bfsvc.dll

v10.0.19041.5363 32-bit Windows NT Analyzed
Download
Description
CMI boot file service plug-in
Authors
© Microsoft Corporation. All rights reserved.
File size
232.5 KB
Uploaded
2025-12-01 08:40
Views
24
SHA-256
a4ba668b4cf4542e5f017c68942f120d

Exported functions 2

DllCanUnloadNow #1 · 0x180b0
DllCsiGetHandler #2 · 0x180d0

Imported DLLs & functions 254

ADVAPI32.dll 15
AdjustTokenPrivileges 0x10035030
ConvertSidToStringSidW 0x10035014
ConvertStringSecurityDescriptorToSecurityDescriptorW 0x10035010
DuplicateTokenEx 0x10035000
GetSecurityDescriptorControl 0x10035020
GetSecurityDescriptorDacl 0x1003502c
GetSecurityDescriptorGroup 0x10035028
GetSecurityDescriptorOwner 0x1003501c
GetSecurityDescriptorSacl 0x10035034
GetTokenInformation 0x10035004
LookupPrivilegeValueW 0x10035038
OpenProcessToken 0x10035018
OpenThreadToken 0x10035008
SetNamedSecurityInfoW 0x10035024
SetThreadToken 0x1003500c
api-ms-win-core-debug-l1-1-0.dll 3
DebugBreak 0x1003510c
IsDebuggerPresent 0x10035108
OutputDebugStringW 0x10035104
api-ms-win-core-errorhandling-l1-1-0.dll 4
GetLastError 0x10035118
SetLastError 0x10035114
SetUnhandledExceptionFilter 0x1003511c
UnhandledExceptionFilter 0x10035120
api-ms-win-core-handle-l1-1-0.dll 1
CloseHandle 0x10035128
api-ms-win-core-heap-l1-1-0.dll 4
GetProcessHeap 0x1003513c
HeapAlloc 0x10035134
HeapDestroy 0x10035138
HeapFree 0x10035130
api-ms-win-core-libraryloader-l1-1-0.dll 8
DisableThreadLibraryCalls 0x10035160
FindResourceExW 0x10035150
FreeLibrary 0x1003514c
GetModuleFileNameA 0x10035158
GetModuleHandleExW 0x10035144
GetModuleHandleW 0x10035154
GetProcAddress 0x1003515c
LoadResource 0x10035148
api-ms-win-core-localization-l1-2-0.dll 1
FormatMessageW 0x10035168
api-ms-win-core-localization-obsolete-l1-2-0.dll 2
GetSystemDefaultUILanguage 0x10035174
GetUserDefaultUILanguage 0x10035170
api-ms-win-core-processenvironment-l1-1-0.dll 1
SearchPathW 0x1003517c
api-ms-win-core-processthreads-l1-1-0.dll 4
GetCurrentProcess 0x10035190
GetCurrentProcessId 0x10035188
GetCurrentThreadId 0x10035184
TerminateProcess 0x1003518c
api-ms-win-core-profile-l1-1-0.dll 1
QueryPerformanceCounter 0x10035198
api-ms-win-core-registry-l1-1-0.dll 5
RegCloseKey 0x100351a8
RegCreateKeyExW 0x100351a4
RegOpenKeyExW 0x100351b0
RegQueryValueExW 0x100351a0
RegSetValueExW 0x100351ac
api-ms-win-core-synch-l1-1-0.dll 16
AcquireSRWLockExclusive 0x100351b8
AcquireSRWLockShared 0x100351d4
CreateMutexExW 0x100351c8
CreateSemaphoreExW 0x100351f4
DeleteCriticalSection 0x100351e4
EnterCriticalSection 0x100351dc
InitializeCriticalSection 0x100351ec
InitializeCriticalSectionEx 0x100351e0
LeaveCriticalSection 0x100351bc
OpenSemaphoreW 0x100351f0
ReleaseMutex 0x100351c0
ReleaseSemaphore 0x100351c4
ReleaseSRWLockExclusive 0x100351d8
ReleaseSRWLockShared 0x100351d0
WaitForSingleObject 0x100351e8
