efswrt.dll

v10.0.19041.5848 64-bit Windows NT Analyzed
Description
Storage Protection Windows Runtime DLL
Authors
© Microsoft Corporation. All rights reserved.
File size
867.0 KB
Uploaded
2025-12-01 07:27
Views
92
SHA-256
6c0538086d6fb6ed2a8c70b566d434d8

Exported functions 31

CdplGetFileProtectionLevel #1 · 0x18b90
CdplIsAppAllowedToRun #2 · 0x18fd0
CdplIsAppDataProtectionSupported #3 · 0xec40
CdplIsSupported #4 · 0x19940
CdplProtectFileToLevel #5 · 0x18a50
CdplProtectFileToLevelWithResult #6 · 0x188e0
CdplProtectKnownUserFolders #7 · 0x18be0
CdplProtectSecretToLevel #8 · 0x18ef0
CdplUnprotectSecret #9 · 0x18fb0
DllCanUnloadNow #10 · 0x5b90
DllGetActivationFactory #11 · 0x5c00
DllGetClassObject #12 · 0x5de0
DpmBufferFree #13 · 0xeb10
DpmProtectSecretToIdentity #14 · 0xe740
DpmStreamClose #15 · 0xeb00
DpmStreamOpenToProtectToIdentity #16 · 0xe920
DpmStreamOpenToUnprotect #17 · 0xea10
DpmStreamUpdate #18 · 0xeaf0
DpmUnprotectSecret #19 · 0xe8a0
EnterpriseDataCopyProtection #20 · 0xd0d0
EnterpriseDataGetStatus #21 · 0xd9a0
EnterpriseDataProtect #22 · 0xcae0
EnterpriseDataRevoke #23 · 0xd4a0
FreeIdentityProtectorList #24 · 0xe710
GetEnterpriseActionForCopy #25 · 0xdf40
GetEnterpriseIdForNetworkPath #26 · 0xdd10
ProtectFileToEnterpriseIdentity #27 · 0xeb20
ProtectFileToIdentity #28 · 0xcf50
ProtectOrReprotectFileToIdentity #29 · 0xeb70
QueryIdentityProtectors #30 · 0xe4e0
UnprotectFile #31 · 0xeb40

Imported DLLs & functions 344

api-ms-win-appmodel-runtime-internal-l1-1-3.dll 1
CouldMultiUserAppsBehaviorBePossibleForPackage 0x1800a0e60
api-ms-win-appmodel-runtime-l1-1-0.dll 5
GetPackageFamilyName 0x1800a0e70
GetPackageFullName 0x1800a0e78
GetPackagesByPackageFamily 0x1800a0e88
PackageFamilyNameFromFullName 0x1800a0e90
PackageNameAndPublisherIdFromFamilyName 0x1800a0e80
api-ms-win-appmodel-runtime-l1-1-1.dll 1
GetPackageFullNameFromToken 0x1800a0ea0
api-ms-win-core-apiquery-l1-1-0.dll 1
ApiSetQueryApiSetPresence 0x1800a0eb0
api-ms-win-core-com-l1-1-0.dll 16
CoCreateFreeThreadedMarshaler 0x1800a0f20
CoCreateInstance 0x1800a0ed0
CoDecrementMTAUsage 0x1800a0f10
CoGetApartmentType 0x1800a0f18
CoGetCallContext 0x1800a0ec0
CoGetCallerTID 0x1800a0ee0
CoGetInterfaceAndReleaseStream 0x1800a0ee8
CoIncrementMTAUsage 0x1800a0f28
CoMarshalInterface 0x1800a0f08
CoMarshalInterThreadInterfaceInStream 0x1800a0ed8
CoReleaseMarshalData 0x1800a0ec8
CoTaskMemAlloc 0x1800a0f00
CoTaskMemFree 0x1800a0ef0
CoTaskMemRealloc 0x1800a0f38
CoWaitForMultipleHandles 0x1800a0ef8
CreateStreamOnHGlobal 0x1800a0f30
api-ms-win-core-com-l1-1-1.dll 1
RoGetAgileReference 0x1800a0f48
api-ms-win-core-com-midlproxystub-l1-1-0.dll 23
CStdStubBuffer2_Connect 0x1800a0fe8
CStdStubBuffer2_CountRefs 0x1800a0f88
CStdStubBuffer2_Disconnect 0x1800a0fa0
CStdStubBuffer2_QueryInterface 0x1800a0f60
NdrProxyForwardingFunction3 0x1800a0fe0
