bfsvc.dll
Description: CMI boot file service plug-in
Authors: © Microsoft Corporation. All rights reserved.
Version: 10.0.19041.5676
Architecture: 32-bit
Operating System: Windows NT
SHA256: 793889a6a01d48a8e51cbeb64153eccf
File Size: 228.9 KB
Uploaded At: Dec. 1, 2025, 8:40 a.m.
Views: 14
Exported Functions
- DllCanUnloadNow (Ordinal: 1, Address: 0x17980)
- DllCsiGetHandler (Ordinal: 2, Address: 0x179a0)
Imported DLLs & Functions
ADVAPI32.dll
- AdjustTokenPrivileges (Address: 0x10034030)
- ConvertSidToStringSidW (Address: 0x10034014)
- ConvertStringSecurityDescriptorToSecurityDescriptorW (Address: 0x10034010)
- DuplicateTokenEx (Address: 0x10034000)
- GetSecurityDescriptorControl (Address: 0x10034020)
- GetSecurityDescriptorDacl (Address: 0x1003402c)
- GetSecurityDescriptorGroup (Address: 0x10034028)
- GetSecurityDescriptorOwner (Address: 0x1003401c)
- GetSecurityDescriptorSacl (Address: 0x10034034)
- GetTokenInformation (Address: 0x10034004)
- LookupPrivilegeValueW (Address: 0x10034038)
- OpenProcessToken (Address: 0x10034018)
- OpenThreadToken (Address: 0x10034008)
- SetNamedSecurityInfoW (Address: 0x10034024)
- SetThreadToken (Address: 0x1003400c)
api-ms-win-core-debug-l1-1-0.dll
- DebugBreak (Address: 0x1003410c)
- IsDebuggerPresent (Address: 0x10034108)
- OutputDebugStringW (Address: 0x10034104)
api-ms-win-core-errorhandling-l1-1-0.dll
- GetLastError (Address: 0x10034118)
- SetLastError (Address: 0x1003411c)
- SetUnhandledExceptionFilter (Address: 0x10034114)
- UnhandledExceptionFilter (Address: 0x10034120)
api-ms-win-core-handle-l1-1-0.dll
- CloseHandle (Address: 0x10034128)
api-ms-win-core-heap-l1-1-0.dll
- GetProcessHeap (Address: 0x10034134)
- HeapAlloc (Address: 0x1003413c)
- HeapDestroy (Address: 0x10034130)
- HeapFree (Address: 0x10034138)
api-ms-win-core-libraryloader-l1-1-0.dll
- DisableThreadLibraryCalls (Address: 0x1003415c)
- FindResourceExW (Address: 0x10034148)
- FreeLibrary (Address: 0x10034154)
- GetModuleFileNameA (Address: 0x10034150)
- GetModuleHandleExW (Address: 0x10034160)
- GetModuleHandleW (Address: 0x1003414c)
- GetProcAddress (Address: 0x10034158)
- LoadResource (Address: 0x10034144)
api-ms-win-core-localization-l1-2-0.dll
- FormatMessageW (Address: 0x10034168)
api-ms-win-core-localization-obsolete-l1-2-0.dll
- GetSystemDefaultUILanguage (Address: 0x10034170)
- GetUserDefaultUILanguage (Address: 0x10034174)
api-ms-win-core-processenvironment-l1-1-0.dll
- SearchPathW (Address: 0x1003417c)
api-ms-win-core-processthreads-l1-1-0.dll
- GetCurrentProcess (Address: 0x10034188)
- GetCurrentProcessId (Address: 0x10034184)
- GetCurrentThreadId (Address: 0x10034190)
- TerminateProcess (Address: 0x1003418c)
api-ms-win-core-profile-l1-1-0.dll
- QueryPerformanceCounter (Address: 0x10034198)
api-ms-win-core-registry-l1-1-0.dll
- RegCloseKey (Address: 0x100341b0)
- RegCreateKeyExW (Address: 0x100341a4)
- RegOpenKeyExW (Address: 0x100341a8)
- RegQueryValueExW (Address: 0x100341a0)
