efswrt.dll

v10.0.19041.5848 32-bit Windows NT Analyzed
Description
Storage Protection Windows Runtime DLL
Authors
© Microsoft Corporation. All rights reserved.
File size
604.0 KB
Uploaded
2025-12-01 07:56
Views
77
SHA-256
61fa70d82ac4a49070bd5f12546596c4

Exported functions 31

CdplGetFileProtectionLevel #1 · 0x34300
CdplIsAppAllowedToRun #2 · 0x345e0
CdplIsAppDataProtectionSupported #3 · 0x2b460
CdplIsSupported #4 · 0x34c90
CdplProtectFileToLevel #5 · 0x34210
CdplProtectFileToLevelWithResult #6 · 0x340f0
CdplProtectKnownUserFolders #7 · 0x34350
CdplProtectSecretToLevel #8 · 0x34550
CdplUnprotectSecret #9 · 0x345c0
DllCanUnloadNow #10 · 0x24940
DllGetActivationFactory #11 · 0x24980
DllGetClassObject #12 · 0x249a0
DpmBufferFree #13 · 0x2b350
DpmProtectSecretToIdentity #14 · 0x2b130
DpmStreamClose #15 · 0x2b340
DpmStreamOpenToProtectToIdentity #16 · 0x2b260
DpmStreamOpenToUnprotect #17 · 0x2b300
DpmStreamUpdate #18 · 0x2b320
DpmUnprotectSecret #19 · 0x2b200
EnterpriseDataCopyProtection #20 · 0x2a020
EnterpriseDataGetStatus #21 · 0x2a6a0
EnterpriseDataProtect #22 · 0x29be0
EnterpriseDataRevoke #23 · 0x2a2e0
FreeIdentityProtectorList #24 · 0x2b110
GetEnterpriseActionForCopy #25 · 0x2ab30
GetEnterpriseIdForNetworkPath #26 · 0x2a910
ProtectFileToEnterpriseIdentity #27 · 0x2b360
ProtectFileToIdentity #28 · 0x29f20
ProtectOrReprotectFileToIdentity #29 · 0x2b3b0
QueryIdentityProtectors #30 · 0x2afa0
UnprotectFile #31 · 0x2b380