NdrProxyForwardingFunction4 0x1800a0f80
NdrProxyForwardingFunction5 0x1800a0f90
ObjectStublessClient10 0x1800a0fd0
ObjectStublessClient11 0x1800a0f98
ObjectStublessClient12 0x1800a0fa8
ObjectStublessClient13 0x1800a1008
ObjectStublessClient14 0x1800a1000
ObjectStublessClient15 0x1800a0ff0
ObjectStublessClient16 0x1800a0fd8
ObjectStublessClient17 0x1800a0fc8
ObjectStublessClient18 0x1800a0f68
ObjectStublessClient19 0x1800a0f78
ObjectStublessClient20 0x1800a0f58
ObjectStublessClient3 0x1800a0f70
ObjectStublessClient6 0x1800a0fb0
ObjectStublessClient7 0x1800a0ff8
ObjectStublessClient8 0x1800a0fb8
ObjectStublessClient9 0x1800a0fc0
api-ms-win-core-debug-l1-1-0.dll 3
DebugBreak 0x1800a1020
IsDebuggerPresent 0x1800a1018
OutputDebugStringW 0x1800a1028
api-ms-win-core-delayload-l1-1-0.dll 1
DelayLoadFailureHook 0x1800a1038
api-ms-win-core-delayload-l1-1-1.dll 1
ResolveDelayLoadedAPI 0x1800a1048
api-ms-win-core-errorhandling-l1-1-0.dll 5
GetLastError 0x1800a1068
RaiseException 0x1800a1070
SetLastError 0x1800a1058
SetUnhandledExceptionFilter 0x1800a1060
UnhandledExceptionFilter 0x1800a1078
api-ms-win-core-file-l1-1-0.dll 9
CreateFileW 0x1800a10c8
FindClose 0x1800a10b8
FindFirstFileW 0x1800a10a0
FindNextFileW 0x1800a10c0
GetDriveTypeW 0x1800a1090
GetFileAttributesW 0x1800a10b0
GetFullPathNameW 0x1800a1088
GetLongPathNameW 0x1800a1098
GetVolumePathNameW 0x1800a10a8
api-ms-win-core-file-l1-2-0.dll 2
GetTempPathW 0x1800a10d8
GetVolumeNameForVolumeMountPointW 0x1800a10e0
api-ms-win-core-file-l2-1-0.dll 1
GetFileInformationByHandleEx 0x1800a10f0
api-ms-win-core-handle-l1-1-0.dll 2
CloseHandle 0x1800a1100
DuplicateHandle 0x1800a1108
api-ms-win-core-heap-l1-1-0.dll 3
GetProcessHeap 0x1800a1128
HeapAlloc 0x1800a1118
HeapFree 0x1800a1120
api-ms-win-core-heap-l2-1-0.dll 2
LocalAlloc 0x1800a1140
LocalFree 0x1800a1138
api-ms-win-core-libraryloader-l1-2-0.dll 10
DisableThreadLibraryCalls 0x1800a1190
FindStringOrdinal 0x1800a1150
FreeLibrary 0x1800a1170
GetModuleFileNameA 0x1800a1188
GetModuleFileNameW 0x1800a1158
GetModuleHandleExW 0x1800a1178
GetModuleHandleW 0x1800a1160
GetProcAddress 0x1800a1180
LoadLibraryExW 0x1800a1168
LoadStringW 0x1800a1198
api-ms-win-core-localization-l1-2-0.dll 2
FormatMessageW 0x1800a11a8
IdnToAscii 0x1800a11b0
api-ms-win-core-marshal-l1-1-0.dll 8
HWND_UserFree 0x1800a11e8
HWND_UserFree64 0x1800a11f0
HWND_UserMarshal 0x1800a11f8
HWND_UserMarshal64 0x1800a11e0
HWND_UserSize 0x1800a11d0
HWND_UserSize64 0x1800a11c8
HWND_UserUnmarshal 0x1800a11c0
HWND_UserUnmarshal64 0x1800a11d8
api-ms-win-core-path-l1-1-0.dll 3
PathCchRemoveFileSpec 0x1800a1208
PathCchSkipRoot 0x1800a1210
PathIsUNCEx 0x1800a1218
api-ms-win-core-processenvironment-l1-1-0.dll 1
ExpandEnvironmentStringsW 0x1800a1228
api-ms-win-core-processthreads-l1-1-0.dll 8
GetCurrentProcess 0x1800a1258
