bfsvc.dll

v10.0.19041.4351 32-bit Windows NT Analyzed
Download
Description
CMI boot file service plug-in
Authors
© Microsoft Corporation. All rights reserved.
File size
236.4 KB
Uploaded
2025-12-01 08:40
Views
21
SHA-256
ad4b828e1283b3bcbf03ee7ca6b92479

Exported functions 2

DllCanUnloadNow #1 · 0x18ea0
DllCsiGetHandler #2 · 0x18ec0

Imported DLLs & functions 255

ADVAPI32.dll 15
AdjustTokenPrivileges 0x10036030
ConvertSidToStringSidW 0x10036014
ConvertStringSecurityDescriptorToSecurityDescriptorW 0x10036010
DuplicateTokenEx 0x10036000
GetSecurityDescriptorControl 0x10036020
GetSecurityDescriptorDacl 0x1003602c
GetSecurityDescriptorGroup 0x10036028
GetSecurityDescriptorOwner 0x1003601c
GetSecurityDescriptorSacl 0x10036034
GetTokenInformation 0x10036004
LookupPrivilegeValueW 0x10036038
OpenProcessToken 0x10036018
OpenThreadToken 0x10036008
SetNamedSecurityInfoW 0x10036024
SetThreadToken 0x1003600c
api-ms-win-core-debug-l1-1-0.dll 3
DebugBreak 0x1003610c
IsDebuggerPresent 0x10036108
OutputDebugStringW 0x10036104
api-ms-win-core-errorhandling-l1-1-0.dll 4
GetLastError 0x10036120
SetLastError 0x10036114
SetUnhandledExceptionFilter 0x10036118
UnhandledExceptionFilter 0x1003611c
api-ms-win-core-handle-l1-1-0.dll 1
CloseHandle 0x10036128
api-ms-win-core-heap-l1-1-0.dll 4
GetProcessHeap 0x1003613c
HeapAlloc 0x10036134
HeapDestroy 0x10036138
HeapFree 0x10036130
api-ms-win-core-libraryloader-l1-1-0.dll 8
DisableThreadLibraryCalls 0x10036160
FindResourceExW 0x10036150
FreeLibrary 0x10036148
GetModuleFileNameA 0x10036158
GetModuleHandleExW 0x10036144
GetModuleHandleW 0x10036154
GetProcAddress 0x1003615c
LoadResource 0x1003614c
api-ms-win-core-localization-l1-2-0.dll 1
FormatMessageW 0x10036168
api-ms-win-core-localization-obsolete-l1-2-0.dll 2
GetSystemDefaultUILanguage 0x10036174
GetUserDefaultUILanguage 0x10036170
api-ms-win-core-processenvironment-l1-1-0.dll 1
SearchPathW 0x1003617c
api-ms-win-core-processthreads-l1-1-0.dll 4
GetCurrentProcess 0x10036190
GetCurrentProcessId 0x10036188
GetCurrentThreadId 0x1003618c
TerminateProcess 0x10036184
api-ms-win-core-profile-l1-1-0.dll 1
QueryPerformanceCounter 0x10036198
api-ms-win-core-registry-l1-1-0.dll 5
RegCloseKey 0x100361a4
RegCreateKeyExW 0x100361a8
RegOpenKeyExW 0x100361b0
RegQueryValueExW 0x100361a0
RegSetValueExW 0x100361ac
api-ms-win-core-synch-l1-1-0.dll 16
AcquireSRWLockExclusive 0x100361e0
AcquireSRWLockShared 0x100361d8
CreateMutexExW 0x100361f4
CreateSemaphoreExW 0x100361c0
DeleteCriticalSection 0x100361e4
EnterCriticalSection 0x100361d0
InitializeCriticalSection 0x100361bc
InitializeCriticalSectionEx 0x100361dc
LeaveCriticalSection 0x100361f0
OpenSemaphoreW 0x100361ec
ReleaseMutex 0x100361c4
ReleaseSemaphore 0x100361c8
ReleaseSRWLockExclusive 0x100361b8
ReleaseSRWLockShared 0x100361d4
WaitForSingleObject 0x100361e8
WaitForSingleObjectEx 0x100361cc
