{
  "path": "NVIDIA App\\ShadowPlay\\capcore64.dll",
  "sha256": "ea21c7b665248ac378459dbead602436c45181cb9606b33eb6e59d30d5e9f3b4",
  "method": "Capstone linear sweep over raw bytes of all IMAGE_SCN_MEM_EXECUTE sections; skipdata enabled; no reachability proof",
  "sections": [
    {
      "name": ".text",
      "raw_bytes": 1193984,
      "processed_bytes": 1193984,
      "instructions": 595371,
      "skipdata_bytes": 25
    }
  ],
  "utc": "2026-11-11T21:40:18.857946+00:00",
  "instructions": 595371,
  "skipdata_bytes": 25,
  "calls": 13454,
  "api_reference_counts": {
    "KERNEL32.dll!InitializeCriticalSection": 38,
    "KERNEL32.dll!LocalAlloc": 59,
    "KERNEL32.dll!LocalFree": 100,
    "KERNEL32.dll!GetProcAddress": 128,
    "KERNEL32.dll!GetSystemDirectoryW": 28,
    "KERNEL32.dll!GetFileAttributesW": 12,
    "KERNEL32.dll!GetLastError": 262,
    "KERNEL32.dll!SetLastError": 119,
    "KERNEL32.dll!GetModuleHandleW": 22,
    "KERNEL32.dll!GetModuleFileNameW": 15,
    "KERNEL32.dll!VerSetConditionMask": 6,
    "KERNEL32.dll!VerifyVersionInfoW": 4,
    "KERNEL32.dll!GetFullPathNameW": 3,
    "KERNEL32.dll!LoadLibraryExW": 31,
    "KERNEL32.dll!CreateFileW": 24,
    "KERNEL32.dll!CloseHandle": 178,
    "KERNEL32.dll!GetModuleFileNameA": 2,
    "KERNEL32.dll!CreateProcessA": 2,
    "KERNEL32.dll!CreateProcessW": 2,
    "KERNEL32.dll!FreeLibrary": 52,
    "USER32.dll!EnumWindows": 3,
    "USER32.dll!GetForegroundWindow": 3,
    "USER32.dll!GetWindowThreadProcessId": 4,
    "USER32.dll!GetWindowRect": 4,
    "USER32.dll!IsWindowVisible": 3,
    "USER32.dll!MonitorFromPoint": 3,
    "USER32.dll!GetSystemMetrics": 3,
    "KERNEL32.dll!CreateSemaphoreW": 17,
    "KERNEL32.dll!CreateEventW": 40,
    "KERNEL32.dll!EnterCriticalSection": 128,
    "KERNEL32.dll!DeleteCriticalSection": 76,
    "KERNEL32.dll!LeaveCriticalSection": 135,
    "KERNEL32.dll!WaitForMultipleObjects": 55,
    "KERNEL32.dll!ReleaseSemaphore": 29,
    "GDI32.dll!SetDCBrushColor": 5,
    "GDI32.dll!SetDCPenColor": 5,
    "GDI32.dll!SetTextColor": 5,
    "GDI32.dll!SetBkMode": 5,
    "USER32.dll!DrawTextW": 5,
    "KERNEL32.dll!WaitForSingleObject": 34,
    "KERNEL32.dll!SetEvent": 33,
    "KERNEL32.dll!SetThreadPriority": 16,
    "KERNEL32.dll!GetThreadPriority": 15,
    "WINMM.dll!timeBeginPeriod": 4,
    "USER32.dll!InvalidateRect": 3,
    "KERNEL32.dll!GetCurrentProcess": 13,
    "KERNEL32.dll!SetPriorityClass": 5,
    "KERNEL32.dll!GetPriorityClass": 5,
    "WINMM.dll!timeEndPeriod": 4,
    "ole32.dll!CoTaskMemFree": 24,
    "KERNEL32.dll!Sleep": 18,
    "KERNEL32.dll!CancelWaitableTimer": 5,
    "KERNEL32.dll!CreateWaitableTimerW": 4,
    "KERNEL32.dll!SetWaitableTimer": 7,