WaitForSingleObjectEx 0x100351cc
api-ms-win-core-synch-l1-2-0.dll 1
Sleep 0x100351fc
api-ms-win-core-sysinfo-l1-1-0.dll 3
GetSystemTimeAsFileTime 0x10035208
GetTickCount 0x10035204
GetVersionExW 0x1003520c
api-ms-win-core-threadpool-l1-2-0.dll 4
CloseThreadpoolTimer 0x1003521c
CreateThreadpoolTimer 0x10035220
SetThreadpoolTimer 0x10035218
WaitForThreadpoolTimerCallbacks 0x10035214
api-ms-win-eventing-provider-l1-1-0.dll 3
EventRegister 0x1003522c
EventUnregister 0x10035228
EventWriteTransfer 0x10035230
bcrypt.dll 6
BCryptCloseAlgorithmProvider 0x1003524c
BCryptCreateHash 0x1003523c
BCryptDestroyHash 0x10035248
BCryptFinishHash 0x10035244
BCryptHashData 0x10035238
BCryptOpenAlgorithmProvider 0x10035240
CRYPT32.dll 1
CertGetNameStringW 0x10035040
imagehlp.dll 1
CheckSumMappedFile 0x10035254
KERNEL32.dll 32
CopyFileExW 0x10035048
CreateDirectoryW 0x100350c4
CreateFileMappingW 0x10035074
CreateFileW 0x1003509c
DeleteFileW 0x1003504c
DeviceIoControl 0x10035080
FindClose 0x100350a4
FindFirstFileW 0x100350b4
FindNextFileW 0x100350b0
FlushFileBuffers 0x1003506c
GetCurrentThread 0x10035078
GetFileAttributesW 0x10035098
GetFileInformationByHandle 0x10035054
GetFileInformationByHandleEx 0x10035058
GetFileSizeEx 0x10035084
GetFullPathNameW 0x10035060
GetLocaleInfoW 0x10035068
GetPrivateProfileSectionW 0x100350a8
GetVolumeInformationW 0x100350b8
GetVolumeNameForVolumeMountPointW 0x10035094
GetVolumePathNameW 0x100350a0
LoadLibraryExW 0x100350c0
LoadLibraryW 0x10035088
LocalAlloc 0x1003505c
LocalFree 0x10035064
MapViewOfFile 0x10035070
MoveFileExW 0x1003508c
QueryDosDeviceW 0x100350bc
SetFileAttributesW 0x10035090
SetFileInformationByHandle 0x10035050
UnmapViewOfFile 0x1003507c
WriteFile 0x100350ac
msvcrt.dll 44
__dllonexit 0x100352ec
__iob_func 0x10035304
_amsg_exit 0x100352e0
_callnewh 0x1003527c
_except_handler4_common 0x100352f4
_initterm 0x10035264
_lock 0x10035298
_onexit 0x100352f0
_purecall 0x10035300
_snwscanf_s 0x100352c8
_ultow_s 0x100352b8
_unlock 0x100352e4
_vsnwprintf 0x100352e8
_vsnwprintf_s 0x1003528c
_wcsicmp 0x10035294
_wcslwr 0x100352cc
_wcsnicmp 0x100352fc
_wcsupr 0x100352b0
_wfopen_s 0x10035284
_XcptFilter 0x1003529c
bsearch 0x100352d8
fclose 0x10035288
fflush 0x10035280
free 0x10035260
fwprintf 0x10035290
malloc 0x1003525c
memcmp 0x10035278
memcpy 0x10035270
memcpy_s 0x10035274
memmove 0x100352f8
memmove_s 0x1003526c
memset 0x10035308
strcpy_s 0x100352c0
strncmp 0x100352d4
swprintf_s 0x100352ac
wcscat_s 0x100352a4
wcschr 0x100352a8
wcscpy_s 0x100352a0
wcsncmp 0x100352dc
wcsncpy_s 0x100352b4
wcsnlen 0x100352d0
wcsrchr 0x10035268
wcsstr 0x100352c4
wcstoul 0x100352bc
ntdll.dll 84
LdrAccessResource 0x10035344
LdrFindResource_U 0x10035340
LdrGetDllHandle 0x10035404
LdrGetProcedureAddress 0x10035400
NtAdjustPrivilegesToken 0x10035418
NtClose 0x10035458
NtCreateEvent 0x1003532c
NtDeviceIoControlFile 0x10035324
