bfsvc.dll

v10.0.19041.3385 32-bit Windows NT Analyzed
Download
Description
CMI boot file service plug-in
Authors
© Microsoft Corporation. All rights reserved.
File size
217.8 KB
Uploaded
2025-12-01 08:40
Views
22
SHA-256
b892e5b39dc31fdf220d31c816a048c6

Exported functions 2

DllCanUnloadNow #1 · 0x16850
DllCsiGetHandler #2 · 0x16870

Imported DLLs & functions 241

ADVAPI32.dll 13
AdjustTokenPrivileges 0x10032028
ConvertSidToStringSidW 0x1003200c
ConvertStringSecurityDescriptorToSecurityDescriptorW 0x10032008
GetSecurityDescriptorControl 0x10032018
GetSecurityDescriptorDacl 0x10032024
GetSecurityDescriptorGroup 0x10032020
GetSecurityDescriptorOwner 0x10032014
GetSecurityDescriptorSacl 0x1003202c
GetTokenInformation 0x10032000
LookupPrivilegeValueW 0x10032030
OpenProcessToken 0x10032010
OpenThreadToken 0x10032004
SetNamedSecurityInfoW 0x1003201c
api-ms-win-core-debug-l1-1-0.dll 3
DebugBreak 0x100320e8
IsDebuggerPresent 0x100320e4
OutputDebugStringW 0x100320e0
api-ms-win-core-errorhandling-l1-1-0.dll 4
GetLastError 0x100320f4
SetLastError 0x100320f0
SetUnhandledExceptionFilter 0x100320f8
UnhandledExceptionFilter 0x100320fc
api-ms-win-core-handle-l1-1-0.dll 1
CloseHandle 0x10032104
api-ms-win-core-heap-l1-1-0.dll 4
GetProcessHeap 0x10032114
HeapAlloc 0x1003210c
HeapDestroy 0x10032118
HeapFree 0x10032110
api-ms-win-core-libraryloader-l1-1-0.dll 8
DisableThreadLibraryCalls 0x10032134
FindResourceExW 0x1003213c
FreeLibrary 0x10032120
GetModuleFileNameA 0x10032128
GetModuleHandleExW 0x10032130
GetModuleHandleW 0x10032138
GetProcAddress 0x10032124
LoadResource 0x1003212c
api-ms-win-core-localization-l1-2-0.dll 1
FormatMessageW 0x10032144
api-ms-win-core-localization-obsolete-l1-2-0.dll 2
GetSystemDefaultUILanguage 0x1003214c
GetUserDefaultUILanguage 0x10032150
api-ms-win-core-processenvironment-l1-1-0.dll 1
SearchPathW 0x10032158
api-ms-win-core-processthreads-l1-1-0.dll 4
GetCurrentProcess 0x10032168
GetCurrentProcessId 0x10032160
GetCurrentThreadId 0x10032164
TerminateProcess 0x1003216c
api-ms-win-core-profile-l1-1-0.dll 1
QueryPerformanceCounter 0x10032174
api-ms-win-core-registry-l1-1-0.dll 5
RegCloseKey 0x10032180
RegCreateKeyExW 0x1003218c
RegOpenKeyExW 0x10032184
RegQueryValueExW 0x1003217c
RegSetValueExW 0x10032188
api-ms-win-core-synch-l1-1-0.dll 16
AcquireSRWLockExclusive 0x100321a0
AcquireSRWLockShared 0x10032198
CreateMutexExW 0x100321d0
CreateSemaphoreExW 0x100321b0
DeleteCriticalSection 0x100321c4
EnterCriticalSection 0x100321bc
InitializeCriticalSection 0x100321b4
InitializeCriticalSectionEx 0x100321c0
LeaveCriticalSection 0x100321ac
OpenSemaphoreW 0x100321cc
ReleaseMutex 0x100321a8
ReleaseSemaphore 0x100321a4
