bfsvc.dll
Description: CMI boot file service plug-in
Authors: © Microsoft Corporation. All rights reserved.
Version: 10.0.19041.4467
Architecture: 32-bit
Operating System: Windows NT
SHA256: 25f94573d56a3d0326db973f10c182a3
File Size: 236.4 KB
Uploaded At: Dec. 1, 2025, 8:40 a.m.
Views: 12
Exported Functions
- DllCanUnloadNow (Ordinal: 1, Address: 0x18ea0)
- DllCsiGetHandler (Ordinal: 2, Address: 0x18ec0)
Imported DLLs & Functions
ADVAPI32.dll
- AdjustTokenPrivileges (Address: 0x10036030)
- ConvertSidToStringSidW (Address: 0x10036014)
- ConvertStringSecurityDescriptorToSecurityDescriptorW (Address: 0x10036010)
- DuplicateTokenEx (Address: 0x10036000)
- GetSecurityDescriptorControl (Address: 0x10036020)
- GetSecurityDescriptorDacl (Address: 0x1003602c)
- GetSecurityDescriptorGroup (Address: 0x10036028)
- GetSecurityDescriptorOwner (Address: 0x1003601c)
- GetSecurityDescriptorSacl (Address: 0x10036034)
- GetTokenInformation (Address: 0x10036004)
- LookupPrivilegeValueW (Address: 0x10036038)
- OpenProcessToken (Address: 0x10036018)
- OpenThreadToken (Address: 0x10036008)
- SetNamedSecurityInfoW (Address: 0x10036024)
- SetThreadToken (Address: 0x1003600c)
api-ms-win-core-debug-l1-1-0.dll
- DebugBreak (Address: 0x1003610c)
- IsDebuggerPresent (Address: 0x10036108)
- OutputDebugStringW (Address: 0x10036104)
api-ms-win-core-errorhandling-l1-1-0.dll
- GetLastError (Address: 0x10036120)
- SetLastError (Address: 0x10036114)
- SetUnhandledExceptionFilter (Address: 0x10036118)
- UnhandledExceptionFilter (Address: 0x1003611c)
api-ms-win-core-handle-l1-1-0.dll
- CloseHandle (Address: 0x10036128)
api-ms-win-core-heap-l1-1-0.dll
- GetProcessHeap (Address: 0x1003613c)
- HeapAlloc (Address: 0x10036134)
- HeapDestroy (Address: 0x10036138)
- HeapFree (Address: 0x10036130)
api-ms-win-core-libraryloader-l1-1-0.dll
- DisableThreadLibraryCalls (Address: 0x10036160)
- FindResourceExW (Address: 0x10036150)
- FreeLibrary (Address: 0x10036148)
- GetModuleFileNameA (Address: 0x10036158)
- GetModuleHandleExW (Address: 0x10036144)
- GetModuleHandleW (Address: 0x10036154)
- GetProcAddress (Address: 0x1003615c)
- LoadResource (Address: 0x1003614c)
api-ms-win-core-localization-l1-2-0.dll
- FormatMessageW (Address: 0x10036168)
api-ms-win-core-localization-obsolete-l1-2-0.dll
- GetSystemDefaultUILanguage (Address: 0x10036174)
- GetUserDefaultUILanguage (Address: 0x10036170)
api-ms-win-core-processenvironment-l1-1-0.dll
- SearchPathW (Address: 0x1003617c)
api-ms-win-core-processthreads-l1-1-0.dll
- GetCurrentProcess (Address: 0x10036190)
- GetCurrentProcessId (Address: 0x10036188)
- GetCurrentThreadId (Address: 0x1003618c)
- TerminateProcess (Address: 0x10036184)
api-ms-win-core-profile-l1-1-0.dll
- QueryPerformanceCounter (Address: 0x10036198)
api-ms-win-core-registry-l1-1-0.dll
- RegCloseKey (Address: 0x100361a4)
- RegCreateKeyExW (Address: 0x100361a8)
- RegOpenKeyExW (Address: 0x100361b0)
- RegQueryValueExW (Address: 0x100361a0)