GetCurrentProcessId 0x1800a1260
GetCurrentThread 0x1800a1240
GetCurrentThreadId 0x1800a1238
GetProcessId 0x1800a1270
OpenProcessToken 0x1800a1248
OpenThreadToken 0x1800a1250
TerminateProcess 0x1800a1268
api-ms-win-core-processthreads-l1-1-1.dll 2
GetProcessMitigationPolicy 0x1800a1288
OpenProcess 0x1800a1280
api-ms-win-core-profile-l1-1-0.dll 2
QueryPerformanceCounter 0x1800a12a0
QueryPerformanceFrequency 0x1800a1298
api-ms-win-core-psapi-l1-1-0.dll 1
QueryFullProcessImageNameW 0x1800a12b0
api-ms-win-core-registry-l1-1-0.dll 7
RegCloseKey 0x1800a12c0
RegCreateKeyExW 0x1800a12d0
RegGetValueW 0x1800a12c8
RegNotifyChangeKeyValue 0x1800a12d8
RegOpenCurrentUser 0x1800a12f0
RegOpenKeyExW 0x1800a12e0
RegQueryValueExW 0x1800a12e8
api-ms-win-core-rtlsupport-l1-1-0.dll 3
RtlCaptureContext 0x1800a1310
RtlLookupFunctionEntry 0x1800a1308
RtlVirtualUnwind 0x1800a1300
api-ms-win-core-shlwapi-legacy-l1-1-0.dll 1
PathFindExtensionW 0x1800a1320
api-ms-win-core-shlwapi-obsolete-l1-1-0.dll 1
StrStrIW 0x1800a1330
api-ms-win-core-string-l1-1-0.dll 1
CompareStringOrdinal 0x1800a1340
api-ms-win-core-synch-l1-1-0.dll 24
AcquireSRWLockExclusive 0x1800a13c0
AcquireSRWLockShared 0x1800a13d8
CreateEventExW 0x1800a13e8
CreateMutexExW 0x1800a1400
CreateMutexW 0x1800a1350
CreateSemaphoreExW 0x1800a1408
DeleteCriticalSection 0x1800a13f8
EnterCriticalSection 0x1800a1370
InitializeCriticalSection 0x1800a1358
InitializeCriticalSectionEx 0x1800a1388
InitializeSRWLock 0x1800a1390
LeaveCriticalSection 0x1800a13f0
OpenSemaphoreW 0x1800a13a8
ReleaseMutex 0x1800a1368
ReleaseSemaphore 0x1800a13d0
ReleaseSRWLockExclusive 0x1800a13a0
ReleaseSRWLockShared 0x1800a13b0
SetEvent 0x1800a13b8
TryAcquireSRWLockExclusive 0x1800a13c8
TryAcquireSRWLockShared 0x1800a1380
TryEnterCriticalSection 0x1800a1398
WaitForMultipleObjectsEx 0x1800a13e0
WaitForSingleObject 0x1800a1378
WaitForSingleObjectEx 0x1800a1360
api-ms-win-core-synch-l1-2-0.dll 8
InitOnceBeginInitialize 0x1800a1440
InitOnceComplete 0x1800a1420
InitOnceExecuteOnce 0x1800a1428
Sleep 0x1800a1430
SleepConditionVariableSRW 0x1800a1450
WaitOnAddress 0x1800a1448
WakeAllConditionVariable 0x1800a1438
WakeByAddressAll 0x1800a1418
api-ms-win-core-sysinfo-l1-1-0.dll 2
GetSystemTimeAsFileTime 0x1800a1468
GetTickCount 0x1800a1460
api-ms-win-core-threadpool-l1-2-0.dll 12
CloseThreadpoolTimer 0x1800a14d0
CloseThreadpoolWait 0x1800a1490
CloseThreadpoolWork 0x1800a14a0
CreateThreadpoolTimer 0x1800a14a8
CreateThreadpoolWait 0x1800a1480
CreateThreadpoolWork 0x1800a14b0
FreeLibraryWhenCallbackReturns 0x1800a1498
SetThreadpoolTimer 0x1800a14c0
SetThreadpoolWait 0x1800a1488
SubmitThreadpoolWork 0x1800a1478
WaitForThreadpoolTimerCallbacks 0x1800a14c8
WaitForThreadpoolWaitCallbacks 0x1800a14b8
api-ms-win-core-url-l1-1-0.dll 1
UrlGetPartW 0x1800a14e0
api-ms-win-core-util-l1-1-0.dll 2