Imported DLLs & functions 333

api-ms-win-appmodel-runtime-internal-l1-1-3.dll 1
CouldMultiUserAppsBehaviorBePossibleForPackage 0x10089070
api-ms-win-appmodel-runtime-l1-1-0.dll 5
GetPackageFamilyName 0x10089080
GetPackageFullName 0x1008907c
GetPackagesByPackageFamily 0x10089088
PackageFamilyNameFromFullName 0x10089078
PackageNameAndPublisherIdFromFamilyName 0x10089084
api-ms-win-appmodel-runtime-l1-1-1.dll 1
GetPackageFullNameFromToken 0x10089090
api-ms-win-core-apiquery-l1-1-0.dll 1
ApiSetQueryApiSetPresence 0x10089098
api-ms-win-core-com-l1-1-0.dll 17
CoCreateFreeThreadedMarshaler 0x100890a8
CoCreateInstance 0x100890a4
CoDecrementMTAUsage 0x100890d0
CoGetApartmentType 0x100890a0
CoGetCallContext 0x100890b4
CoGetCallerTID 0x100890cc
CoGetInterfaceAndReleaseStream 0x100890d8
CoGetMalloc 0x100890c8
CoIncrementMTAUsage 0x100890c4
CoMarshalInterface 0x100890b0
CoMarshalInterThreadInterfaceInStream 0x100890c0
CoReleaseMarshalData 0x100890b8
CoTaskMemAlloc 0x100890d4
CoTaskMemFree 0x100890dc
CoTaskMemRealloc 0x100890e0
CoWaitForMultipleHandles 0x100890ac
CreateStreamOnHGlobal 0x100890bc
api-ms-win-core-com-l1-1-1.dll 1
RoGetAgileReference 0x100890e8
api-ms-win-core-com-midlproxystub-l1-1-0.dll 23
CStdStubBuffer2_Connect 0x10089148
CStdStubBuffer2_CountRefs 0x10089138
CStdStubBuffer2_Disconnect 0x10089124
CStdStubBuffer2_QueryInterface 0x10089118
NdrProxyForwardingFunction3 0x100890f0
NdrProxyForwardingFunction4 0x10089110
NdrProxyForwardingFunction5 0x10089108
ObjectStublessClient10 0x100890f8
ObjectStublessClient11 0x1008913c
ObjectStublessClient12 0x10089144
ObjectStublessClient13 0x1008911c
ObjectStublessClient14 0x10089140
ObjectStublessClient15 0x10089128
ObjectStublessClient16 0x100890f4
ObjectStublessClient17 0x100890fc
ObjectStublessClient18 0x10089130
ObjectStublessClient19 0x10089114
ObjectStublessClient20 0x1008912c
ObjectStublessClient3 0x10089134
ObjectStublessClient6 0x1008910c
ObjectStublessClient7 0x10089120
ObjectStublessClient8 0x10089104
ObjectStublessClient9 0x10089100
api-ms-win-core-debug-l1-1-0.dll 3
DebugBreak 0x10089158
IsDebuggerPresent 0x10089154
OutputDebugStringW 0x10089150
api-ms-win-core-delayload-l1-1-0.dll 1
DelayLoadFailureHook 0x10089160
api-ms-win-core-delayload-l1-1-1.dll 1
ResolveDelayLoadedAPI 0x10089168
api-ms-win-core-errorhandling-l1-1-0.dll 5
GetLastError 0x10089174
RaiseException 0x10089180
SetLastError 0x10089170
SetUnhandledExceptionFilter 0x1008917c
UnhandledExceptionFilter 0x10089178
api-ms-win-core-file-l1-1-0.dll 9
CreateFileW 0x100891a0
FindClose 0x10089190
FindFirstFileW 0x100891a4
FindNextFileW 0x1008918c
GetDriveTypeW 0x100891a8
GetFileAttributesW 0x1008919c
GetFullPathNameW 0x10089198
GetLongPathNameW 0x10089194
GetVolumePathNameW 0x10089188
api-ms-win-core-file-l1-2-0.dll 2
GetTempPathW 0x100891b0
GetVolumeNameForVolumeMountPointW 0x100891b4
api-ms-win-core-file-l2-1-0.dll 1
GetFileInformationByHandleEx 0x100891bc
api-ms-win-core-handle-l1-1-0.dll 2
CloseHandle 0x100891c4
DuplicateHandle 0x100891c8
api-ms-win-core-heap-l1-1-0.dll 3
GetProcessHeap 0x100891d0
HeapAlloc 0x100891d8
HeapFree 0x100891d4
api-ms-win-core-heap-l2-1-0.dll 2
LocalAlloc 0x100891e4
LocalFree 0x100891e0
api-ms-win-core-libraryloader-l1-2-0.dll 10
DisableThreadLibraryCalls 0x100891f0
FindStringOrdinal 0x100891fc
FreeLibrary 0x100891f8
GetModuleFileNameA 0x10089208
GetModuleFileNameW 0x1008920c
GetModuleHandleExW 0x100891ec
GetModuleHandleW 0x10089204
GetProcAddress 0x100891f4
LoadLibraryExW 0x10089200
LoadStringW 0x10089210
api-ms-win-core-localization-l1-2-0.dll 2
FormatMessageW 0x1008921c
IdnToAscii 0x10089218
api-ms-win-core-marshal-l1-1-0.dll 4
HWND_UserFree 0x10089224
HWND_UserMarshal 0x10089230
HWND_UserSize 0x1008922c
HWND_UserUnmarshal 0x10089228
api-ms-win-core-path-l1-1-0.dll 3
PathCchRemoveFileSpec 0x10089240
PathCchSkipRoot 0x1008923c
PathIsUNCEx 0x10089238
api-ms-win-core-processenvironment-l1-1-0.dll 1
ExpandEnvironmentStringsW 0x10089248
api-ms-win-core-processthreads-l1-1-0.dll 8
