bfsvc.dll

v10.0.19041.3989 32-bit Windows NT Analyzed
Download
Description
CMI boot file service plug-in
Authors
© Microsoft Corporation. All rights reserved.
File size
229.9 KB
Uploaded
2025-12-01 08:40
Views
25
SHA-256
a7f9a95770c531c6ecec619e78f2afaa

Exported functions 2

DllCanUnloadNow #1 · 0x18150
DllCsiGetHandler #2 · 0x18170

Imported DLLs & functions 241

ADVAPI32.dll 13
AdjustTokenPrivileges 0x10034028
ConvertSidToStringSidW 0x1003400c
ConvertStringSecurityDescriptorToSecurityDescriptorW 0x10034008
GetSecurityDescriptorControl 0x10034018
GetSecurityDescriptorDacl 0x10034024
GetSecurityDescriptorGroup 0x10034020
GetSecurityDescriptorOwner 0x10034014
GetSecurityDescriptorSacl 0x1003402c
GetTokenInformation 0x10034000
LookupPrivilegeValueW 0x10034030
OpenProcessToken 0x10034010
OpenThreadToken 0x10034004
SetNamedSecurityInfoW 0x1003401c
api-ms-win-core-debug-l1-1-0.dll 3
DebugBreak 0x100340e8
IsDebuggerPresent 0x100340e4
OutputDebugStringW 0x100340e0
api-ms-win-core-errorhandling-l1-1-0.dll 4
GetLastError 0x100340f4
SetLastError 0x100340f0
SetUnhandledExceptionFilter 0x100340f8
UnhandledExceptionFilter 0x100340fc
api-ms-win-core-handle-l1-1-0.dll 1
CloseHandle 0x10034104
api-ms-win-core-heap-l1-1-0.dll 4
GetProcessHeap 0x10034114
HeapAlloc 0x1003410c
HeapDestroy 0x10034118
HeapFree 0x10034110
api-ms-win-core-libraryloader-l1-1-0.dll 8
DisableThreadLibraryCalls 0x10034134
FindResourceExW 0x1003413c
FreeLibrary 0x10034120
GetModuleFileNameA 0x10034128
GetModuleHandleExW 0x10034130
GetModuleHandleW 0x10034138
GetProcAddress 0x10034124
LoadResource 0x1003412c
api-ms-win-core-localization-l1-2-0.dll 1
FormatMessageW 0x10034144
api-ms-win-core-localization-obsolete-l1-2-0.dll 2
GetSystemDefaultUILanguage 0x1003414c
GetUserDefaultUILanguage 0x10034150
api-ms-win-core-processenvironment-l1-1-0.dll 1
SearchPathW 0x10034158
api-ms-win-core-processthreads-l1-1-0.dll 4
GetCurrentProcess 0x10034168
GetCurrentProcessId 0x10034160
GetCurrentThreadId 0x10034164
TerminateProcess 0x1003416c
api-ms-win-core-profile-l1-1-0.dll 1
QueryPerformanceCounter 0x10034174
api-ms-win-core-registry-l1-1-0.dll 5
RegCloseKey 0x10034180
RegCreateKeyExW 0x1003418c
RegOpenKeyExW 0x10034184
RegQueryValueExW 0x1003417c
RegSetValueExW 0x10034188
api-ms-win-core-synch-l1-1-0.dll 16
AcquireSRWLockExclusive 0x100341a0
AcquireSRWLockShared 0x10034198
CreateMutexExW 0x100341d0
CreateSemaphoreExW 0x100341b0
DeleteCriticalSection 0x100341c4
EnterCriticalSection 0x100341bc
InitializeCriticalSection 0x100341b4
InitializeCriticalSectionEx 0x100341c0
LeaveCriticalSection 0x100341ac
OpenSemaphoreW 0x100341cc
ReleaseMutex 0x100341a8
ReleaseSemaphore 0x100341a4