api-ms-win-core-synch-l1-2-0.dll 1
Sleep 0x100361fc
api-ms-win-core-sysinfo-l1-1-0.dll 4
GetSystemTimeAsFileTime 0x10036210
GetSystemWindowsDirectoryW 0x1003620c
GetTickCount 0x10036208
GetVersionExW 0x10036204
api-ms-win-core-threadpool-l1-2-0.dll 4
CloseThreadpoolTimer 0x10036220
CreateThreadpoolTimer 0x10036224
SetThreadpoolTimer 0x10036218
WaitForThreadpoolTimerCallbacks 0x1003621c
api-ms-win-eventing-provider-l1-1-0.dll 3
EventRegister 0x10036230
EventUnregister 0x1003622c
EventWriteTransfer 0x10036234
bcrypt.dll 6
BCryptCloseAlgorithmProvider 0x10036250
BCryptCreateHash 0x10036240
BCryptDestroyHash 0x1003624c
BCryptFinishHash 0x10036248
BCryptHashData 0x1003623c
BCryptOpenAlgorithmProvider 0x10036244
CRYPT32.dll 1
CertGetNameStringW 0x10036040
imagehlp.dll 1
CheckSumMappedFile 0x10036258
KERNEL32.dll 32
CopyFileExW 0x10036048
CreateDirectoryW 0x100360c4
CreateFileMappingW 0x10036098
CreateFileW 0x100360ac
DeleteFileW 0x1003604c
DeviceIoControl 0x100360b4
FindClose 0x10036078
FindFirstFileW 0x10036088
FindNextFileW 0x10036084
FlushFileBuffers 0x10036090
GetCurrentThread 0x1003609c
GetFileAttributesW 0x100360a8
GetFileInformationByHandle 0x10036054
GetFileInformationByHandleEx 0x10036058
GetFileSizeEx 0x100360b8
GetFullPathNameW 0x10036060
GetLocaleInfoW 0x10036068
GetPrivateProfileSectionW 0x1003607c
GetVolumeInformationW 0x1003608c
GetVolumeNameForVolumeMountPointW 0x100360a0
GetVolumePathNameW 0x100360b0
LoadLibraryExW 0x100360c0
LoadLibraryW 0x1003606c
LocalAlloc 0x1003605c
LocalFree 0x10036064
MapViewOfFile 0x10036094
MoveFileExW 0x10036070
QueryDosDeviceW 0x100360bc
SetFileAttributesW 0x10036074
SetFileInformationByHandle 0x10036050
UnmapViewOfFile 0x100360a4
WriteFile 0x10036080
msvcrt.dll 44
__dllonexit 0x100362f0
__iob_func 0x10036308
_amsg_exit 0x100362e4
_callnewh 0x1003627c
_except_handler4_common 0x100362f8
_initterm 0x10036264
_lock 0x1003629c
_onexit 0x100362f4
_purecall 0x10036268
_snwscanf_s 0x100362c4
_ultow_s 0x100362bc
_unlock 0x100362e8
_vsnwprintf 0x100362ec
_vsnwprintf_s 0x10036290
_wcsicmp 0x10036300
_wcslwr 0x100362c8
_wcsnicmp 0x100362e0
_wcsupr 0x100362b4
_wfopen_s 0x10036288
_XcptFilter 0x100362a0
bsearch 0x100362dc
fclose 0x1003628c
fflush 0x10036284
free 0x10036304
fwprintf 0x10036294
malloc 0x10036260
memcmp 0x10036280
memcpy 0x10036274
memcpy_s 0x10036278
memmove 0x100362fc
memmove_s 0x10036270
memset 0x1003630c
strcpy_s 0x100362d4
strncmp 0x100362d8
swprintf_s 0x100362ac
wcscat_s 0x100362a8
wcschr 0x100362b0
wcscpy_s 0x10036298
wcsncmp 0x100362a4
wcsncpy_s 0x100362b8
wcsnlen 0x100362d0
wcsrchr 0x1003626c
wcsstr 0x100362cc
wcstoul 0x100362c0
ntdll.dll 84
LdrAccessResource 0x10036348
LdrFindResource_U 0x10036344
LdrGetDllHandle 0x10036430
LdrGetProcedureAddress 0x1003642c
NtAdjustPrivilegesToken 0x10036444
NtClose 0x1003645c
NtCreateEvent 0x10036328
