bfsvc.dll

v10.0.19041.5547 32-bit Windows NT Analyzed
Download
Description
CMI boot file service plug-in
Authors
© Microsoft Corporation. All rights reserved.
File size
228.9 KB
Uploaded
2025-12-01 08:40
Views
23
SHA-256
cafb63f1b5198238a2866a9e101031d1

Exported functions 2

DllCanUnloadNow #1 · 0x17980
DllCsiGetHandler #2 · 0x179a0

Imported DLLs & functions 254

ADVAPI32.dll 15
AdjustTokenPrivileges 0x10034030
ConvertSidToStringSidW 0x10034014
ConvertStringSecurityDescriptorToSecurityDescriptorW 0x10034010
DuplicateTokenEx 0x10034000
GetSecurityDescriptorControl 0x10034020
GetSecurityDescriptorDacl 0x1003402c
GetSecurityDescriptorGroup 0x10034028
GetSecurityDescriptorOwner 0x1003401c
GetSecurityDescriptorSacl 0x10034034
GetTokenInformation 0x10034004
LookupPrivilegeValueW 0x10034038
OpenProcessToken 0x10034018
OpenThreadToken 0x10034008
SetNamedSecurityInfoW 0x10034024
SetThreadToken 0x1003400c
api-ms-win-core-debug-l1-1-0.dll 3
DebugBreak 0x1003410c
IsDebuggerPresent 0x10034108
OutputDebugStringW 0x10034104
api-ms-win-core-errorhandling-l1-1-0.dll 4
GetLastError 0x10034118
SetLastError 0x1003411c
SetUnhandledExceptionFilter 0x10034114
UnhandledExceptionFilter 0x10034120
api-ms-win-core-handle-l1-1-0.dll 1
CloseHandle 0x10034128
api-ms-win-core-heap-l1-1-0.dll 4
GetProcessHeap 0x10034134
HeapAlloc 0x1003413c
HeapDestroy 0x10034130
HeapFree 0x10034138
api-ms-win-core-libraryloader-l1-1-0.dll 8
DisableThreadLibraryCalls 0x1003415c
FindResourceExW 0x10034148
FreeLibrary 0x10034154
GetModuleFileNameA 0x10034150
GetModuleHandleExW 0x10034160
GetModuleHandleW 0x1003414c
GetProcAddress 0x10034158
LoadResource 0x10034144
api-ms-win-core-localization-l1-2-0.dll 1
FormatMessageW 0x10034168
api-ms-win-core-localization-obsolete-l1-2-0.dll 2
GetSystemDefaultUILanguage 0x10034170
GetUserDefaultUILanguage 0x10034174
api-ms-win-core-processenvironment-l1-1-0.dll 1
SearchPathW 0x1003417c
api-ms-win-core-processthreads-l1-1-0.dll 4
GetCurrentProcess 0x10034188
GetCurrentProcessId 0x10034184
GetCurrentThreadId 0x10034190
TerminateProcess 0x1003418c
api-ms-win-core-profile-l1-1-0.dll 1
QueryPerformanceCounter 0x10034198
api-ms-win-core-registry-l1-1-0.dll 5
RegCloseKey 0x100341b0
RegCreateKeyExW 0x100341a4
RegOpenKeyExW 0x100341a8
RegQueryValueExW 0x100341a0
RegSetValueExW 0x100341ac
api-ms-win-core-synch-l1-1-0.dll 16
AcquireSRWLockExclusive 0x100341d0
AcquireSRWLockShared 0x100341c8
CreateMutexExW 0x100341dc
CreateSemaphoreExW 0x100341d4
DeleteCriticalSection 0x100341e8
EnterCriticalSection 0x100341f0
InitializeCriticalSection 0x100341c0
InitializeCriticalSectionEx 0x100341ec
LeaveCriticalSection 0x100341d8
OpenSemaphoreW 0x100341e0
ReleaseMutex 0x100341bc
ReleaseSemaphore 0x100341b8
ReleaseSRWLockExclusive 0x100341cc
ReleaseSRWLockShared 0x100341c4
WaitForSingleObject 0x100341e4
