bfsvc.dll

v10.0.19041.6465 32-bit Windows NT Analyzed
Download
Description
CMI boot file service plug-in
Authors
© Microsoft Corporation. All rights reserved.
File size
229.4 KB
Uploaded
2025-12-01 08:40
Views
26
SHA-256
108e152ddcafafe8d7f4c7bee4811c6d

Exported functions 2

DllCanUnloadNow #1 · 0x17c20
DllCsiGetHandler #2 · 0x17c40

Imported DLLs & functions 255

ADVAPI32.dll 15
AdjustTokenPrivileges 0x10034018
ConvertSidToStringSidW 0x10034028
ConvertStringSecurityDescriptorToSecurityDescriptorW 0x10034024
DuplicateTokenEx 0x1003400c
GetSecurityDescriptorControl 0x10034030
GetSecurityDescriptorDacl 0x10034038
GetSecurityDescriptorGroup 0x10034004
GetSecurityDescriptorOwner 0x1003402c
GetSecurityDescriptorSacl 0x10034000
GetTokenInformation 0x10034020
LookupPrivilegeValueW 0x1003401c
OpenProcessToken 0x10034014
OpenThreadToken 0x10034008
SetNamedSecurityInfoW 0x10034034
SetThreadToken 0x10034010
api-ms-win-core-debug-l1-1-0.dll 3
DebugBreak 0x10034104
IsDebuggerPresent 0x10034108
OutputDebugStringW 0x1003410c
api-ms-win-core-errorhandling-l1-1-0.dll 4
GetLastError 0x10034114
SetLastError 0x1003411c
SetUnhandledExceptionFilter 0x10034120
UnhandledExceptionFilter 0x10034118
api-ms-win-core-handle-l1-1-0.dll 1
CloseHandle 0x10034128
api-ms-win-core-heap-l1-1-0.dll 4
GetProcessHeap 0x10034134
HeapAlloc 0x10034130
HeapDestroy 0x1003413c
HeapFree 0x10034138
api-ms-win-core-libraryloader-l1-1-0.dll 8
DisableThreadLibraryCalls 0x10034148
FindResourceExW 0x10034150
FreeLibrary 0x10034154
GetModuleFileNameA 0x1003414c
GetModuleHandleExW 0x10034158
GetModuleHandleW 0x10034144
GetProcAddress 0x10034160
LoadResource 0x1003415c
api-ms-win-core-localization-l1-2-0.dll 1
FormatMessageW 0x10034168
api-ms-win-core-localization-obsolete-l1-2-0.dll 2
GetSystemDefaultUILanguage 0x10034174
GetUserDefaultUILanguage 0x10034170
api-ms-win-core-processenvironment-l1-1-0.dll 1
SearchPathW 0x1003417c
api-ms-win-core-processthreads-l1-1-0.dll 4
GetCurrentProcess 0x10034188
GetCurrentProcessId 0x10034190
GetCurrentThreadId 0x10034184
TerminateProcess 0x1003418c
api-ms-win-core-profile-l1-1-0.dll 1
QueryPerformanceCounter 0x10034198
api-ms-win-core-registry-l1-1-0.dll 5
RegCloseKey 0x100341b0
RegCreateKeyExW 0x100341a0
RegOpenKeyExW 0x100341ac
RegQueryValueExW 0x100341a4
RegSetValueExW 0x100341a8
api-ms-win-core-synch-l1-1-0.dll 16
AcquireSRWLockExclusive 0x100341d8
AcquireSRWLockShared 0x100341d0
CreateMutexExW 0x100341f4
CreateSemaphoreExW 0x100341c8
DeleteCriticalSection 0x100341e0
EnterCriticalSection 0x100341e8
InitializeCriticalSection 0x100341f0
InitializeCriticalSectionEx 0x100341ec
LeaveCriticalSection 0x100341c4
OpenSemaphoreW 0x100341b8
ReleaseMutex 0x100341bc
ReleaseSemaphore 0x100341c0
ReleaseSRWLockExclusive 0x100341d4
ReleaseSRWLockShared 0x100341cc
WaitForSingleObject 0x100341dc
WaitForSingleObjectEx 0x100341e4