NtDeviceIoControlFile 0x10036320
NtEnumerateBootEntries 0x100363d8
NtOpenDirectoryObject 0x100363d0
NtOpenFile 0x1003633c
NtOpenKey 0x100363a0
NtOpenProcess 0x100363b4
NtOpenProcessTokenEx 0x10036448
NtOpenSymbolicLinkObject 0x10036398
NtOpenThreadTokenEx 0x1003644c
NtQueryBootEntryOrder 0x100363c4
NtQueryBootOptions 0x100363c8
NtQueryDirectoryObject 0x100363d4
NtQueryInformationFile 0x1003632c
NtQueryInformationProcess 0x10036460
NtQueryInformationThread 0x10036330
NtQuerySymbolicLinkObject 0x100363a4
NtQuerySystemEnvironmentValueEx 0x10036360
NtQuerySystemInformation 0x10036340
NtQueryValueKey 0x100363c0
NtReadFile 0x10036318
NtSetInformationFile 0x10036350
NtSetInformationThread 0x1003631c
NtTranslateFilePath 0x100363cc
NtWaitForSingleObject 0x10036338
NtWriteFile 0x10036454
RtlAddAccessAllowedAceEx 0x100363a8
RtlAllocateAndInitializeSid 0x100363ac
RtlAllocateHeap 0x10036364
RtlAppendUnicodeToString 0x10036370
RtlCompareMemory 0x1003635c
RtlCreateAcl 0x100363b8
RtlCreateSecurityDescriptor 0x100363bc
RtlFreeHeap 0x10036358
RtlFreeSid 0x10036458
RtlFreeUnicodeString 0x1003634c
RtlGetVersion 0x10036424
RtlGUIDFromString 0x1003636c
RtlImageNtHeader 0x10036324
RtlImpersonateSelf 0x10036450
RtlInitAnsiString 0x10036438
RtlInitUnicodeString 0x10036314
RtlLengthSecurityDescriptor 0x10036390
RtlLengthSid 0x100363b0
RtlNtStatusToDosError 0x10036334
RtlSetDaclSecurityDescriptor 0x1003639c
RtlSetOwnerSecurityDescriptor 0x10036394
RtlStringFromGUID 0x10036354
ZwAllocateUuids 0x10036410
ZwClose 0x1003638c
ZwCreateFile 0x100363dc
ZwCreateKey 0x100363e0
ZwDeleteKey 0x100363f4
ZwDeleteValueKey 0x100363ec
ZwDeviceIoControlFile 0x10036418
ZwEnumerateKey 0x100363f8
ZwFlushKey 0x100363e8
ZwLoadKey 0x100363e4
ZwOpenDirectoryObject 0x10036428
ZwOpenFile 0x10036384
ZwOpenKey 0x1003640c
ZwOpenMutant 0x10036388
ZwOpenProcess 0x10036440
ZwOpenSymbolicLinkObject 0x10036420
ZwQueryAttributesFile 0x10036374
ZwQueryDirectoryObject 0x1003641c
ZwQueryInformationFile 0x1003643c
ZwQueryInformationProcess 0x10036434
ZwQueryKey 0x1003637c
ZwQuerySymbolicLinkObject 0x10036414
ZwQuerySystemInformation 0x10036368
ZwQueryValueKey 0x100363fc
ZwReleaseMutant 0x10036380
ZwSaveKey 0x100363f0
ZwSetSecurityObject 0x10036400
ZwSetValueKey 0x10036408
ZwUnloadKey 0x10036404
ZwWaitForSingleObject 0x10036378
RPCRT4.dll 1
UuidCreate 0x100360cc
SHLWAPI.dll 1
PathRemoveBackslashW 0x100360d4
WCP.dll 5
?RtlGetFacilityTracingFlags@Rtl@WCP@Windows@@YIKPAU_RTL_TRACING_FACILITY@123@@Z 0x100360e8
?RtlTraceFormat_PCWSTR@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z 0x100360ec
?RtlTraceVa@Rtl@WCP@Windows@@YIXKKPAU_RTL_TRACING_FACILITY@123@QBDKPAD@Z 0x100360e4
RtlFreeLUnicodeString 0x100360e0
RtlReportErrorOrigination 0x100360dc
WINTRUST.dll 3
WinVerifyTrust 0x100360fc
WTHelperGetProvSignerFromChain 0x100360f4
WTHelperProvDataFromStateData 0x100360f8