DecodePointer 0x1800a14f0
EncodePointer 0x1800a14f8
api-ms-win-core-winrt-error-l1-1-0.dll 5
GetRestrictedErrorInfo 0x1800a1528
RoOriginateError 0x1800a1520
RoOriginateErrorW 0x1800a1508
RoTransformError 0x1800a1510
SetRestrictedErrorInfo 0x1800a1518
api-ms-win-core-winrt-error-l1-1-1.dll 3
IsErrorPropagationEnabled 0x1800a1540
RoGetMatchingRestrictedErrorInfo 0x1800a1548
RoReportFailedDelegate 0x1800a1538
api-ms-win-core-winrt-l1-1-0.dll 1
RoGetActivationFactory 0x1800a1558
api-ms-win-core-winrt-robuffer-l1-1-0.dll 1
RoGetBufferMarshaler 0x1800a1568
api-ms-win-core-winrt-string-l1-1-0.dll 16
HSTRING_UserFree 0x1800a15c8
HSTRING_UserFree64 0x1800a15e8
HSTRING_UserMarshal 0x1800a15f0
HSTRING_UserMarshal64 0x1800a15c0
HSTRING_UserSize 0x1800a1578
HSTRING_UserSize64 0x1800a15d0
HSTRING_UserUnmarshal 0x1800a15b8
HSTRING_UserUnmarshal64 0x1800a15b0
WindowsCreateString 0x1800a15e0
WindowsCreateStringReference 0x1800a1598
WindowsDeleteString 0x1800a1588
WindowsDuplicateString 0x1800a1580
WindowsGetStringLen 0x1800a15d8
WindowsGetStringRawBuffer 0x1800a1590
WindowsIsStringEmpty 0x1800a15a0
WindowsStringHasEmbeddedNull 0x1800a15a8
api-ms-win-eventing-classicprovider-l1-1-0.dll 6
GetTraceEnableFlags 0x1800a1618
GetTraceEnableLevel 0x1800a1608
GetTraceLoggerHandle 0x1800a1628
RegisterTraceGuidsW 0x1800a1610
TraceMessage 0x1800a1620
UnregisterTraceGuids 0x1800a1600
api-ms-win-eventing-provider-l1-1-0.dll 6
EventActivityIdControl 0x1800a1658
EventProviderEnabled 0x1800a1650
EventRegister 0x1800a1640
EventSetInformation 0x1800a1660
EventUnregister 0x1800a1648
EventWriteTransfer 0x1800a1638
api-ms-win-security-base-l1-1-0.dll 9
CopySid 0x1800a1678
EqualSid 0x1800a1690
GetAce 0x1800a1688
GetLengthSid 0x1800a1698
GetSidSubAuthority 0x1800a16a0
GetSidSubAuthorityCount 0x1800a16b0
GetTokenInformation 0x1800a1680
ImpersonateLoggedOnUser 0x1800a16a8
RevertToSelf 0x1800a1670
api-ms-win-security-sddl-l1-1-0.dll 2
ConvertSidToStringSidW 0x1800a16c8
ConvertStringSidToSidW 0x1800a16c0
api-ms-win-service-private-l1-1-0.dll 1
I_QueryTagInformation 0x1800a16d8
combase.dll 3
0x1800a16e8
0x1800a16f0
0x1800a16f8
MPR.dll 1
WNetGetUniversalNameW 0x1800a0d80
msvcrt.dll 48
__C_specific_handler 0x1800a1718
__CxxFrameHandler3 0x1800a17e8
__dllonexit 0x1800a1728
_amsg_exit 0x1800a1738
_callnewh 0x1800a1780
_CxxThrowException 0x1800a1760
_initterm 0x1800a1720
_lock 0x1800a1708
_onexit 0x1800a1740
_purecall 0x1800a17b0
_ui64tow_s 0x1800a17a8
_unlock 0x1800a1770
_vsnprintf_s 0x1800a17d0
_vsnwprintf 0x1800a1870
_wcsicmp 0x1800a17c8
_wcsnicmp 0x1800a1820
_XcptFilter 0x1800a1798
??_V@YAXPEAX@Z 0x1800a17f8
??0exception@@QEAA@AEBQEBD@Z 0x1800a1778
??0exception@@QEAA@AEBQEBDH@Z 0x1800a1878
??0exception@@QEAA@AEBV0@@Z 0x1800a17e0
??0exception@@QEAA@XZ 0x1800a17f0
??1exception@@UEAA@XZ 0x1800a1858