- RegSetValueExW (Address: 0x100341ac)
api-ms-win-core-synch-l1-1-0.dll
- AcquireSRWLockExclusive (Address: 0x100341d0)
- AcquireSRWLockShared (Address: 0x100341c8)
- CreateMutexExW (Address: 0x100341dc)
- CreateSemaphoreExW (Address: 0x100341d4)
- DeleteCriticalSection (Address: 0x100341e8)
- EnterCriticalSection (Address: 0x100341f0)
- InitializeCriticalSection (Address: 0x100341c0)
- InitializeCriticalSectionEx (Address: 0x100341ec)
- LeaveCriticalSection (Address: 0x100341d8)
- OpenSemaphoreW (Address: 0x100341e0)
- ReleaseMutex (Address: 0x100341bc)
- ReleaseSemaphore (Address: 0x100341b8)
- ReleaseSRWLockExclusive (Address: 0x100341cc)
- ReleaseSRWLockShared (Address: 0x100341c4)
- WaitForSingleObject (Address: 0x100341e4)
- WaitForSingleObjectEx (Address: 0x100341f4)
api-ms-win-core-synch-l1-2-0.dll
- Sleep (Address: 0x100341fc)
api-ms-win-core-sysinfo-l1-1-0.dll
- GetSystemTimeAsFileTime (Address: 0x10034204)
- GetTickCount (Address: 0x1003420c)
- GetVersionExW (Address: 0x10034208)
api-ms-win-core-threadpool-l1-2-0.dll
- CloseThreadpoolTimer (Address: 0x10034218)
- CreateThreadpoolTimer (Address: 0x10034220)
- SetThreadpoolTimer (Address: 0x1003421c)
- WaitForThreadpoolTimerCallbacks (Address: 0x10034214)
api-ms-win-eventing-provider-l1-1-0.dll
- EventRegister (Address: 0x1003422c)
- EventUnregister (Address: 0x10034228)
- EventWriteTransfer (Address: 0x10034230)
bcrypt.dll
- BCryptCloseAlgorithmProvider (Address: 0x1003424c)
- BCryptCreateHash (Address: 0x10034244)
- BCryptDestroyHash (Address: 0x10034248)
- BCryptFinishHash (Address: 0x1003423c)
- BCryptHashData (Address: 0x10034238)
- BCryptOpenAlgorithmProvider (Address: 0x10034240)
CRYPT32.dll
- CertGetNameStringW (Address: 0x10034040)
imagehlp.dll
- CheckSumMappedFile (Address: 0x10034254)
KERNEL32.dll
- CopyFileExW (Address: 0x10034048)
- CreateDirectoryW (Address: 0x100340c4)
- CreateFileMappingW (Address: 0x10034074)
- CreateFileW (Address: 0x1003409c)
- DeleteFileW (Address: 0x1003404c)
- DeviceIoControl (Address: 0x10034080)
- FindClose (Address: 0x100340a4)
- FindFirstFileW (Address: 0x100340b4)
- FindNextFileW (Address: 0x100340b0)
- FlushFileBuffers (Address: 0x1003406c)
- GetCurrentThread (Address: 0x10034078)
- GetFileAttributesW (Address: 0x10034098)
- GetFileInformationByHandle (Address: 0x10034054)
- GetFileInformationByHandleEx (Address: 0x10034058)
- GetFileSizeEx (Address: 0x10034084)
- GetFullPathNameW (Address: 0x10034060)
- GetLocaleInfoW (Address: 0x10034068)
- GetPrivateProfileSectionW (Address: 0x100340a8)
- GetVolumeInformationW (Address: 0x100340b8)
- GetVolumeNameForVolumeMountPointW (Address: 0x10034094)
- GetVolumePathNameW (Address: 0x100340a0)
- LoadLibraryExW (Address: 0x100340c0)
- LoadLibraryW (Address: 0x10034088)
- LocalAlloc (Address: 0x1003405c)
- LocalFree (Address: 0x10034064)
- MapViewOfFile (Address: 0x10034070)
- MoveFileExW (Address: 0x1003408c)
- QueryDosDeviceW (Address: 0x100340bc)
