bfsvc.dll

v10.0.19041.6151 32-bit Windows NT Analyzed
Download
Description
CMI boot file service plug-in
Authors
© Microsoft Corporation. All rights reserved.
File size
233.9 KB
Uploaded
2025-12-01 08:40
Views
29
SHA-256
41f0429f24fc9e0b3c3ab8c3e96839ab

Exported functions 2

DllCanUnloadNow #1 · 0x18dd0
DllCsiGetHandler #2 · 0x18df0

Imported DLLs & functions 255

ADVAPI32.dll 15
AdjustTokenPrivileges 0x10035018
ConvertSidToStringSidW 0x10035028
ConvertStringSecurityDescriptorToSecurityDescriptorW 0x10035024
DuplicateTokenEx 0x1003500c
GetSecurityDescriptorControl 0x10035030
GetSecurityDescriptorDacl 0x10035038
GetSecurityDescriptorGroup 0x10035004
GetSecurityDescriptorOwner 0x1003502c
GetSecurityDescriptorSacl 0x10035000
GetTokenInformation 0x10035020
LookupPrivilegeValueW 0x1003501c
OpenProcessToken 0x10035014
OpenThreadToken 0x10035008
SetNamedSecurityInfoW 0x10035034
SetThreadToken 0x10035010
api-ms-win-core-debug-l1-1-0.dll 3
DebugBreak 0x10035104
IsDebuggerPresent 0x10035108
OutputDebugStringW 0x1003510c
api-ms-win-core-errorhandling-l1-1-0.dll 4
GetLastError 0x10035114
SetLastError 0x1003511c
SetUnhandledExceptionFilter 0x10035120
UnhandledExceptionFilter 0x10035118
api-ms-win-core-handle-l1-1-0.dll 1
CloseHandle 0x10035128
api-ms-win-core-heap-l1-1-0.dll 4
GetProcessHeap 0x10035134
HeapAlloc 0x10035130
HeapDestroy 0x1003513c
HeapFree 0x10035138
api-ms-win-core-libraryloader-l1-1-0.dll 8
DisableThreadLibraryCalls 0x10035148
FindResourceExW 0x10035150
FreeLibrary 0x10035154
GetModuleFileNameA 0x1003514c
GetModuleHandleExW 0x10035158
GetModuleHandleW 0x10035144
GetProcAddress 0x10035160
LoadResource 0x1003515c
api-ms-win-core-localization-l1-2-0.dll 1
FormatMessageW 0x10035168
api-ms-win-core-localization-obsolete-l1-2-0.dll 2
GetSystemDefaultUILanguage 0x10035174
GetUserDefaultUILanguage 0x10035170
api-ms-win-core-processenvironment-l1-1-0.dll 1
SearchPathW 0x1003517c
api-ms-win-core-processthreads-l1-1-0.dll 4
GetCurrentProcess 0x10035188
GetCurrentProcessId 0x10035190
GetCurrentThreadId 0x10035184
TerminateProcess 0x1003518c
api-ms-win-core-profile-l1-1-0.dll 1
QueryPerformanceCounter 0x10035198
api-ms-win-core-registry-l1-1-0.dll 5
RegCloseKey 0x100351b0
RegCreateKeyExW 0x100351a0
RegOpenKeyExW 0x100351ac
RegQueryValueExW 0x100351a4
RegSetValueExW 0x100351a8
api-ms-win-core-synch-l1-1-0.dll 16
AcquireSRWLockExclusive 0x100351d8
AcquireSRWLockShared 0x100351d0
CreateMutexExW 0x100351f4
CreateSemaphoreExW 0x100351c8
DeleteCriticalSection 0x100351e0
EnterCriticalSection 0x100351e8
InitializeCriticalSection 0x100351f0
InitializeCriticalSectionEx 0x100351ec
LeaveCriticalSection 0x100351c4
OpenSemaphoreW 0x100351b8
ReleaseMutex 0x100351bc
ReleaseSemaphore 0x100351c0
ReleaseSRWLockExclusive 0x100351d4
ReleaseSRWLockShared 0x100351cc
WaitForSingleObject 0x100351dc
WaitForSingleObjectEx 0x100351e4