WaitForSingleObjectEx 0x100341f4
api-ms-win-core-synch-l1-2-0.dll 1
Sleep 0x100341fc
api-ms-win-core-sysinfo-l1-1-0.dll 3
GetSystemTimeAsFileTime 0x10034204
GetTickCount 0x1003420c
GetVersionExW 0x10034208
api-ms-win-core-threadpool-l1-2-0.dll 4
CloseThreadpoolTimer 0x10034218
CreateThreadpoolTimer 0x10034220
SetThreadpoolTimer 0x1003421c
WaitForThreadpoolTimerCallbacks 0x10034214
api-ms-win-eventing-provider-l1-1-0.dll 3
EventRegister 0x1003422c
EventUnregister 0x10034228
EventWriteTransfer 0x10034230
bcrypt.dll 6
BCryptCloseAlgorithmProvider 0x1003424c
BCryptCreateHash 0x10034244
BCryptDestroyHash 0x10034248
BCryptFinishHash 0x1003423c
BCryptHashData 0x10034238
BCryptOpenAlgorithmProvider 0x10034240
CRYPT32.dll 1
CertGetNameStringW 0x10034040
imagehlp.dll 1
CheckSumMappedFile 0x10034254
KERNEL32.dll 32
CopyFileExW 0x10034048
CreateDirectoryW 0x100340c4
CreateFileMappingW 0x10034074
CreateFileW 0x1003409c
DeleteFileW 0x1003404c
DeviceIoControl 0x10034080
FindClose 0x100340a4
FindFirstFileW 0x100340b4
FindNextFileW 0x100340b0
FlushFileBuffers 0x1003406c
GetCurrentThread 0x10034078
GetFileAttributesW 0x10034098
GetFileInformationByHandle 0x10034054
GetFileInformationByHandleEx 0x10034058
GetFileSizeEx 0x10034084
GetFullPathNameW 0x10034060
GetLocaleInfoW 0x10034068
GetPrivateProfileSectionW 0x100340a8
GetVolumeInformationW 0x100340b8
GetVolumeNameForVolumeMountPointW 0x10034094
GetVolumePathNameW 0x100340a0
LoadLibraryExW 0x100340c0
LoadLibraryW 0x10034088
LocalAlloc 0x1003405c
LocalFree 0x10034064
MapViewOfFile 0x10034070
MoveFileExW 0x1003408c
QueryDosDeviceW 0x100340bc
SetFileAttributesW 0x10034090
SetFileInformationByHandle 0x10034050
UnmapViewOfFile 0x1003407c
WriteFile 0x100340ac
msvcrt.dll 44
__dllonexit 0x100342ec
__iob_func 0x10034304
_amsg_exit 0x1003427c
_callnewh 0x10034270
_except_handler4_common 0x10034264
_initterm 0x10034298
_lock 0x100342e0
_onexit 0x100342f4
_purecall 0x10034300
_snwscanf_s 0x100342c8
_ultow_s 0x100342b8
_unlock 0x100342e8
_vsnwprintf 0x10034274
_vsnwprintf_s 0x1003428c
_wcsicmp 0x10034294
_wcslwr 0x100342cc
_wcsnicmp 0x100342f0
_wcsupr 0x100342b0
_wfopen_s 0x10034284
_XcptFilter 0x10034278
bsearch 0x100342d8
fclose 0x10034288
fflush 0x10034280
free 0x10034260
fwprintf 0x10034290
malloc 0x1003425c
memcmp 0x100342f8
memcpy 0x100342fc
memcpy_s 0x100342e4
memmove 0x100342dc
memmove_s 0x1003426c
memset 0x10034308
strcpy_s 0x100342c0
strncmp 0x100342d4
swprintf_s 0x100342ac
wcscat_s 0x100342a4
wcschr 0x100342a8
wcscpy_s 0x100342a0
wcsncmp 0x1003429c
wcsncpy_s 0x100342b4
wcsnlen 0x100342d0
wcsrchr 0x10034268
wcsstr 0x100342c4
wcstoul 0x100342bc
ntdll.dll 84
LdrAccessResource 0x10034344
LdrFindResource_U 0x10034340
LdrGetDllHandle 0x10034404
LdrGetProcedureAddress 0x10034400
NtAdjustPrivilegesToken 0x10034418
NtClose 0x10034458
NtCreateEvent 0x1003432c
NtDeviceIoControlFile 0x10034324