ReleaseSRWLockExclusive 0x1003419c
ReleaseSRWLockShared 0x10034194
WaitForSingleObject 0x100341c8
WaitForSingleObjectEx 0x100341b8
api-ms-win-core-synch-l1-2-0.dll 1
Sleep 0x100341d8
api-ms-win-core-sysinfo-l1-1-0.dll 4
GetSystemTimeAsFileTime 0x100341ec
GetSystemWindowsDirectoryW 0x100341e4
GetTickCount 0x100341e8
GetVersionExW 0x100341e0
api-ms-win-core-threadpool-l1-2-0.dll 4
CloseThreadpoolTimer 0x100341f8
CreateThreadpoolTimer 0x100341f4
SetThreadpoolTimer 0x10034200
WaitForThreadpoolTimerCallbacks 0x100341fc
api-ms-win-eventing-provider-l1-1-0.dll 3
EventRegister 0x1003420c
EventUnregister 0x10034210
EventWriteTransfer 0x10034208
imagehlp.dll 1
CheckSumMappedFile 0x10034218
KERNEL32.dll 31
CopyFileExW 0x1003406c
CreateDirectoryW 0x100340b0
CreateFileMappingW 0x10034088
CreateFileW 0x10034098
DeleteFileW 0x1003403c
DeviceIoControl 0x100340a0
FindClose 0x10034064
FindFirstFileW 0x10034078
FindNextFileW 0x10034074
FlushFileBuffers 0x10034080
GetCurrentThread 0x1003408c
GetFileAttributesW 0x10034060
GetFileInformationByHandle 0x10034044
GetFileInformationByHandleEx 0x10034048
GetFileSizeEx 0x100340a4
GetFullPathNameW 0x10034038
GetLocaleInfoW 0x1003404c
GetPrivateProfileSectionW 0x10034068
GetVolumeInformationW 0x1003407c
GetVolumeNameForVolumeMountPointW 0x10034090
GetVolumePathNameW 0x1003409c
LoadLibraryExW 0x100340ac
LoadLibraryW 0x10034054
LocalFree 0x10034050
MapViewOfFile 0x10034084
MoveFileExW 0x10034058
QueryDosDeviceW 0x100340a8
SetFileAttributesW 0x1003405c
SetFileInformationByHandle 0x10034040
UnmapViewOfFile 0x10034094
WriteFile 0x10034070
msvcrt.dll 44
__dllonexit 0x100342a4
__iob_func 0x100342c8
_amsg_exit 0x1003423c
_callnewh 0x100342b4
_except_handler4_common 0x100342b0
_initterm 0x10034240
_lock 0x10034258
_onexit 0x100342ac
_purecall 0x10034228
_snwscanf_s 0x10034280
_ultow_s 0x10034274
_unlock 0x100342a0
_vsnwprintf 0x100342a8
_vsnwprintf_s 0x10034250
_wcsicmp 0x1003425c
_wcslwr 0x10034284
_wcsnicmp 0x10034260
_wcsupr 0x10034270
_wfopen_s 0x10034248
_XcptFilter 0x10034234
bsearch 0x1003429c
fclose 0x1003424c
fflush 0x10034244
free 0x10034224
fwprintf 0x10034254
malloc 0x10034220
memcmp 0x100342bc
memcpy 0x100342c0
memcpy_s 0x10034238
memmove 0x100342b8
memmove_s 0x10034230
memset 0x100342cc
strcpy_s 0x10034290
strncmp 0x10034294
swprintf_s 0x10034268
wcscat_s 0x10034264
wcschr 0x1003426c
wcscpy_s 0x100342c4
wcsncmp 0x10034298
wcsncpy_s 0x1003427c
wcsnlen 0x1003428c
wcsrchr 0x1003422c
wcsstr 0x10034288
wcstoul 0x10034278
ntdll.dll 83
LdrAccessResource 0x10034308
LdrFindResource_U 0x10034304
LdrGetDllHandle 0x100343ec
LdrGetProcedureAddress 0x100343e8
NtAdjustPrivilegesToken 0x10034400
NtClose 0x10034418
NtCreateEvent 0x100342e8
