WofUtil.dll

Description: Windows Overlay File System Filter user mode API

Version: 10.0.19041.5438

Architecture: 32-bit

Operating System: Windows NT

SHA256: ba59d345510f5c0359963a2a842abcf8

File Size: 28.5 KB

Uploaded At: Dec. 1, 2025, 8:08 a.m.

Views: 12

Exported Functions

WofEnumEntries (Ordinal: 1, Address: 0x23f0)
WofFileEnumFiles (Ordinal: 2, Address: 0x2e70)
WofGetDriverVersion (Ordinal: 3, Address: 0x2800)
WofIsExternalFile (Ordinal: 4, Address: 0x2770)
WofSetFileDataLocation (Ordinal: 5, Address: 0x2620)
WofShouldCompressBinaries (Ordinal: 6, Address: 0x48b0)
WofWimAddEntry (Ordinal: 7, Address: 0x1f90)
WofWimEnumFiles (Ordinal: 8, Address: 0x2e40)
WofWimRemoveEntry (Ordinal: 9, Address: 0x2330)
WofWimSuspendEntry (Ordinal: 10, Address: 0x2270)
WofWimUpdateEntry (Ordinal: 11, Address: 0x2130)

Imported DLLs & Functions

api-ms-win-core-errorhandling-l1-1-0.dll

GetLastError (Address: 0x10008008)
SetLastError (Address: 0x1000800c)
SetUnhandledExceptionFilter (Address: 0x10008004)
UnhandledExceptionFilter (Address: 0x10008000)

api-ms-win-core-file-l1-1-0.dll

CreateFileW (Address: 0x10008014)
FindClose (Address: 0x10008020)
GetDriveTypeW (Address: 0x1000801c)
GetFinalPathNameByHandleW (Address: 0x10008018)
GetVolumePathNameW (Address: 0x10008024)

api-ms-win-core-file-l1-2-0.dll

GetVolumeNameForVolumeMountPointW (Address: 0x1000802c)
GetVolumePathNamesForVolumeNameW (Address: 0x10008030)

api-ms-win-core-handle-l1-1-0.dll

CloseHandle (Address: 0x10008038)

api-ms-win-core-heap-l1-1-0.dll

GetProcessHeap (Address: 0x10008040)
HeapAlloc (Address: 0x10008044)
HeapFree (Address: 0x10008048)

api-ms-win-core-io-l1-1-0.dll

DeviceIoControl (Address: 0x10008054)
GetOverlappedResult (Address: 0x10008050)

api-ms-win-core-kernel32-legacy-l1-1-0.dll

LoadLibraryW (Address: 0x1000805c)

api-ms-win-core-kernel32-legacy-l1-1-1.dll

PowerCreateRequest (Address: 0x10008064)

api-ms-win-core-libraryloader-l1-2-0.dll

FreeLibrary (Address: 0x10008070)
GetModuleHandleW (Address: 0x1000806c)
GetProcAddress (Address: 0x10008074)

api-ms-win-core-processthreads-l1-1-0.dll

CreateThread (Address: 0x1000807c)
GetCurrentProcess (Address: 0x10008088)
GetCurrentProcessId (Address: 0x10008090)
GetCurrentThread (Address: 0x1000808c)
GetCurrentThreadId (Address: 0x10008094)
OpenThreadToken (Address: 0x10008080)
TerminateProcess (Address: 0x10008084)

api-ms-win-core-profile-l1-1-0.dll

QueryPerformanceCounter (Address: 0x100080a0)
QueryPerformanceFrequency (Address: 0x1000809c)

api-ms-win-core-psapi-l1-1-0.dll

K32GetPerformanceInfo (Address: 0x100080a8)

api-ms-win-core-registry-l1-1-0.dll

RegCloseKey (Address: 0x100080bc)
RegCreateKeyExW (Address: 0x100080c0)
RegOpenKeyExW (Address: 0x100080b4)
RegQueryValueExW (Address: 0x100080b0)
RegSetValueExW (Address: 0x100080b8)

api-ms-win-core-synch-l1-1-0.dll

CreateEventW (Address: 0x100080d4)
CreateMutexW (Address: 0x100080d8)
ReleaseMutex (Address: 0x100080c8)
SetEvent (Address: 0x100080cc)
WaitForSingleObject (Address: 0x100080d0)

api-ms-win-core-synch-l1-2-0.dll

Sleep (Address: 0x100080e0)

api-ms-win-core-sysinfo-l1-1-0.dll

GetSystemTimeAsFileTime (Address: 0x100080ec)
GetTickCount (Address: 0x100080e8)
GetVersionExW (Address: 0x100080f0)

api-ms-win-core-sysinfo-l1-2-0.dll

GetNativeSystemInfo (Address: 0x100080f8)

api-ms-win-security-base-l1-1-0.dll

ImpersonateLoggedOnUser (Address: 0x10008104)
RevertToSelf (Address: 0x10008100)

msvcrt.dll

_amsg_exit (Address: 0x1000812c)
_except_handler4_common (Address: 0x10008124)
_initterm (Address: 0x10008118)
_vsnwprintf (Address: 0x10008120)
_XcptFilter (Address: 0x1000810c)
free (Address: 0x10008110)
malloc (Address: 0x10008128)
memcpy (Address: 0x10008114)
memset (Address: 0x10008134)
printf (Address: 0x10008130)
wcschr (Address: 0x1000811c)

ntdll.dll

NtClose (Address: 0x1000813c)
NtCreateFile (Address: 0x10008174)
NtPowerInformation (Address: 0x10008158)
NtQueryInformationFile (Address: 0x10008178)
NtQueryVolumeInformationFile (Address: 0x10008144)
NtSetInformationThread (Address: 0x10008164)
RtlAcquirePrivilege (Address: 0x10008154)
RtlAllocateHeap (Address: 0x10008170)
RtlCompressBuffer (Address: 0x10008150)
RtlDecompressBufferEx (Address: 0x1000814c)
RtlDosPathNameToNtPathName_U (Address: 0x10008140)
RtlDosPathNameToNtPathName_U_WithStatus (Address: 0x10008180)
RtlFreeHeap (Address: 0x10008148)
RtlGetCompressionWorkSpaceSize (Address: 0x10008184)
RtlGetNtProductType (Address: 0x10008160)
RtlGetPersistedStateLocation (Address: 0x10008168)
RtlInitializeCriticalSection (Address: 0x1000815c)
RtlNtStatusToDosError (Address: 0x1000817c)
RtlRandom (Address: 0x1000816c)