api-ms-win-core-synch-l1-2-0.dll 1
Sleep 0x100341fc
api-ms-win-core-sysinfo-l1-1-0.dll 3
GetSystemTimeAsFileTime 0x1003420c
GetTickCount 0x10034208
GetVersionExW 0x10034204
api-ms-win-core-threadpool-l1-2-0.dll 4
CloseThreadpoolTimer 0x10034218
CreateThreadpoolTimer 0x10034214
SetThreadpoolTimer 0x10034220
WaitForThreadpoolTimerCallbacks 0x1003421c
api-ms-win-eventing-provider-l1-1-0.dll 3
EventRegister 0x1003422c
EventUnregister 0x10034230
EventWriteTransfer 0x10034228
bcrypt.dll 7
BCryptCloseAlgorithmProvider 0x1003423c
BCryptCreateHash 0x10034240
BCryptDestroyHash 0x10034244
BCryptFinishHash 0x10034248
BCryptHash 0x1003424c
BCryptHashData 0x10034238
BCryptOpenAlgorithmProvider 0x10034250
CRYPT32.dll 1
CertGetNameStringW 0x10034040
imagehlp.dll 1
CheckSumMappedFile 0x10034258
KERNEL32.dll 32
CopyFileExW 0x10034048
CreateDirectoryW 0x100340bc
CreateFileMappingW 0x10034068
CreateFileW 0x10034094
DeleteFileW 0x1003404c
DeviceIoControl 0x10034070
FindClose 0x1003409c
FindFirstFileW 0x100340ac
FindNextFileW 0x100340a8
FlushFileBuffers 0x10034060
GetCurrentThread 0x100340c0
GetFileAttributesW 0x10034090
GetFileInformationByHandle 0x10034054
GetFileInformationByHandleEx 0x10034058
GetFileSizeEx 0x10034074
GetFullPathNameW 0x100340c4
GetLocaleInfoW 0x1003405c
GetPrivateProfileSectionW 0x100340a0
GetVolumeInformationW 0x100340b0
GetVolumeNameForVolumeMountPointW 0x1003408c
GetVolumePathNameW 0x10034098
LoadLibraryExW 0x100340b8
LoadLibraryW 0x10034080
LocalAlloc 0x1003407c
LocalFree 0x10034078
MapViewOfFile 0x10034064
MoveFileExW 0x10034084
QueryDosDeviceW 0x100340b4
SetFileAttributesW 0x10034088
SetFileInformationByHandle 0x10034050
UnmapViewOfFile 0x1003406c
WriteFile 0x100340a4
msvcrt.dll 44
__dllonexit 0x100342e8
__iob_func 0x100342f8
_amsg_exit 0x1003427c
_callnewh 0x10034260
_except_handler4_common 0x100342f0
_initterm 0x10034280
_lock 0x10034284
_onexit 0x100342ec
_purecall 0x1003426c
_snwscanf_s 0x100342d0
_ultow_s 0x100342c0
_unlock 0x100342e4
_vsnwprintf 0x10034278
_vsnwprintf_s 0x10034294
_wcsicmp 0x1003429c
_wcslwr 0x100342d4
_wcsnicmp 0x100342a0
_wcsupr 0x100342bc
_wfopen_s 0x1003428c
_XcptFilter 0x10034264
bsearch 0x100342e0
fclose 0x10034290
fflush 0x10034288
free 0x10034268
fwprintf 0x10034298
malloc 0x10034300
memcmp 0x10034304
memcpy 0x10034308
memcpy_s 0x100342fc
memmove 0x100342f4
memmove_s 0x10034274
memset 0x1003430c
strcpy_s 0x100342c8
strncmp 0x100342dc
swprintf_s 0x100342b8
wcscat_s 0x100342ac
wcschr 0x100342b4
wcscpy_s 0x100342a8
wcsncmp 0x100342a4
wcsncpy_s 0x100342b0
wcsnlen 0x100342d8
wcsrchr 0x10034270
wcsstr 0x100342cc
wcstoul 0x100342c4
ntdll.dll 84
LdrAccessResource 0x1003434c
LdrFindResource_U 0x10034348
LdrGetDllHandle 0x10034408
LdrGetProcedureAddress 0x10034404
NtAdjustPrivilegesToken 0x1003441c
NtClose 0x1003445c
NtCreateEvent 0x10034334