    "KERNEL32.dll!SleepEx": 5,
    "USER32.dll!DestroyWindow": 7,
    "USER32.dll!RegisterClassExW": 4,
    "USER32.dll!CreateWindowExW": 4,
    "USER32.dll!UnregisterClassW": 2,
    "USER32.dll!EnumDisplayDevicesW": 2,
    "KERNEL32.dll!CreateEventExW": 3,
    "ole32.dll!CoInitializeEx": 4,
    "KERNEL32.dll!GetVolumeInformationA": 2,
    "KERNEL32.dll!GetVersionExW": 2,
    "KERNEL32.dll!OutputDebugStringW": 7,
    "ADVAPI32.dll!CreateWellKnownSid": 2,
    "ADVAPI32.dll!ImpersonateSelf": 2,
    "KERNEL32.dll!GetCurrentThread": 8,
    "ADVAPI32.dll!OpenThreadToken": 2,
    "ADVAPI32.dll!CreateRestrictedToken": 2,
    "ADVAPI32.dll!SetThreadToken": 5,
    "ADVAPI32.dll!RevertToSelf": 4,
    "KERNEL32.dll!GetFileSizeEx": 10,
    "KERNEL32.dll!CopyFileW": 3,
    "ADVAPI32.dll!GetSecurityDescriptorDacl": 5,
    "SHELL32.dll!SHGetFolderPathW": 8,
    "KERNEL32.dll!CreateDirectoryW": 8,
    "KERNEL32.dll!WideCharToMultiByte": 17,
    "KERNEL32.dll!GetCurrentProcessId": 7,
    "ADVAPI32.dll!AllocateAndInitializeSid": 2,
    "ADVAPI32.dll!SetEntriesInAclW": 2,
    "ADVAPI32.dll!InitializeSecurityDescriptor": 3,
    "ADVAPI32.dll!SetSecurityDescriptorDacl": 3,
    "ADVAPI32.dll!FreeSid": 2,
    "ADVAPI32.dll!GetUserNameA": 2,
    "ADVAPI32.dll!GetUserNameW": 2,
    "KERNEL32.dll!GetLocalTime": 3,
    "KERNEL32.dll!GetCurrentThreadId": 12,
    "ADVAPI32.dll!RegOpenKeyExA": 3,
    "ADVAPI32.dll!RegQueryValueExA": 3,
    "ADVAPI32.dll!RegCloseKey": 3,
    "KERNEL32.dll!MoveFileExW": 3,
    "KERNEL32.dll!GetFinalPathNameByHandleW": 2,
    "KERNEL32.dll!DeleteFileW": 10,
    "KERNEL32.dll!WriteFile": 15,
    "ole32.dll!CoCreateInstance": 11,
    "SHLWAPI.dll!PathIsUNCW": 2,
    "SHLWAPI.dll!PathAppendW": 2,
    "KERNEL32.dll!GetDiskFreeSpaceExW": 3,
    "KERNEL32.dll!GetTempFileNameW": 4,
    "KERNEL32.dll!SetFilePointer": 9,
    "KERNEL32.dll!ReadFile": 7,
    "KERNEL32.dll!FlushFileBuffers": 4,
    "KERNEL32.dll!GetTickCount": 4,
    "ole32.dll!CoUninitialize": 3,
    "OLEAUT32.dll!VariantInit": 2,
    "OLEAUT32.dll!VariantClear": 2,
    "KERNEL32.dll!ResetEvent": 5,
    "KERNEL32.dll!GetThreadId": 10,
    "USER32.dll!PostThreadMessageW": 7,
    "KERNEL32.dll!CreateThread": 2,
    "KERNEL32.dll!GetFileSize": 2,
    "KERNEL32.dll!GetModuleHandleExW": 6,
    "KERNEL32.dll!GetSystemInfo": 3,
    "KERNEL32.dll!QueryPerformanceFrequency": 2,
    "KERNEL32.dll!QueryPerformanceCounter": 4,
    "SHELL32.dll!SHGetKnownFolderPath": 1,
    "USER32.dll!DefWindowProcW": 1,
    "dxva2.dll!DXVA2CreateVideoService": 1,
    "KERNEL32.dll!AcquireSRWLockExclusive": 5,
    "KERNEL32.dll!ReleaseSRWLockExclusive": 5,
    "KERNEL32.dll!WakeAllConditionVariable": 4,
    "KERNEL32.dll!SleepConditionVariableSRW": 3,