- SetFileAttributesW (Address: 0x10034090)
- SetFileInformationByHandle (Address: 0x10034050)
- UnmapViewOfFile (Address: 0x1003407c)
- WriteFile (Address: 0x100340ac)
msvcrt.dll
- __dllonexit (Address: 0x100342ec)
- __iob_func (Address: 0x10034304)
- _amsg_exit (Address: 0x1003427c)
- _callnewh (Address: 0x10034270)
- _except_handler4_common (Address: 0x10034264)
- _initterm (Address: 0x10034298)
- _lock (Address: 0x100342e0)
- _onexit (Address: 0x100342f4)
- _purecall (Address: 0x10034300)
- _snwscanf_s (Address: 0x100342c8)
- _ultow_s (Address: 0x100342b8)
- _unlock (Address: 0x100342e8)
- _vsnwprintf (Address: 0x10034274)
- _vsnwprintf_s (Address: 0x1003428c)
- _wcsicmp (Address: 0x10034294)
- _wcslwr (Address: 0x100342cc)
- _wcsnicmp (Address: 0x100342f0)
- _wcsupr (Address: 0x100342b0)
- _wfopen_s (Address: 0x10034284)
- _XcptFilter (Address: 0x10034278)
- bsearch (Address: 0x100342d8)
- fclose (Address: 0x10034288)
- fflush (Address: 0x10034280)
- free (Address: 0x10034260)
- fwprintf (Address: 0x10034290)
- malloc (Address: 0x1003425c)
- memcmp (Address: 0x100342f8)
- memcpy (Address: 0x100342fc)
- memcpy_s (Address: 0x100342e4)
- memmove (Address: 0x100342dc)
- memmove_s (Address: 0x1003426c)
- memset (Address: 0x10034308)
- strcpy_s (Address: 0x100342c0)
- strncmp (Address: 0x100342d4)
- swprintf_s (Address: 0x100342ac)
- wcscat_s (Address: 0x100342a4)
- wcschr (Address: 0x100342a8)
- wcscpy_s (Address: 0x100342a0)
- wcsncmp (Address: 0x1003429c)
- wcsncpy_s (Address: 0x100342b4)
- wcsnlen (Address: 0x100342d0)
- wcsrchr (Address: 0x10034268)
- wcsstr (Address: 0x100342c4)
- wcstoul (Address: 0x100342bc)
ntdll.dll
- LdrAccessResource (Address: 0x10034344)
- LdrFindResource_U (Address: 0x10034340)
- LdrGetDllHandle (Address: 0x10034404)
- LdrGetProcedureAddress (Address: 0x10034400)
- NtAdjustPrivilegesToken (Address: 0x10034418)
- NtClose (Address: 0x10034458)
- NtCreateEvent (Address: 0x1003432c)
- NtDeviceIoControlFile (Address: 0x10034324)
- NtEnumerateBootEntries (Address: 0x1003444c)
- NtOpenDirectoryObject (Address: 0x10034444)
- NtOpenFile (Address: 0x1003433c)
- NtOpenKey (Address: 0x1003442c)
- NtOpenProcess (Address: 0x10034318)
- NtOpenProcessTokenEx (Address: 0x1003441c)
- NtOpenSymbolicLinkObject (Address: 0x10034428)
- NtOpenThreadTokenEx (Address: 0x10034420)
- NtQueryBootEntryOrder (Address: 0x10034438)
- NtQueryBootOptions (Address: 0x1003443c)
- NtQueryDirectoryObject (Address: 0x10034448)
- NtQueryInformationFile (Address: 0x10034330)
- NtQueryInformationProcess (Address: 0x10034314)
- NtQueryInformationThread (Address: 0x10034334)
- NtQuerySymbolicLinkObject (Address: 0x10034430)
- NtQuerySystemEnvironmentValueEx (Address: 0x1003435c)
- NtQuerySystemInformation (Address: 0x10034450)
- NtQueryValueKey (Address: 0x10034434)
- NtReadFile (Address: 0x1003431c)
- NtSetInformationFile (Address: 0x1003434c)
- NtSetInformationThread (Address: 0x10034320)
- NtTranslateFilePath (Address: 0x10034440)