NtDeviceIoControlFile 0x1003432c
NtEnumerateBootEntries 0x10034450
NtOpenDirectoryObject 0x10034448
NtOpenFile 0x10034344
NtOpenKey 0x10034430
NtOpenProcess 0x10034320
NtOpenProcessTokenEx 0x10034420
NtOpenSymbolicLinkObject 0x1003442c
NtOpenThreadTokenEx 0x10034424
NtQueryBootEntryOrder 0x1003443c
NtQueryBootOptions 0x10034440
NtQueryDirectoryObject 0x1003444c
NtQueryInformationFile 0x10034338
NtQueryInformationProcess 0x1003431c
NtQueryInformationThread 0x1003433c
NtQuerySymbolicLinkObject 0x10034434
NtQuerySystemEnvironmentValueEx 0x100343b4
NtQuerySystemInformation 0x10034458
NtQueryValueKey 0x10034438
NtReadFile 0x10034324
NtSetInformationFile 0x10034354
NtSetInformationThread 0x10034328
NtTranslateFilePath 0x10034444
NtWaitForSingleObject 0x10034340
NtWriteFile 0x10034314
RtlAddAccessAllowedAceEx 0x100343a8
RtlAllocateAndInitializeSid 0x100343ac
RtlAllocateHeap 0x10034364
RtlAppendUnicodeToString 0x10034370
RtlCompareMemory 0x10034360
RtlCreateAcl 0x100343d0
RtlCreateSecurityDescriptor 0x100343dc
RtlFreeHeap 0x1003435c
RtlFreeSid 0x100343c0
RtlFreeUnicodeString 0x10034350
RtlGetVersion 0x100343fc
RtlGUIDFromString 0x1003436c
RtlImageNtHeader 0x10034330
RtlImpersonateSelf 0x10034428
RtlInitAnsiString 0x10034410
RtlInitUnicodeString 0x10034460
RtlLengthSecurityDescriptor 0x10034390
RtlLengthSid 0x100343b0
RtlNtStatusToDosError 0x10034318
RtlSetDaclSecurityDescriptor 0x10034398
RtlSetOwnerSecurityDescriptor 0x10034394
RtlStringFromGUID 0x10034358
ZwAllocateUuids 0x100343e8
ZwClose 0x1003438c
ZwCreateFile 0x1003439c
ZwCreateKey 0x100343a0
ZwDeleteKey 0x100343c4
ZwDeleteValueKey 0x100343b8
ZwDeviceIoControlFile 0x100343f0
ZwEnumerateKey 0x100343c8
ZwFlushKey 0x10034454
ZwLoadKey 0x100343a4
ZwOpenDirectoryObject 0x10034400
ZwOpenFile 0x10034384
ZwOpenKey 0x100343e4
ZwOpenMutant 0x10034388
ZwOpenProcess 0x10034418
ZwOpenSymbolicLinkObject 0x100343f8
ZwQueryAttributesFile 0x10034374
ZwQueryDirectoryObject 0x100343f4
ZwQueryInformationFile 0x10034414
ZwQueryInformationProcess 0x1003440c
ZwQueryKey 0x1003437c
ZwQuerySymbolicLinkObject 0x100343ec
ZwQuerySystemInformation 0x10034368
ZwQueryValueKey 0x100343cc
ZwReleaseMutant 0x10034380
ZwSaveKey 0x100343bc
ZwSetSecurityObject 0x100343d4
ZwSetValueKey 0x100343e0
ZwUnloadKey 0x100343d8
ZwWaitForSingleObject 0x10034378
RPCRT4.dll 1
UuidCreate 0x100340cc
SHLWAPI.dll 1
PathRemoveBackslashW 0x100340d4
WCP.dll 5
?RtlGetFacilityTracingFlags@Rtl@WCP@Windows@@YIKPAU_RTL_TRACING_FACILITY@123@@Z 0x100340e8
?RtlTraceFormat_PCWSTR@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z 0x100340ec
?RtlTraceVa@Rtl@WCP@Windows@@YIXKKPAU_RTL_TRACING_FACILITY@123@QBDKPAD@Z 0x100340dc
RtlFreeLUnicodeString 0x100340e4
RtlReportErrorOrigination 0x100340e0
WINTRUST.dll 3
WinVerifyTrust 0x100340f4
WTHelperGetProvSignerFromChain 0x100340fc
WTHelperProvDataFromStateData 0x100340f8