    "KERNEL32.dll!SetUnhandledExceptionFilter": 5,
    "KERNEL32.dll!UnhandledExceptionFilter": 4,
    "KERNEL32.dll!TerminateProcess": 4,
    "KERNEL32.dll!IsProcessorFeaturePresent": 7,
    "KERNEL32.dll!RtlCaptureContext": 6,
    "KERNEL32.dll!RtlLookupFunctionEntry": 7,
    "KERNEL32.dll!RtlVirtualUnwind": 6,
    "KERNEL32.dll!IsDebuggerPresent": 7,
    "KERNEL32.dll!GetStartupInfoW": 3,
    "KERNEL32.dll!GetSystemTimeAsFileTime": 4,
    "KERNEL32.dll!InitializeSListHead": 2,
    "VERSION.dll!GetFileVersionInfoSizeW": 1,
    "VERSION.dll!GetFileVersionInfoW": 1,
    "VERSION.dll!VerQueryValueW": 1,
    "KERNEL32.dll!RtlUnwindEx": 4,
    "KERNEL32.dll!RtlPcToFileHeader": 2,
    "KERNEL32.dll!RaiseException": 6,
    "KERNEL32.dll!InterlockedFlushSList": 2,
    "KERNEL32.dll!InterlockedPushEntrySList": 2,
    "KERNEL32.dll!EncodePointer": 4,
    "KERNEL32.dll!TlsAlloc": 2,
    "KERNEL32.dll!TlsFree": 2,
    "KERNEL32.dll!TlsGetValue": 2,
    "KERNEL32.dll!TlsSetValue": 2,
    "KERNEL32.dll!InitializeCriticalSectionAndSpinCount": 3,
    "KERNEL32.dll!GetStdHandle": 4,
    "KERNEL32.dll!GetFileType": 5,
    "KERNEL32.dll!WriteConsoleW": 7,
    "KERNEL32.dll!ExitProcess": 2,
    "KERNEL32.dll!HeapFree": 2,
    "KERNEL32.dll!HeapAlloc": 3,
    "KERNEL32.dll!SetConsoleCtrlHandler": 2,
    "KERNEL32.dll!FindFirstFileExW": 4,
    "KERNEL32.dll!FindNextFileW": 4,
    "KERNEL32.dll!FindClose": 10,
    "KERNEL32.dll!GetOEMCP": 2,
    "KERNEL32.dll!GetACP": 4,
    "KERNEL32.dll!GetCPInfo": 5,
    "KERNEL32.dll!IsValidCodePage": 4,
    "KERNEL32.dll!GetCommandLineA": 2,
    "KERNEL32.dll!GetCommandLineW": 2,
    "KERNEL32.dll!MultiByteToWideChar": 2,
    "KERNEL32.dll!FreeEnvironmentStringsW": 7,
    "KERNEL32.dll!GetEnvironmentStringsW": 3,
    "KERNEL32.dll!SetEnvironmentVariableW": 4,
    "KERNEL32.dll!EnumSystemLocalesW": 8,
    "KERNEL32.dll!CompareStringW": 2,
    "KERNEL32.dll!FlsAlloc": 2,
    "KERNEL32.dll!FlsFree": 2,
    "KERNEL32.dll!FlsGetValue": 2,
    "KERNEL32.dll!FlsSetValue": 2,
    "KERNEL32.dll!GetDateFormatW": 2,
    "KERNEL32.dll!GetLocaleInfoW": 12,
    "KERNEL32.dll!GetTempPathW": 2,
    "KERNEL32.dll!GetTimeFormatW": 2,
    "KERNEL32.dll!GetUserDefaultLCID": 4,
    "KERNEL32.dll!IsValidLocale": 3,
    "KERNEL32.dll!LCMapStringW": 2,
    "KERNEL32.dll!GetProcessHeap": 2,
    "KERNEL32.dll!GetStringTypeW": 3,
    "KERNEL32.dll!SetFilePointerEx": 10,
    "KERNEL32.dll!SetStdHandle": 3,
    "KERNEL32.dll!GetConsoleOutputCP": 2,
    "KERNEL32.dll!GetConsoleMode": 4,
    "KERNEL32.dll!HeapSize": 2,
    "KERNEL32.dll!HeapReAlloc": 2,
    "KERNEL32.dll!ReadConsoleW": 2,
    "KERNEL32.dll!RtlUnwind": 2
  },
  "complete_linear_sweep": true
}