- RegSetValueExW (Address: 0x100361ac)
api-ms-win-core-synch-l1-1-0.dll
- AcquireSRWLockExclusive (Address: 0x100361e0)
- AcquireSRWLockShared (Address: 0x100361d8)
- CreateMutexExW (Address: 0x100361f4)
- CreateSemaphoreExW (Address: 0x100361c0)
- DeleteCriticalSection (Address: 0x100361e4)
- EnterCriticalSection (Address: 0x100361d0)
- InitializeCriticalSection (Address: 0x100361bc)
- InitializeCriticalSectionEx (Address: 0x100361dc)
- LeaveCriticalSection (Address: 0x100361f0)
- OpenSemaphoreW (Address: 0x100361ec)
- ReleaseMutex (Address: 0x100361c4)
- ReleaseSemaphore (Address: 0x100361c8)
- ReleaseSRWLockExclusive (Address: 0x100361b8)
- ReleaseSRWLockShared (Address: 0x100361d4)
- WaitForSingleObject (Address: 0x100361e8)
- WaitForSingleObjectEx (Address: 0x100361cc)
api-ms-win-core-synch-l1-2-0.dll
- Sleep (Address: 0x100361fc)
api-ms-win-core-sysinfo-l1-1-0.dll
- GetSystemTimeAsFileTime (Address: 0x10036210)
- GetSystemWindowsDirectoryW (Address: 0x1003620c)
- GetTickCount (Address: 0x10036208)
- GetVersionExW (Address: 0x10036204)
api-ms-win-core-threadpool-l1-2-0.dll
- CloseThreadpoolTimer (Address: 0x10036220)
- CreateThreadpoolTimer (Address: 0x10036224)
- SetThreadpoolTimer (Address: 0x10036218)
- WaitForThreadpoolTimerCallbacks (Address: 0x1003621c)
api-ms-win-eventing-provider-l1-1-0.dll
- EventRegister (Address: 0x10036230)
- EventUnregister (Address: 0x1003622c)
- EventWriteTransfer (Address: 0x10036234)
bcrypt.dll
- BCryptCloseAlgorithmProvider (Address: 0x10036250)
- BCryptCreateHash (Address: 0x10036240)
- BCryptDestroyHash (Address: 0x1003624c)
- BCryptFinishHash (Address: 0x10036248)
- BCryptHashData (Address: 0x1003623c)
- BCryptOpenAlgorithmProvider (Address: 0x10036244)
CRYPT32.dll
- CertGetNameStringW (Address: 0x10036040)
imagehlp.dll
- CheckSumMappedFile (Address: 0x10036258)
KERNEL32.dll
- CopyFileExW (Address: 0x10036048)
- CreateDirectoryW (Address: 0x100360c4)
- CreateFileMappingW (Address: 0x10036098)
- CreateFileW (Address: 0x100360ac)
- DeleteFileW (Address: 0x1003604c)
- DeviceIoControl (Address: 0x100360b4)
- FindClose (Address: 0x10036078)
- FindFirstFileW (Address: 0x10036088)
- FindNextFileW (Address: 0x10036084)
- FlushFileBuffers (Address: 0x10036090)
- GetCurrentThread (Address: 0x1003609c)
- GetFileAttributesW (Address: 0x100360a8)
- GetFileInformationByHandle (Address: 0x10036054)
- GetFileInformationByHandleEx (Address: 0x10036058)
- GetFileSizeEx (Address: 0x100360b8)
- GetFullPathNameW (Address: 0x10036060)
- GetLocaleInfoW (Address: 0x10036068)
- GetPrivateProfileSectionW (Address: 0x1003607c)
- GetVolumeInformationW (Address: 0x1003608c)
- GetVolumeNameForVolumeMountPointW (Address: 0x100360a0)
- GetVolumePathNameW (Address: 0x100360b0)
- LoadLibraryExW (Address: 0x100360c0)
- LoadLibraryW (Address: 0x1003606c)
- LocalAlloc (Address: 0x1003605c)
- LocalFree (Address: 0x10036064)
- MapViewOfFile (Address: 0x10036094)
- MoveFileExW (Address: 0x10036070)
- QueryDosDeviceW (Address: 0x100360bc)
