efssvc.dll

v10.0.19041.6328 64-bit Windows NT Analyzed
Download
Description
EFS Service
Authors
© Microsoft Corporation. All rights reserved.
File size
89.5 KB
Uploaded
2025-12-01 07:27
Views
96
SHA-256
88732fb0734f9eaa2c20038a69ae7bdb

Exported functions 1

EfsServiceMain #1 · 0x2370

Imported DLLs & functions 117

api-ms-win-core-debug-l1-1-0.dll 3
DebugBreak 0x18000fe28
IsDebuggerPresent 0x18000fe20
OutputDebugStringW 0x18000fe18
api-ms-win-core-errorhandling-l1-1-0.dll 5
GetLastError 0x18000fe40
RaiseException 0x18000fe38
SetLastError 0x18000fe50
SetUnhandledExceptionFilter 0x18000fe48
UnhandledExceptionFilter 0x18000fe58
api-ms-win-core-featurestaging-l1-1-0.dll 3
RecordFeatureUsage 0x18000fe78
SubscribeFeatureStateChangeNotification 0x18000fe70
UnsubscribeFeatureStateChangeNotification 0x18000fe68
api-ms-win-core-file-l1-1-0.dll 2
CreateFileW 0x18000fe88
GetFileAttributesW 0x18000fe90
api-ms-win-core-handle-l1-1-0.dll 1
CloseHandle 0x18000fea0
api-ms-win-core-heap-l1-1-0.dll 3
GetProcessHeap 0x18000feb8
HeapAlloc 0x18000feb0
HeapFree 0x18000fec0
api-ms-win-core-heap-l2-1-0.dll 1
LocalFree 0x18000fed0
api-ms-win-core-libraryloader-l1-2-0.dll 6
FreeLibrary 0x18000fee8
GetModuleFileNameA 0x18000fee0
GetModuleHandleExW 0x18000ff00
GetModuleHandleW 0x18000fef8
GetProcAddress 0x18000ff08
LoadLibraryExA 0x18000fef0
api-ms-win-core-localization-l1-2-0.dll 1
FormatMessageW 0x18000ff18
api-ms-win-core-memory-l1-1-0.dll 2
VirtualProtect 0x18000ff28
VirtualQuery 0x18000ff30
api-ms-win-core-processthreads-l1-1-0.dll 5
GetCurrentProcess 0x18000ff40
GetCurrentProcessId 0x18000ff60
GetCurrentThreadId 0x18000ff48
OpenProcessToken 0x18000ff58
TerminateProcess 0x18000ff50
api-ms-win-core-profile-l1-1-0.dll 1
QueryPerformanceCounter 0x18000ff70
api-ms-win-core-registry-l1-1-0.dll 1
RegGetValueW 0x18000ff80
api-ms-win-core-rtlsupport-l1-1-0.dll 3
RtlCaptureContext 0x18000ffa0
RtlLookupFunctionEntry 0x18000ff98
RtlVirtualUnwind 0x18000ff90
api-ms-win-core-synch-l1-1-0.dll 11
AcquireSRWLockExclusive 0x18000ffd8
CreateEventW 0x18000ffd0
CreateMutexExW 0x180010000
CreateSemaphoreExW 0x18000ffb0
OpenSemaphoreW 0x18000fff8
ReleaseMutex 0x18000fff0
ReleaseSemaphore 0x18000ffe8
ReleaseSRWLockExclusive 0x18000ffc0
SetEvent 0x18000ffc8
WaitForSingleObject 0x18000ffe0
WaitForSingleObjectEx 0x18000ffb8
api-ms-win-core-synch-l1-2-0.dll 3
InitOnceBeginInitialize 0x180010020
InitOnceComplete 0x180010018
Sleep 0x180010010
api-ms-win-core-sysinfo-l1-1-0.dll 3
GetSystemInfo 0x180010030
GetSystemTimeAsFileTime 0x180010040
GetTickCount 0x180010038
api-ms-win-eventing-provider-l1-1-0.dll 4
EventRegister 0x180010060
EventSetInformation 0x180010050
EventUnregister 0x180010068
EventWriteTransfer 0x180010058
api-ms-win-security-base-l1-1-0.dll 6
CheckTokenMembership 0x180010098
CreateWellKnownSid 0x180010078
GetSidSubAuthority 0x180010090
GetSidSubAuthorityCount 0x1800100a0
GetTokenInformation 0x180010080
IsWellKnownSid 0x180010088
api-ms-win-security-sddl-l1-1-0.dll 1
ConvertStringSecurityDescriptorToSecurityDescriptorW 0x1800100b0
api-ms-win-service-core-l1-1-0.dll 2
RegisterServiceCtrlHandlerExW 0x1800100c0
SetServiceStatus 0x1800100c8
msvcrt.dll 16
__C_specific_handler 0x180010120
__dllonexit 0x180010108
_amsg_exit 0x180010130
_callnewh 0x180010148
_initterm 0x180010128
_lock 0x180010118
_onexit 0x180010100
_unlock 0x180010110
_vsnwprintf 0x1800100e0
_wcsicmp 0x1800100e8
_XcptFilter 0x180010138
free 0x180010140
malloc 0x180010150
memcpy 0x1800100f8
memcpy_s 0x1800100f0
memset 0x1800100d8
ntdll.dll 18
EtwEventEnabled 0x180010190
EtwEventRegister 0x1800101a0
EtwEventUnregister 0x180010198
EtwEventWrite 0x180010188
NtClearEvent 0x1800101d8
NtClose 0x1800101e0
NtCreateEvent 0x1800101b8
NtOpenEvent 0x1800101b0
NtOpenThreadToken 0x180010170
NtQueryInformationToken 0x180010160
NtQueryVolumeInformationFile 0x1800101c0
NtSetEvent 0x1800101a8
RtlAllocateHeap 0x180010168
RtlFreeHeap 0x1800101e8
RtlInitUnicodeString 0x1800101c8
RtlNtStatusToDosError 0x1800101d0
RtlValidRelativeSecurityDescriptor 0x180010178
RtlValidSid 0x180010180
RPCRT4.dll 16
I_RpcBindingIsClientLocal 0x18000fdc0
I_RpcOpenClientProcess 0x18000fdd8
NdrServerCall2 0x18000fd90
NdrServerCallAll 0x18000fde8
RpcBindingInqAuthClientW 0x18000fd98
RpcBindingToStringBindingW 0x18000fdc8
RpcImpersonateClient 0x18000fda8
RpcRaiseException 0x18000fdd0
RpcRevertToSelf 0x18000fda0
RpcServerInqCallAttributesW 0x18000fde0
RpcServerInterfaceGroupActivate 0x18000fdf0
RpcServerInterfaceGroupClose 0x18000fe08
RpcServerInterfaceGroupCreateW 0x18000fdf8
RpcServerRegisterAuthInfoW 0x18000fe00
RpcStringBindingParseW 0x18000fdb0
RpcStringFreeW 0x18000fdb8