NtDeviceIoControlFile 0x100342e0
NtEnumerateBootEntries 0x10034394
NtOpenDirectoryObject 0x1003438c
NtOpenFile 0x100342fc
NtOpenKey 0x1003435c
NtOpenProcess 0x10034374
NtOpenProcessTokenEx 0x10034404
NtOpenSymbolicLinkObject 0x10034354
NtOpenThreadTokenEx 0x10034408
NtQueryBootEntryOrder 0x10034380
NtQueryBootOptions 0x10034384
NtQueryDirectoryObject 0x10034390
NtQueryInformationFile 0x100342ec
NtQueryInformationProcess 0x1003441c
NtQueryInformationThread 0x100342f0
NtQuerySymbolicLinkObject 0x10034360
NtQuerySystemInformation 0x10034300
NtQueryValueKey 0x1003437c
NtReadFile 0x100342d8
NtSetInformationFile 0x10034310
NtSetInformationThread 0x100342dc
NtTranslateFilePath 0x10034388
NtWaitForSingleObject 0x100342f8
NtWriteFile 0x10034410
RtlAddAccessAllowedAceEx 0x10034364
RtlAllocateAndInitializeSid 0x10034368
RtlAllocateHeap 0x10034320
RtlAppendUnicodeToString 0x1003432c
RtlCompareMemory 0x1003431c
RtlCreateAcl 0x10034414
RtlCreateSecurityDescriptor 0x10034378
RtlFreeHeap 0x10034318
RtlFreeSid 0x10034370
RtlFreeUnicodeString 0x1003430c
RtlGetVersion 0x100343e0
RtlGUIDFromString 0x10034328
RtlImageNtHeader 0x100342e4
RtlImpersonateSelf 0x1003440c
RtlInitAnsiString 0x100343f4
RtlInitUnicodeString 0x100342d4
RtlLengthSecurityDescriptor 0x1003434c
RtlLengthSid 0x1003436c
RtlNtStatusToDosError 0x100342f4
RtlSetDaclSecurityDescriptor 0x10034358
RtlSetOwnerSecurityDescriptor 0x10034350
RtlStringFromGUID 0x10034314
ZwAllocateUuids 0x100343cc
ZwClose 0x10034348
ZwCreateFile 0x10034398
ZwCreateKey 0x1003439c
ZwDeleteKey 0x100343b0
ZwDeleteValueKey 0x100343a8
ZwDeviceIoControlFile 0x100343d4
ZwEnumerateKey 0x100343b4
ZwFlushKey 0x100343a4
ZwLoadKey 0x100343a0
ZwOpenDirectoryObject 0x100343e4
ZwOpenFile 0x10034340
ZwOpenKey 0x100343c8
ZwOpenMutant 0x10034344
ZwOpenProcess 0x100343fc
ZwOpenSymbolicLinkObject 0x100343dc
ZwQueryAttributesFile 0x10034330
ZwQueryDirectoryObject 0x100343d8
ZwQueryInformationFile 0x100343f8
ZwQueryInformationProcess 0x100343f0
ZwQueryKey 0x10034338
ZwQuerySymbolicLinkObject 0x100343d0
ZwQuerySystemInformation 0x10034324
ZwQueryValueKey 0x100343b8
ZwReleaseMutant 0x1003433c
ZwSaveKey 0x100343ac
ZwSetSecurityObject 0x100343bc
ZwSetValueKey 0x100343c4
ZwUnloadKey 0x100343c0
ZwWaitForSingleObject 0x10034334
RPCRT4.dll 1
UuidCreate 0x100340b8
SHLWAPI.dll 1
PathRemoveBackslashW 0x100340c0
WCP.dll 5
?RtlGetFacilityTracingFlags@Rtl@WCP@Windows@@YIKPAU_RTL_TRACING_FACILITY@123@@Z 0x100340cc
?RtlTraceFormat_PCWSTR@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z 0x100340d4
?RtlTraceVa@Rtl@WCP@Windows@@YIXKKPAU_RTL_TRACING_FACILITY@123@QBDKPAD@Z 0x100340d8
RtlFreeLUnicodeString 0x100340d0
RtlReportErrorOrigination 0x100340c8