api-ms-win-core-synch-l1-2-0.dll 1
Sleep 0x100351fc
api-ms-win-core-sysinfo-l1-1-0.dll 3
GetSystemTimeAsFileTime 0x1003520c
GetTickCount 0x10035208
GetVersionExW 0x10035204
api-ms-win-core-threadpool-l1-2-0.dll 4
CloseThreadpoolTimer 0x10035218
CreateThreadpoolTimer 0x10035214
SetThreadpoolTimer 0x10035220
WaitForThreadpoolTimerCallbacks 0x1003521c
api-ms-win-eventing-provider-l1-1-0.dll 3
EventRegister 0x1003522c
EventUnregister 0x10035230
EventWriteTransfer 0x10035228
bcrypt.dll 7
BCryptCloseAlgorithmProvider 0x1003523c
BCryptCreateHash 0x10035240
BCryptDestroyHash 0x10035244
BCryptFinishHash 0x10035248
BCryptHash 0x1003524c
BCryptHashData 0x10035238
BCryptOpenAlgorithmProvider 0x10035250
CRYPT32.dll 1
CertGetNameStringW 0x10035040
imagehlp.dll 1
CheckSumMappedFile 0x10035258
KERNEL32.dll 32
CopyFileExW 0x10035048
CreateDirectoryW 0x100350bc
CreateFileMappingW 0x10035068
CreateFileW 0x10035094
DeleteFileW 0x1003504c
DeviceIoControl 0x10035070
FindClose 0x1003509c
FindFirstFileW 0x100350ac
FindNextFileW 0x100350a8
FlushFileBuffers 0x10035060
GetCurrentThread 0x100350c0
GetFileAttributesW 0x10035090
GetFileInformationByHandle 0x10035054
GetFileInformationByHandleEx 0x10035058
GetFileSizeEx 0x10035074
GetFullPathNameW 0x100350c4
GetLocaleInfoW 0x1003505c
GetPrivateProfileSectionW 0x100350a0
GetVolumeInformationW 0x100350b0
GetVolumeNameForVolumeMountPointW 0x1003508c
GetVolumePathNameW 0x10035098
LoadLibraryExW 0x100350b8
LoadLibraryW 0x10035080
LocalAlloc 0x1003507c
LocalFree 0x10035078
MapViewOfFile 0x10035064
MoveFileExW 0x10035084
QueryDosDeviceW 0x100350b4
SetFileAttributesW 0x10035088
SetFileInformationByHandle 0x10035050
UnmapViewOfFile 0x1003506c
WriteFile 0x100350a4
msvcrt.dll 44
__dllonexit 0x100352e8
__iob_func 0x100352f8
_amsg_exit 0x1003527c
_callnewh 0x10035260
_except_handler4_common 0x100352f0
_initterm 0x10035280
_lock 0x10035284
_onexit 0x100352ec
_purecall 0x1003526c
_snwscanf_s 0x100352d0
_ultow_s 0x100352c0
_unlock 0x100352e4
_vsnwprintf 0x10035278
_vsnwprintf_s 0x10035294
_wcsicmp 0x1003529c
_wcslwr 0x100352d4
_wcsnicmp 0x100352a0
_wcsupr 0x100352bc
_wfopen_s 0x1003528c
_XcptFilter 0x10035264
bsearch 0x100352e0
fclose 0x10035290
fflush 0x10035288
free 0x10035268
fwprintf 0x10035298
malloc 0x10035300
memcmp 0x10035304
memcpy 0x10035308
memcpy_s 0x100352fc
memmove 0x100352f4
memmove_s 0x10035274
memset 0x1003530c
strcpy_s 0x100352c8
strncmp 0x100352dc
swprintf_s 0x100352b8
wcscat_s 0x100352ac
wcschr 0x100352b4
wcscpy_s 0x100352a8
wcsncmp 0x100352a4
wcsncpy_s 0x100352b0
wcsnlen 0x100352d8
wcsrchr 0x10035270
wcsstr 0x100352cc
wcstoul 0x100352c4
ntdll.dll 84
LdrAccessResource 0x1003534c
LdrFindResource_U 0x10035348
LdrGetDllHandle 0x10035408
LdrGetProcedureAddress 0x10035404
NtAdjustPrivilegesToken 0x1003541c
NtClose 0x1003545c
NtCreateEvent 0x10035334