NtEnumerateBootEntries 0x1003544c
NtOpenDirectoryObject 0x10035444
NtOpenFile 0x1003533c
NtOpenKey 0x1003542c
NtOpenProcess 0x10035318
NtOpenProcessTokenEx 0x1003541c
NtOpenSymbolicLinkObject 0x10035428
NtOpenThreadTokenEx 0x10035420
NtQueryBootEntryOrder 0x10035438
NtQueryBootOptions 0x1003543c
NtQueryDirectoryObject 0x10035448
NtQueryInformationFile 0x10035330
NtQueryInformationProcess 0x10035314
NtQueryInformationThread 0x10035334
NtQuerySymbolicLinkObject 0x10035430
NtQuerySystemEnvironmentValueEx 0x1003535c
NtQuerySystemInformation 0x10035450
NtQueryValueKey 0x10035434
NtReadFile 0x1003531c
NtSetInformationFile 0x1003534c
NtSetInformationThread 0x10035320
NtTranslateFilePath 0x10035440
NtWaitForSingleObject 0x10035338
NtWriteFile 0x1003545c
RtlAddAccessAllowedAceEx 0x100353a4
RtlAllocateAndInitializeSid 0x100353a8
RtlAllocateHeap 0x10035360
RtlAppendUnicodeToString 0x1003536c
RtlCompareMemory 0x10035358
RtlCreateAcl 0x100353cc
RtlCreateSecurityDescriptor 0x100353d8
RtlFreeHeap 0x10035354
RtlFreeSid 0x100353bc
RtlFreeUnicodeString 0x10035348
RtlGetVersion 0x100353f8
RtlGUIDFromString 0x10035368
RtlImageNtHeader 0x10035328
RtlImpersonateSelf 0x10035424
RtlInitAnsiString 0x1003540c
RtlInitUnicodeString 0x100353b0
RtlLengthSecurityDescriptor 0x1003538c
RtlLengthSid 0x100353ac
RtlNtStatusToDosError 0x10035310
RtlSetDaclSecurityDescriptor 0x10035394
RtlSetOwnerSecurityDescriptor 0x10035390
RtlStringFromGUID 0x10035350
ZwAllocateUuids 0x100353e4
ZwClose 0x10035388
ZwCreateFile 0x10035398
ZwCreateKey 0x1003539c
ZwDeleteKey 0x100353c0
ZwDeleteValueKey 0x100353b4
ZwDeviceIoControlFile 0x100353ec
ZwEnumerateKey 0x100353c4
ZwFlushKey 0x10035454
ZwLoadKey 0x100353a0
ZwOpenDirectoryObject 0x100353fc
ZwOpenFile 0x10035380
ZwOpenKey 0x100353e0
ZwOpenMutant 0x10035384
ZwOpenProcess 0x10035414
ZwOpenSymbolicLinkObject 0x100353f4
ZwQueryAttributesFile 0x10035370
ZwQueryDirectoryObject 0x100353f0
ZwQueryInformationFile 0x10035410
ZwQueryInformationProcess 0x10035408
ZwQueryKey 0x10035378
ZwQuerySymbolicLinkObject 0x100353e8
ZwQuerySystemInformation 0x10035364
ZwQueryValueKey 0x100353c8
ZwReleaseMutant 0x1003537c
ZwSaveKey 0x100353b8
ZwSetSecurityObject 0x100353d0
ZwSetValueKey 0x100353dc
ZwUnloadKey 0x100353d4
ZwWaitForSingleObject 0x10035374
RPCRT4.dll 1
UuidCreate 0x100350cc
SHLWAPI.dll 1
PathRemoveBackslashW 0x100350d4
WCP.dll 5
?RtlGetFacilityTracingFlags@Rtl@WCP@Windows@@YIKPAU_RTL_TRACING_FACILITY@123@@Z 0x100350e8
?RtlTraceFormat_PCWSTR@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z 0x100350ec
?RtlTraceVa@Rtl@WCP@Windows@@YIXKKPAU_RTL_TRACING_FACILITY@123@QBDKPAD@Z 0x100350e0
RtlFreeLUnicodeString 0x100350e4
RtlReportErrorOrigination 0x100350dc
WINTRUST.dll 3
WinVerifyTrust 0x100350fc
WTHelperGetProvSignerFromChain 0x100350f8
WTHelperProvDataFromStateData 0x100350f4