- SetFileAttributesW (Address: 0x10036074)
- SetFileInformationByHandle (Address: 0x10036050)
- UnmapViewOfFile (Address: 0x100360a4)
- WriteFile (Address: 0x10036080)
msvcrt.dll
- __dllonexit (Address: 0x100362f0)
- __iob_func (Address: 0x10036308)
- _amsg_exit (Address: 0x100362e4)
- _callnewh (Address: 0x1003627c)
- _except_handler4_common (Address: 0x100362f8)
- _initterm (Address: 0x10036264)
- _lock (Address: 0x1003629c)
- _onexit (Address: 0x100362f4)
- _purecall (Address: 0x10036268)
- _snwscanf_s (Address: 0x100362c4)
- _ultow_s (Address: 0x100362bc)
- _unlock (Address: 0x100362e8)
- _vsnwprintf (Address: 0x100362ec)
- _vsnwprintf_s (Address: 0x10036290)
- _wcsicmp (Address: 0x10036300)
- _wcslwr (Address: 0x100362c8)
- _wcsnicmp (Address: 0x100362e0)
- _wcsupr (Address: 0x100362b4)
- _wfopen_s (Address: 0x10036288)
- _XcptFilter (Address: 0x100362a0)
- bsearch (Address: 0x100362dc)
- fclose (Address: 0x1003628c)
- fflush (Address: 0x10036284)
- free (Address: 0x10036304)
- fwprintf (Address: 0x10036294)
- malloc (Address: 0x10036260)
- memcmp (Address: 0x10036280)
- memcpy (Address: 0x10036274)
- memcpy_s (Address: 0x10036278)
- memmove (Address: 0x100362fc)
- memmove_s (Address: 0x10036270)
- memset (Address: 0x1003630c)
- strcpy_s (Address: 0x100362d4)
- strncmp (Address: 0x100362d8)
- swprintf_s (Address: 0x100362ac)
- wcscat_s (Address: 0x100362a8)
- wcschr (Address: 0x100362b0)
- wcscpy_s (Address: 0x10036298)
- wcsncmp (Address: 0x100362a4)
- wcsncpy_s (Address: 0x100362b8)
- wcsnlen (Address: 0x100362d0)
- wcsrchr (Address: 0x1003626c)
- wcsstr (Address: 0x100362cc)
- wcstoul (Address: 0x100362c0)
ntdll.dll
- LdrAccessResource (Address: 0x10036348)
- LdrFindResource_U (Address: 0x10036344)
- LdrGetDllHandle (Address: 0x10036430)
- LdrGetProcedureAddress (Address: 0x1003642c)
- NtAdjustPrivilegesToken (Address: 0x10036444)
- NtClose (Address: 0x1003645c)
- NtCreateEvent (Address: 0x10036328)
- NtDeviceIoControlFile (Address: 0x10036320)
- NtEnumerateBootEntries (Address: 0x100363d8)
- NtOpenDirectoryObject (Address: 0x100363d0)
- NtOpenFile (Address: 0x1003633c)
- NtOpenKey (Address: 0x100363a0)
- NtOpenProcess (Address: 0x100363b4)
- NtOpenProcessTokenEx (Address: 0x10036448)
- NtOpenSymbolicLinkObject (Address: 0x10036398)
- NtOpenThreadTokenEx (Address: 0x1003644c)
- NtQueryBootEntryOrder (Address: 0x100363c4)
- NtQueryBootOptions (Address: 0x100363c8)
- NtQueryDirectoryObject (Address: 0x100363d4)
- NtQueryInformationFile (Address: 0x1003632c)
- NtQueryInformationProcess (Address: 0x10036460)
- NtQueryInformationThread (Address: 0x10036330)
- NtQuerySymbolicLinkObject (Address: 0x100363a4)
- NtQuerySystemEnvironmentValueEx (Address: 0x10036360)
- NtQuerySystemInformation (Address: 0x10036340)
- NtQueryValueKey (Address: 0x100363c0)
- NtReadFile (Address: 0x10036318)
- NtSetInformationFile (Address: 0x10036350)
- NtSetInformationThread (Address: 0x1003631c)