NtDeviceIoControlFile 0x1003532c
NtEnumerateBootEntries 0x10035450
NtOpenDirectoryObject 0x10035448
NtOpenFile 0x10035344
NtOpenKey 0x10035430
NtOpenProcess 0x10035320
NtOpenProcessTokenEx 0x10035420
NtOpenSymbolicLinkObject 0x1003542c
NtOpenThreadTokenEx 0x10035424
NtQueryBootEntryOrder 0x1003543c
NtQueryBootOptions 0x10035440
NtQueryDirectoryObject 0x1003544c
NtQueryInformationFile 0x10035338
NtQueryInformationProcess 0x1003531c
NtQueryInformationThread 0x1003533c
NtQuerySymbolicLinkObject 0x10035434
NtQuerySystemEnvironmentValueEx 0x100353b4
NtQuerySystemInformation 0x10035458
NtQueryValueKey 0x10035438
NtReadFile 0x10035324
NtSetInformationFile 0x10035354
NtSetInformationThread 0x10035328
NtTranslateFilePath 0x10035444
NtWaitForSingleObject 0x10035340
NtWriteFile 0x10035314
RtlAddAccessAllowedAceEx 0x100353a8
RtlAllocateAndInitializeSid 0x100353ac
RtlAllocateHeap 0x10035364
RtlAppendUnicodeToString 0x10035370
RtlCompareMemory 0x10035360
RtlCreateAcl 0x100353d0
RtlCreateSecurityDescriptor 0x100353dc
RtlFreeHeap 0x1003535c
RtlFreeSid 0x100353c0
RtlFreeUnicodeString 0x10035350
RtlGetVersion 0x100353fc
RtlGUIDFromString 0x1003536c
RtlImageNtHeader 0x10035330
RtlImpersonateSelf 0x10035428
RtlInitAnsiString 0x10035410
RtlInitUnicodeString 0x10035460
RtlLengthSecurityDescriptor 0x10035390
RtlLengthSid 0x100353b0
RtlNtStatusToDosError 0x10035318
RtlSetDaclSecurityDescriptor 0x10035398
RtlSetOwnerSecurityDescriptor 0x10035394
RtlStringFromGUID 0x10035358
ZwAllocateUuids 0x100353e8
ZwClose 0x1003538c
ZwCreateFile 0x1003539c
ZwCreateKey 0x100353a0
ZwDeleteKey 0x100353c4
ZwDeleteValueKey 0x100353b8
ZwDeviceIoControlFile 0x100353f0
ZwEnumerateKey 0x100353c8
ZwFlushKey 0x10035454
ZwLoadKey 0x100353a4
ZwOpenDirectoryObject 0x10035400
ZwOpenFile 0x10035384
ZwOpenKey 0x100353e4
ZwOpenMutant 0x10035388
ZwOpenProcess 0x10035418
ZwOpenSymbolicLinkObject 0x100353f8
ZwQueryAttributesFile 0x10035374
ZwQueryDirectoryObject 0x100353f4
ZwQueryInformationFile 0x10035414
ZwQueryInformationProcess 0x1003540c
ZwQueryKey 0x1003537c
ZwQuerySymbolicLinkObject 0x100353ec
ZwQuerySystemInformation 0x10035368
ZwQueryValueKey 0x100353cc
ZwReleaseMutant 0x10035380
ZwSaveKey 0x100353bc
ZwSetSecurityObject 0x100353d4
ZwSetValueKey 0x100353e0
ZwUnloadKey 0x100353d8
ZwWaitForSingleObject 0x10035378
RPCRT4.dll 1
UuidCreate 0x100350cc
SHLWAPI.dll 1
PathRemoveBackslashW 0x100350d4
WCP.dll 5
?RtlGetFacilityTracingFlags@Rtl@WCP@Windows@@YIKPAU_RTL_TRACING_FACILITY@123@@Z 0x100350e8
?RtlTraceFormat_PCWSTR@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z 0x100350ec
?RtlTraceVa@Rtl@WCP@Windows@@YIXKKPAU_RTL_TRACING_FACILITY@123@QBDKPAD@Z 0x100350dc
RtlFreeLUnicodeString 0x100350e4
RtlReportErrorOrigination 0x100350e0
WINTRUST.dll 3
WinVerifyTrust 0x100350f4
WTHelperGetProvSignerFromChain 0x100350fc
WTHelperProvDataFromStateData 0x100350f8