ReleaseSRWLockExclusive 0x1003219c
ReleaseSRWLockShared 0x10032194
WaitForSingleObject 0x100321c8
WaitForSingleObjectEx 0x100321b8
api-ms-win-core-synch-l1-2-0.dll 1
Sleep 0x100321d8
api-ms-win-core-sysinfo-l1-1-0.dll 4
GetSystemTimeAsFileTime 0x100321ec
GetSystemWindowsDirectoryW 0x100321e4
GetTickCount 0x100321e8
GetVersionExW 0x100321e0
api-ms-win-core-threadpool-l1-2-0.dll 4
CloseThreadpoolTimer 0x100321f8
CreateThreadpoolTimer 0x100321f4
SetThreadpoolTimer 0x10032200
WaitForThreadpoolTimerCallbacks 0x100321fc
api-ms-win-eventing-provider-l1-1-0.dll 3
EventRegister 0x1003220c
EventUnregister 0x10032210
EventWriteTransfer 0x10032208
imagehlp.dll 1
CheckSumMappedFile 0x10032218
KERNEL32.dll 31
CopyFileExW 0x1003206c
CreateDirectoryW 0x100320b0
CreateFileMappingW 0x1003208c
CreateFileW 0x1003209c
DeleteFileW 0x1003203c
DeviceIoControl 0x100320a4
FindClose 0x10032064
FindFirstFileW 0x10032078
FindNextFileW 0x10032074
FlushFileBuffers 0x10032084
GetCurrentThread 0x10032090
GetFileAttributesW 0x10032060
GetFileInformationByHandle 0x10032044
GetFileInformationByHandleEx 0x10032048
GetFileSizeEx 0x100320a8
GetFullPathNameW 0x10032038
GetLocaleInfoW 0x1003204c
GetPrivateProfileSectionW 0x10032068
GetVolumeInformationW 0x1003207c
GetVolumeNameForVolumeMountPointW 0x10032094
GetVolumePathNameW 0x100320a0
LoadLibraryExW 0x10032080
LoadLibraryW 0x10032054
LocalFree 0x10032050
MapViewOfFile 0x10032088
MoveFileExW 0x10032058
QueryDosDeviceW 0x100320ac
SetFileAttributesW 0x1003205c
SetFileInformationByHandle 0x10032040
UnmapViewOfFile 0x10032098
WriteFile 0x10032070
msvcrt.dll 44
__dllonexit 0x100322a4
__iob_func 0x100322c8
_amsg_exit 0x1003223c
_callnewh 0x100322b4
_except_handler4_common 0x100322b0
_initterm 0x10032240
_lock 0x10032258
_onexit 0x100322ac
_purecall 0x10032228
_snwscanf_s 0x10032280
_ultow_s 0x10032274
_unlock 0x100322a0
_vsnwprintf 0x100322a8
_vsnwprintf_s 0x10032250
_wcsicmp 0x1003225c
_wcslwr 0x10032284
_wcsnicmp 0x10032260
_wcsupr 0x10032270
_wfopen_s 0x10032248
_XcptFilter 0x10032234
bsearch 0x1003229c
fclose 0x1003224c
fflush 0x10032244
free 0x10032224
fwprintf 0x10032254
malloc 0x10032220
memcmp 0x100322bc
memcpy 0x100322c0
memcpy_s 0x10032238
memmove 0x100322b8
memmove_s 0x10032230
memset 0x100322cc
strcpy_s 0x10032290
strncmp 0x10032294
swprintf_s 0x10032268
wcscat_s 0x10032264
wcschr 0x1003226c
wcscpy_s 0x100322c4
wcsncmp 0x10032298
wcsncpy_s 0x1003227c
wcsnlen 0x1003228c
wcsrchr 0x1003222c
wcsstr 0x10032288
wcstoul 0x10032278
ntdll.dll 83
LdrAccessResource 0x10032308
LdrFindResource_U 0x10032304
LdrGetDllHandle 0x100323ec
LdrGetProcedureAddress 0x100323e8
NtAdjustPrivilegesToken 0x10032400
NtClose 0x10032418
NtCreateEvent 0x100322e8