- NtTranslateFilePath (Address: 0x100363cc)
- NtWaitForSingleObject (Address: 0x10036338)
- NtWriteFile (Address: 0x10036454)
- RtlAddAccessAllowedAceEx (Address: 0x100363a8)
- RtlAllocateAndInitializeSid (Address: 0x100363ac)
- RtlAllocateHeap (Address: 0x10036364)
- RtlAppendUnicodeToString (Address: 0x10036370)
- RtlCompareMemory (Address: 0x1003635c)
- RtlCreateAcl (Address: 0x100363b8)
- RtlCreateSecurityDescriptor (Address: 0x100363bc)
- RtlFreeHeap (Address: 0x10036358)
- RtlFreeSid (Address: 0x10036458)
- RtlFreeUnicodeString (Address: 0x1003634c)
- RtlGetVersion (Address: 0x10036424)
- RtlGUIDFromString (Address: 0x1003636c)
- RtlImageNtHeader (Address: 0x10036324)
- RtlImpersonateSelf (Address: 0x10036450)
- RtlInitAnsiString (Address: 0x10036438)
- RtlInitUnicodeString (Address: 0x10036314)
- RtlLengthSecurityDescriptor (Address: 0x10036390)
- RtlLengthSid (Address: 0x100363b0)
- RtlNtStatusToDosError (Address: 0x10036334)
- RtlSetDaclSecurityDescriptor (Address: 0x1003639c)
- RtlSetOwnerSecurityDescriptor (Address: 0x10036394)
- RtlStringFromGUID (Address: 0x10036354)
- ZwAllocateUuids (Address: 0x10036410)
- ZwClose (Address: 0x1003638c)
- ZwCreateFile (Address: 0x100363dc)
- ZwCreateKey (Address: 0x100363e0)
- ZwDeleteKey (Address: 0x100363f4)
- ZwDeleteValueKey (Address: 0x100363ec)
- ZwDeviceIoControlFile (Address: 0x10036418)
- ZwEnumerateKey (Address: 0x100363f8)
- ZwFlushKey (Address: 0x100363e8)
- ZwLoadKey (Address: 0x100363e4)
- ZwOpenDirectoryObject (Address: 0x10036428)
- ZwOpenFile (Address: 0x10036384)
- ZwOpenKey (Address: 0x1003640c)
- ZwOpenMutant (Address: 0x10036388)
- ZwOpenProcess (Address: 0x10036440)
- ZwOpenSymbolicLinkObject (Address: 0x10036420)
- ZwQueryAttributesFile (Address: 0x10036374)
- ZwQueryDirectoryObject (Address: 0x1003641c)
- ZwQueryInformationFile (Address: 0x1003643c)
- ZwQueryInformationProcess (Address: 0x10036434)
- ZwQueryKey (Address: 0x1003637c)
- ZwQuerySymbolicLinkObject (Address: 0x10036414)
- ZwQuerySystemInformation (Address: 0x10036368)
- ZwQueryValueKey (Address: 0x100363fc)
- ZwReleaseMutant (Address: 0x10036380)
- ZwSaveKey (Address: 0x100363f0)
- ZwSetSecurityObject (Address: 0x10036400)
- ZwSetValueKey (Address: 0x10036408)
- ZwUnloadKey (Address: 0x10036404)
- ZwWaitForSingleObject (Address: 0x10036378)
RPCRT4.dll
- UuidCreate (Address: 0x100360cc)
SHLWAPI.dll
- PathRemoveBackslashW (Address: 0x100360d4)
WCP.dll
- ?RtlGetFacilityTracingFlags@Rtl@WCP@Windows@@YIKPAU_RTL_TRACING_FACILITY@123@@Z (Address: 0x100360e8)
- ?RtlTraceFormat_PCWSTR@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z (Address: 0x100360ec)
- ?RtlTraceVa@Rtl@WCP@Windows@@YIXKKPAU_RTL_TRACING_FACILITY@123@QBDKPAD@Z (Address: 0x100360e4)
- RtlFreeLUnicodeString (Address: 0x100360e0)
- RtlReportErrorOrigination (Address: 0x100360dc)
WINTRUST.dll
- WinVerifyTrust (Address: 0x100360fc)
- WTHelperGetProvSignerFromChain (Address: 0x100360f4)
- WTHelperProvDataFromStateData (Address: 0x100360f8)