WofUtil.dll

Description: Windows Overlay File System Filter user mode API

Version: 10.0.19041.5438

Architecture: 64-bit

Operating System: Windows NT

SHA256: bbe6ccdc5afb34fbf2179037b30913f5

File Size: 36.0 KB

Uploaded At: Dec. 1, 2025, 7:45 a.m.

Views: 5

Exported Functions

WofEnumEntries (Ordinal: 1, Address: 0x15f0)
WofFileEnumFiles (Ordinal: 2, Address: 0x23b0)
WofGetDriverVersion (Ordinal: 3, Address: 0x1b20)
WofIsExternalFile (Ordinal: 4, Address: 0x1a40)
WofSetFileDataLocation (Ordinal: 5, Address: 0x1880)
WofShouldCompressBinaries (Ordinal: 6, Address: 0x45e0)
WofWimAddEntry (Ordinal: 7, Address: 0x1010)
WofWimEnumFiles (Ordinal: 8, Address: 0x2380)
WofWimRemoveEntry (Ordinal: 9, Address: 0x1520)
WofWimSuspendEntry (Ordinal: 10, Address: 0x1450)
WofWimUpdateEntry (Ordinal: 11, Address: 0x1280)

Imported DLLs & Functions

api-ms-win-core-errorhandling-l1-1-0.dll

GetLastError (Address: 0x180007128)
SetLastError (Address: 0x180007130)
SetUnhandledExceptionFilter (Address: 0x180007140)
UnhandledExceptionFilter (Address: 0x180007138)

api-ms-win-core-file-l1-1-0.dll

CreateFileW (Address: 0x180007170)
FindClose (Address: 0x180007150)
GetDriveTypeW (Address: 0x180007158)
GetFinalPathNameByHandleW (Address: 0x180007160)
GetVolumePathNameW (Address: 0x180007168)

api-ms-win-core-file-l1-2-0.dll

GetVolumeNameForVolumeMountPointW (Address: 0x180007188)
GetVolumePathNamesForVolumeNameW (Address: 0x180007180)

api-ms-win-core-handle-l1-1-0.dll

CloseHandle (Address: 0x180007198)

api-ms-win-core-heap-l1-1-0.dll

GetProcessHeap (Address: 0x1800071a8)
HeapAlloc (Address: 0x1800071b0)
HeapFree (Address: 0x1800071b8)

api-ms-win-core-io-l1-1-0.dll

DeviceIoControl (Address: 0x1800071c8)
GetOverlappedResult (Address: 0x1800071d0)

api-ms-win-core-kernel32-legacy-l1-1-0.dll

LoadLibraryW (Address: 0x1800071e0)

api-ms-win-core-kernel32-legacy-l1-1-1.dll

PowerCreateRequest (Address: 0x1800071f0)

api-ms-win-core-libraryloader-l1-2-0.dll

FreeLibrary (Address: 0x180007208)
GetModuleHandleW (Address: 0x180007200)
GetProcAddress (Address: 0x180007210)

api-ms-win-core-processthreads-l1-1-0.dll

CreateThread (Address: 0x180007238)
GetCurrentProcess (Address: 0x180007250)
GetCurrentProcessId (Address: 0x180007240)
GetCurrentThread (Address: 0x180007228)
GetCurrentThreadId (Address: 0x180007248)
OpenThreadToken (Address: 0x180007220)
TerminateProcess (Address: 0x180007230)

api-ms-win-core-profile-l1-1-0.dll

QueryPerformanceCounter (Address: 0x180007260)
QueryPerformanceFrequency (Address: 0x180007268)

api-ms-win-core-psapi-l1-1-0.dll

K32GetPerformanceInfo (Address: 0x180007278)

api-ms-win-core-registry-l1-1-0.dll

RegCloseKey (Address: 0x1800072a0)
RegCreateKeyExW (Address: 0x180007298)
RegOpenKeyExW (Address: 0x180007290)
RegQueryValueExW (Address: 0x1800072a8)
RegSetValueExW (Address: 0x180007288)

api-ms-win-core-synch-l1-1-0.dll

CreateEventW (Address: 0x1800072c0)
CreateMutexW (Address: 0x1800072b8)
ReleaseMutex (Address: 0x1800072d8)
SetEvent (Address: 0x1800072c8)
WaitForSingleObject (Address: 0x1800072d0)

api-ms-win-core-synch-l1-2-0.dll

Sleep (Address: 0x1800072e8)

api-ms-win-core-sysinfo-l1-1-0.dll

GetSystemTimeAsFileTime (Address: 0x1800072f8)
GetTickCount (Address: 0x180007308)
GetVersionExW (Address: 0x180007300)

api-ms-win-core-sysinfo-l1-2-0.dll

GetNativeSystemInfo (Address: 0x180007318)

api-ms-win-security-base-l1-1-0.dll

ImpersonateLoggedOnUser (Address: 0x180007330)
RevertToSelf (Address: 0x180007328)

msvcrt.dll

__C_specific_handler (Address: 0x180007360)
_amsg_exit (Address: 0x180007380)
_initterm (Address: 0x180007368)
_vsnwprintf (Address: 0x180007358)
_XcptFilter (Address: 0x180007350)
free (Address: 0x180007378)
malloc (Address: 0x180007370)
memcpy (Address: 0x180007388)
memset (Address: 0x180007390)
printf (Address: 0x180007348)
wcschr (Address: 0x180007340)

ntdll.dll

NtClose (Address: 0x1800073a0)
NtCreateFile (Address: 0x180007428)
NtPowerInformation (Address: 0x1800073d8)
NtQueryInformationFile (Address: 0x180007430)
NtQueryVolumeInformationFile (Address: 0x1800073b0)
NtSetInformationThread (Address: 0x180007448)
RtlAcquirePrivilege (Address: 0x1800073d0)
RtlAllocateHeap (Address: 0x180007408)
RtlCaptureContext (Address: 0x180007410)
RtlCompressBuffer (Address: 0x1800073c8)
RtlDecompressBufferEx (Address: 0x1800073c0)
RtlDosPathNameToNtPathName_U (Address: 0x1800073a8)
RtlDosPathNameToNtPathName_U_WithStatus (Address: 0x180007440)
RtlFreeHeap (Address: 0x1800073b8)
RtlGetCompressionWorkSpaceSize (Address: 0x1800073e0)
RtlGetNtProductType (Address: 0x1800073e8)
RtlGetPersistedStateLocation (Address: 0x1800073f8)
RtlInitializeCriticalSection (Address: 0x1800073f0)
RtlLookupFunctionEntry (Address: 0x180007418)
RtlNtStatusToDosError (Address: 0x180007438)
RtlRandom (Address: 0x180007400)
RtlVirtualUnwind (Address: 0x180007420)