NtEnumerateBootEntries 0x1003444c
NtOpenDirectoryObject 0x10034444
NtOpenFile 0x1003433c
NtOpenKey 0x1003442c
NtOpenProcess 0x10034318
NtOpenProcessTokenEx 0x1003441c
NtOpenSymbolicLinkObject 0x10034428
NtOpenThreadTokenEx 0x10034420
NtQueryBootEntryOrder 0x10034438
NtQueryBootOptions 0x1003443c
NtQueryDirectoryObject 0x10034448
NtQueryInformationFile 0x10034330
NtQueryInformationProcess 0x10034314
NtQueryInformationThread 0x10034334
NtQuerySymbolicLinkObject 0x10034430
NtQuerySystemEnvironmentValueEx 0x1003435c
NtQuerySystemInformation 0x10034450
NtQueryValueKey 0x10034434
NtReadFile 0x1003431c
NtSetInformationFile 0x1003434c
NtSetInformationThread 0x10034320
NtTranslateFilePath 0x10034440
NtWaitForSingleObject 0x10034338
NtWriteFile 0x1003445c
RtlAddAccessAllowedAceEx 0x100343a4
RtlAllocateAndInitializeSid 0x100343a8
RtlAllocateHeap 0x10034360
RtlAppendUnicodeToString 0x1003436c
RtlCompareMemory 0x10034358
RtlCreateAcl 0x100343cc
RtlCreateSecurityDescriptor 0x100343d8
RtlFreeHeap 0x10034354
RtlFreeSid 0x100343bc
RtlFreeUnicodeString 0x10034348
RtlGetVersion 0x100343f8
RtlGUIDFromString 0x10034368
RtlImageNtHeader 0x10034328
RtlImpersonateSelf 0x10034424
RtlInitAnsiString 0x1003440c
RtlInitUnicodeString 0x100343b0
RtlLengthSecurityDescriptor 0x1003438c
RtlLengthSid 0x100343ac
RtlNtStatusToDosError 0x10034310
RtlSetDaclSecurityDescriptor 0x10034394
RtlSetOwnerSecurityDescriptor 0x10034390
RtlStringFromGUID 0x10034350
ZwAllocateUuids 0x100343e4
ZwClose 0x10034388
ZwCreateFile 0x10034398
ZwCreateKey 0x1003439c
ZwDeleteKey 0x100343c0
ZwDeleteValueKey 0x100343b4
ZwDeviceIoControlFile 0x100343ec
ZwEnumerateKey 0x100343c4
ZwFlushKey 0x10034454
ZwLoadKey 0x100343a0
ZwOpenDirectoryObject 0x100343fc
ZwOpenFile 0x10034380
ZwOpenKey 0x100343e0
ZwOpenMutant 0x10034384
ZwOpenProcess 0x10034414
ZwOpenSymbolicLinkObject 0x100343f4
ZwQueryAttributesFile 0x10034370
ZwQueryDirectoryObject 0x100343f0
ZwQueryInformationFile 0x10034410
ZwQueryInformationProcess 0x10034408
ZwQueryKey 0x10034378
ZwQuerySymbolicLinkObject 0x100343e8
ZwQuerySystemInformation 0x10034364
ZwQueryValueKey 0x100343c8
ZwReleaseMutant 0x1003437c
ZwSaveKey 0x100343b8
ZwSetSecurityObject 0x100343d0
ZwSetValueKey 0x100343dc
ZwUnloadKey 0x100343d4
ZwWaitForSingleObject 0x10034374
RPCRT4.dll 1
UuidCreate 0x100340cc
SHLWAPI.dll 1
PathRemoveBackslashW 0x100340d4
WCP.dll 5
?RtlGetFacilityTracingFlags@Rtl@WCP@Windows@@YIKPAU_RTL_TRACING_FACILITY@123@@Z 0x100340e8
?RtlTraceFormat_PCWSTR@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z 0x100340ec
?RtlTraceVa@Rtl@WCP@Windows@@YIXKKPAU_RTL_TRACING_FACILITY@123@QBDKPAD@Z 0x100340dc
RtlFreeLUnicodeString 0x100340e4
RtlReportErrorOrigination 0x100340e0
WINTRUST.dll 3
WinVerifyTrust 0x100340fc
WTHelperGetProvSignerFromChain 0x100340f8
WTHelperProvDataFromStateData 0x100340f4