NtDeviceIoControlFile 0x100322e0
NtEnumerateBootEntries 0x10032394
NtOpenDirectoryObject 0x1003238c
NtOpenFile 0x100322fc
NtOpenKey 0x1003235c
NtOpenProcess 0x10032374
NtOpenProcessTokenEx 0x10032404
NtOpenSymbolicLinkObject 0x10032354
NtOpenThreadTokenEx 0x10032408
NtQueryBootEntryOrder 0x10032380
NtQueryBootOptions 0x10032384
NtQueryDirectoryObject 0x10032390
NtQueryInformationFile 0x100322ec
NtQueryInformationProcess 0x1003241c
NtQueryInformationThread 0x100322f0
NtQuerySymbolicLinkObject 0x10032360
NtQuerySystemInformation 0x10032300
NtQueryValueKey 0x1003237c
NtReadFile 0x100322d8
NtSetInformationFile 0x10032310
NtSetInformationThread 0x100322dc
NtTranslateFilePath 0x10032388
NtWaitForSingleObject 0x100322f8
NtWriteFile 0x10032410
RtlAddAccessAllowedAceEx 0x10032364
RtlAllocateAndInitializeSid 0x10032368
RtlAllocateHeap 0x10032320
RtlAppendUnicodeToString 0x1003232c
RtlCompareMemory 0x1003231c
RtlCreateAcl 0x10032414
RtlCreateSecurityDescriptor 0x10032378
RtlFreeHeap 0x10032318
RtlFreeSid 0x10032370
RtlFreeUnicodeString 0x1003230c
RtlGetVersion 0x100323e0
RtlGUIDFromString 0x10032328
RtlImageNtHeader 0x100322e4
RtlImpersonateSelf 0x1003240c
RtlInitAnsiString 0x100323f4
RtlInitUnicodeString 0x100322d4
RtlLengthSecurityDescriptor 0x1003234c
RtlLengthSid 0x1003236c
RtlNtStatusToDosError 0x100322f4
RtlSetDaclSecurityDescriptor 0x10032358
RtlSetOwnerSecurityDescriptor 0x10032350
RtlStringFromGUID 0x10032314
ZwAllocateUuids 0x100323cc
ZwClose 0x10032348
ZwCreateFile 0x10032398
ZwCreateKey 0x1003239c
ZwDeleteKey 0x100323b0
ZwDeleteValueKey 0x100323a8
ZwDeviceIoControlFile 0x100323d4
ZwEnumerateKey 0x100323b4
ZwFlushKey 0x100323a4
ZwLoadKey 0x100323a0
ZwOpenDirectoryObject 0x100323e4
ZwOpenFile 0x10032340
ZwOpenKey 0x100323c8
ZwOpenMutant 0x10032344
ZwOpenProcess 0x100323fc
ZwOpenSymbolicLinkObject 0x100323dc
ZwQueryAttributesFile 0x10032330
ZwQueryDirectoryObject 0x100323d8
ZwQueryInformationFile 0x100323f8
ZwQueryInformationProcess 0x100323f0
ZwQueryKey 0x10032338
ZwQuerySymbolicLinkObject 0x100323d0
ZwQuerySystemInformation 0x10032324
ZwQueryValueKey 0x100323b8
ZwReleaseMutant 0x1003233c
ZwSaveKey 0x100323ac
ZwSetSecurityObject 0x100323bc
ZwSetValueKey 0x100323c4
ZwUnloadKey 0x100323c0
ZwWaitForSingleObject 0x10032334
RPCRT4.dll 1
UuidCreate 0x100320b8
SHLWAPI.dll 1
PathRemoveBackslashW 0x100320c0
WCP.dll 5
?RtlGetFacilityTracingFlags@Rtl@WCP@Windows@@YIKPAU_RTL_TRACING_FACILITY@123@@Z 0x100320cc
?RtlTraceFormat_PCWSTR@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z 0x100320d4
?RtlTraceVa@Rtl@WCP@Windows@@YIXKKPAU_RTL_TRACING_FACILITY@123@QBDKPAD@Z 0x100320d8
RtlFreeLUnicodeString 0x100320d0
RtlReportErrorOrigination 0x100320c8