- NtWaitForSingleObject (Address: 0x10034338)
- NtWriteFile (Address: 0x1003445c)
- RtlAddAccessAllowedAceEx (Address: 0x100343a4)
- RtlAllocateAndInitializeSid (Address: 0x100343a8)
- RtlAllocateHeap (Address: 0x10034360)
- RtlAppendUnicodeToString (Address: 0x1003436c)
- RtlCompareMemory (Address: 0x10034358)
- RtlCreateAcl (Address: 0x100343cc)
- RtlCreateSecurityDescriptor (Address: 0x100343d8)
- RtlFreeHeap (Address: 0x10034354)
- RtlFreeSid (Address: 0x100343bc)
- RtlFreeUnicodeString (Address: 0x10034348)
- RtlGetVersion (Address: 0x100343f8)
- RtlGUIDFromString (Address: 0x10034368)
- RtlImageNtHeader (Address: 0x10034328)
- RtlImpersonateSelf (Address: 0x10034424)
- RtlInitAnsiString (Address: 0x1003440c)
- RtlInitUnicodeString (Address: 0x100343b0)
- RtlLengthSecurityDescriptor (Address: 0x1003438c)
- RtlLengthSid (Address: 0x100343ac)
- RtlNtStatusToDosError (Address: 0x10034310)
- RtlSetDaclSecurityDescriptor (Address: 0x10034394)
- RtlSetOwnerSecurityDescriptor (Address: 0x10034390)
- RtlStringFromGUID (Address: 0x10034350)
- ZwAllocateUuids (Address: 0x100343e4)
- ZwClose (Address: 0x10034388)
- ZwCreateFile (Address: 0x10034398)
- ZwCreateKey (Address: 0x1003439c)
- ZwDeleteKey (Address: 0x100343c0)
- ZwDeleteValueKey (Address: 0x100343b4)
- ZwDeviceIoControlFile (Address: 0x100343ec)
- ZwEnumerateKey (Address: 0x100343c4)
- ZwFlushKey (Address: 0x10034454)
- ZwLoadKey (Address: 0x100343a0)
- ZwOpenDirectoryObject (Address: 0x100343fc)
- ZwOpenFile (Address: 0x10034380)
- ZwOpenKey (Address: 0x100343e0)
- ZwOpenMutant (Address: 0x10034384)
- ZwOpenProcess (Address: 0x10034414)
- ZwOpenSymbolicLinkObject (Address: 0x100343f4)
- ZwQueryAttributesFile (Address: 0x10034370)
- ZwQueryDirectoryObject (Address: 0x100343f0)
- ZwQueryInformationFile (Address: 0x10034410)
- ZwQueryInformationProcess (Address: 0x10034408)
- ZwQueryKey (Address: 0x10034378)
- ZwQuerySymbolicLinkObject (Address: 0x100343e8)
- ZwQuerySystemInformation (Address: 0x10034364)
- ZwQueryValueKey (Address: 0x100343c8)
- ZwReleaseMutant (Address: 0x1003437c)
- ZwSaveKey (Address: 0x100343b8)
- ZwSetSecurityObject (Address: 0x100343d0)
- ZwSetValueKey (Address: 0x100343dc)
- ZwUnloadKey (Address: 0x100343d4)
- ZwWaitForSingleObject (Address: 0x10034374)
RPCRT4.dll
- UuidCreate (Address: 0x100340cc)
SHLWAPI.dll
- PathRemoveBackslashW (Address: 0x100340d4)
WCP.dll
- ?RtlGetFacilityTracingFlags@Rtl@WCP@Windows@@YIKPAU_RTL_TRACING_FACILITY@123@@Z (Address: 0x100340e8)
- ?RtlTraceFormat_PCWSTR@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z (Address: 0x100340ec)
- ?RtlTraceVa@Rtl@WCP@Windows@@YIXKKPAU_RTL_TRACING_FACILITY@123@QBDKPAD@Z (Address: 0x100340dc)
- RtlFreeLUnicodeString (Address: 0x100340e4)
- RtlReportErrorOrigination (Address: 0x100340e0)
WINTRUST.dll
- WinVerifyTrust (Address: 0x100340fc)
- WTHelperGetProvSignerFromChain (Address: 0x100340f8)
- WTHelperProvDataFromStateData (Address: 0x100340f4)