??1type_info@@UEAA@XZ 0x1800a17c0
??3@YAXPEAX@Z 0x1800a1860
?terminate@@YAXXZ 0x1800a1710
?what@exception@@UEBAPEBDXZ 0x1800a1768
free 0x1800a1730
iswalpha 0x1800a1818
malloc 0x1800a1788
memcmp 0x1800a17d8
memcpy 0x1800a1750
memcpy_s 0x1800a1868
memmove 0x1800a1748
memmove_s 0x1800a1790
memset 0x1800a1758
qsort 0x1800a17b8
realloc 0x1800a1800
toupper 0x1800a1850
wcschr 0x1800a1840
wcscmp 0x1800a1880
wcscpy_s 0x1800a1810
wcsncmp 0x1800a1828
wcsnlen 0x1800a1838
wcsrchr 0x1800a17a0
wcsstr 0x1800a1830
wcstok_s 0x1800a1808
wcstoul 0x1800a1848
ntdll.dll 42
NtClose 0x1800a18a8
NtDeviceIoControlFile 0x1800a18b0
NtDuplicateObject 0x1800a18a0
NtDuplicateToken 0x1800a18c0
NtFsControlFile 0x1800a1918
NtOpenFile 0x1800a1890
NtOpenProcessToken 0x1800a18c8
NtOpenThreadToken 0x1800a1898
NtQuerySecurityAttributesToken 0x1800a18d8
NtQuerySecurityObject 0x1800a1928
NtQueryWnfStateData 0x1800a1990
NtSetInformationThread 0x1800a18b8
NtSetSecurityObject 0x1800a1958
RtlAddAccessAllowedAce 0x1800a1940
RtlAddAce 0x1800a1950
RtlAllocateHeap 0x1800a18f0
RtlCompareMemory 0x1800a18d0
RtlCompareUnicodeString 0x1800a18f8
RtlConvertSidToUnicodeString 0x1800a19a0
RtlCopyUnicodeString 0x1800a18e8
RtlCreateAcl 0x1800a1938
RtlCreateSecurityDescriptor 0x1800a19d8
RtlFreeHeap 0x1800a18e0
RtlFreeUnicodeString 0x1800a19c8
RtlGetAce 0x1800a1968
RtlGetDaclSecurityDescriptor 0x1800a1920
RtlInitUnicodeString 0x1800a1978
RtlIsMultiSessionSku 0x1800a1910
RtlLengthSid 0x1800a1948
RtlNtStatusToDosError 0x1800a1908
RtlPublishWnfStateData 0x1800a1980
RtlQueryInformationAcl 0x1800a1960
RtlQueryPackageClaims 0x1800a1900
RtlSetDaclSecurityDescriptor 0x1800a1970
RtlSubscribeWnfStateChangeNotification 0x1800a19d0
RtlUnsubscribeWnfNotificationWaitForCompletion 0x1800a1988
ZwClose 0x1800a19b0
ZwOpenProcessTokenEx 0x1800a19b8
ZwOpenThreadTokenEx 0x1800a19a8
ZwQueryInformationProcess 0x1800a19c0
ZwQueryInformationToken 0x1800a1998
ZwQueryWnfStateData 0x1800a1930
OLEAUT32.dll 1
SysFreeString 0x1800a0d90
RPCRT4.dll 23
CStdStubBuffer_AddRef 0x1800a0db0
CStdStubBuffer_Connect 0x1800a0e38
CStdStubBuffer_CountRefs 0x1800a0de0
CStdStubBuffer_DebugServerQueryInterface 0x1800a0da8
CStdStubBuffer_DebugServerRelease 0x1800a0e20
CStdStubBuffer_Disconnect 0x1800a0e50
CStdStubBuffer_Invoke 0x1800a0df0
CStdStubBuffer_IsIIDSupported 0x1800a0e00
CStdStubBuffer_QueryInterface 0x1800a0e08
I_RpcBindingInqLocalClientPID 0x1800a0dd8
IUnknown_AddRef_Proxy 0x1800a0dd0
IUnknown_QueryInterface_Proxy 0x1800a0e28
IUnknown_Release_Proxy 0x1800a0dc8
NdrCStdStubBuffer_Release 0x1800a0e30
NdrCStdStubBuffer2_Release 0x1800a0e40
NdrDllCanUnloadNow 0x1800a0da0
NdrDllGetClassObject 0x1800a0e18
NdrOleAllocate 0x1800a0e10
NdrOleFree 0x1800a0e48
NdrStubCall3 0x1800a0df8
NdrStubForwardingFunction 0x1800a0de8
UuidCreateNil 0x1800a0db8
UuidFromStringW 0x1800a0dc0