2, "KERNEL32.dll!RtlUnwindEx": 4, "KERNEL32.dll!TlsAlloc": 2, "KERNEL32.dll!TlsFree": 2, "KERNEL32.dll!TlsGetValue": 2, "KERNEL32.dll!TlsSetValue": 2, "KERNEL32.dll!InitializeCriticalSectionAndSpinCount": 3, "KERNEL32.dll!GetFileType": 5, "KERNEL32.dll!ExitProcess": 2, "KERNEL32.dll!GetCurrentThread": 2, "KERNEL32.dll!HeapFree": 2, "KERNEL32.dll!HeapAlloc": 3, "KERNEL32.dll!GetStdHandle": 3, "KERNEL32.dll!EnumSystemLocalesW": 8, "KERNEL32.dll!CompareStringW": 2, "KERNEL32.dll!FlsAlloc": 2, "KERNEL32.dll!FlsFree": 2, "KERNEL32.dll!FlsGetValue": 2, "KERNEL32.dll!FlsSetValue": 2, "KERNEL32.dll!GetDateFormatW": 2, "KERNEL32.dll!GetLocaleInfoW": 12, "KERNEL32.dll!GetTempPathW": 2, "KERNEL32.dll!GetTimeFormatW": 2, "KERNEL32.dll!GetUserDefaultLCID": 4, "KERNEL32.dll!IsValidLocale": 3, "KERNEL32.dll!LCMapStringW": 2, "KERNEL32.dll!FlushFileBuffers": 3, "KERNEL32.dll!WriteFile": 9, "KERNEL32.dll!GetConsoleOutputCP": 2, "KERNEL32.dll!GetConsoleMode": 4, "KERNEL32.dll!SetFilePointerEx": 10, "KERNEL32.dll!GetFileSizeEx": 2, "KERNEL32.dll!ReadFile": 6, "KERNEL32.dll!SetStdHandle": 3, "KERNEL32.dll!SetEndOfFile": 2, "KERNEL32.dll!ReadConsoleW": 2, "KERNEL32.dll!SetConsoleCtrlHandler": 2, "KERNEL32.dll!HeapReAlloc": 2, "KERNEL32.dll!GetTimeZoneInformation": 2, "KERNEL32.dll!GetOEMCP": 2, "KERNEL32.dll!GetACP": 4, "KERNEL32.dll!IsValidCodePage": 4, "KERNEL32.dll!GetCommandLineA": 2, "KERNEL32.dll!FreeEnvironmentStringsW": 7, "KERNEL32.dll!GetEnvironmentStringsW": 3, "KERNEL32.dll!SetEnvironmentVariableW": 4, "KERNEL32.dll!GetProcessHeap": 2, "KERNEL32.dll!HeapSize": 2, "KERNEL32.dll!WriteConsoleW": 6, "KERNEL32.dll!OutputDebugStringW": 5, "KERNEL32.dll!RtlUnwind": 2 }, "complete_linear_sweep": true }