GetCurrentProcess 0x10089258
GetCurrentProcessId 0x10089264
GetCurrentThread 0x1008926c
GetCurrentThreadId 0x10089250
GetProcessId 0x1008925c
OpenProcessToken 0x10089260
OpenThreadToken 0x10089268
TerminateProcess 0x10089254
api-ms-win-core-processthreads-l1-1-1.dll 2
GetProcessMitigationPolicy 0x10089278
OpenProcess 0x10089274
api-ms-win-core-profile-l1-1-0.dll 2
QueryPerformanceCounter 0x10089280
QueryPerformanceFrequency 0x10089284
api-ms-win-core-psapi-l1-1-0.dll 1
QueryFullProcessImageNameW 0x1008928c
api-ms-win-core-registry-l1-1-0.dll 7
RegCloseKey 0x100892ac
RegCreateKeyExW 0x100892a4
RegGetValueW 0x1008929c
RegNotifyChangeKeyValue 0x100892a0
RegOpenCurrentUser 0x100892a8
RegOpenKeyExW 0x10089298
RegQueryValueExW 0x10089294
api-ms-win-core-shlwapi-legacy-l1-1-0.dll 1
PathFindExtensionW 0x100892b4
api-ms-win-core-shlwapi-obsolete-l1-1-0.dll 1
StrStrIW 0x100892bc
api-ms-win-core-string-l1-1-0.dll 1
CompareStringOrdinal 0x100892c4
api-ms-win-core-synch-l1-1-0.dll 24
AcquireSRWLockExclusive 0x100892dc
AcquireSRWLockShared 0x10089304
CreateEventExW 0x10089318
CreateMutexExW 0x10089300
CreateMutexW 0x100892e4
CreateSemaphoreExW 0x100892e0
DeleteCriticalSection 0x10089320
EnterCriticalSection 0x10089308
InitializeCriticalSection 0x100892ec
InitializeCriticalSectionEx 0x1008931c
InitializeSRWLock 0x1008930c
LeaveCriticalSection 0x10089314
OpenSemaphoreW 0x10089310
ReleaseMutex 0x100892d4
ReleaseSemaphore 0x100892cc
ReleaseSRWLockExclusive 0x100892d8
ReleaseSRWLockShared 0x100892fc
SetEvent 0x100892f8
TryAcquireSRWLockExclusive 0x100892e8
TryAcquireSRWLockShared 0x10089324
TryEnterCriticalSection 0x10089328
WaitForMultipleObjectsEx 0x100892f0
WaitForSingleObject 0x100892d0
WaitForSingleObjectEx 0x100892f4
api-ms-win-core-synch-l1-2-0.dll 8
InitOnceBeginInitialize 0x10089330
InitOnceComplete 0x1008934c
InitOnceExecuteOnce 0x10089340
Sleep 0x10089338
SleepConditionVariableSRW 0x1008933c
WaitOnAddress 0x10089334
WakeAllConditionVariable 0x10089344
WakeByAddressAll 0x10089348
api-ms-win-core-sysinfo-l1-1-0.dll 2
GetSystemTimeAsFileTime 0x10089358
GetTickCount 0x10089354
api-ms-win-core-threadpool-l1-2-0.dll 12
CloseThreadpoolTimer 0x1008938c
CloseThreadpoolWait 0x10089384
CloseThreadpoolWork 0x10089374
CreateThreadpoolTimer 0x1008937c
CreateThreadpoolWait 0x10089368
CreateThreadpoolWork 0x10089364
FreeLibraryWhenCallbackReturns 0x10089378
SetThreadpoolTimer 0x10089388
SetThreadpoolWait 0x1008936c
SubmitThreadpoolWork 0x10089380
WaitForThreadpoolTimerCallbacks 0x10089370
WaitForThreadpoolWaitCallbacks 0x10089360
api-ms-win-core-url-l1-1-0.dll 1
UrlGetPartW 0x10089394
api-ms-win-core-util-l1-1-0.dll 2
DecodePointer 0x1008939c
EncodePointer 0x100893a0
api-ms-win-core-winrt-error-l1-1-0.dll 5
GetRestrictedErrorInfo 0x100893b8
RoOriginateError 0x100893a8
RoOriginateErrorW 0x100893b4
RoTransformError 0x100893b0
SetRestrictedErrorInfo 0x100893ac
api-ms-win-core-winrt-error-l1-1-1.dll 3
IsErrorPropagationEnabled 0x100893c4
RoGetMatchingRestrictedErrorInfo 0x100893c8
RoReportFailedDelegate 0x100893c0
api-ms-win-core-winrt-l1-1-0.dll 1
RoGetActivationFactory 0x100893d0
api-ms-win-core-winrt-robuffer-l1-1-0.dll 1
RoGetBufferMarshaler 0x100893d8
api-ms-win-core-winrt-string-l1-1-0.dll 12
HSTRING_UserFree 0x100893e8
HSTRING_UserMarshal 0x10089408
HSTRING_UserSize 0x1008940c
HSTRING_UserUnmarshal 0x100893fc
WindowsCreateString 0x100893ec
WindowsCreateStringReference 0x100893e4
WindowsDeleteString 0x100893f8
WindowsDuplicateString 0x10089400
WindowsGetStringLen 0x10089404
WindowsGetStringRawBuffer 0x100893e0
WindowsIsStringEmpty 0x100893f0
WindowsStringHasEmbeddedNull 0x100893f4
api-ms-win-eventing-classicprovider-l1-1-0.dll 6
GetTraceEnableFlags 0x10089428
GetTraceEnableLevel 0x10089424
GetTraceLoggerHandle 0x1008941c
RegisterTraceGuidsW 0x10089420
TraceMessage 0x10089418
UnregisterTraceGuids 0x10089414
api-ms-win-eventing-provider-l1-1-0.dll 6
EventActivityIdControl 0x1008943c
EventProviderEnabled 0x10089430
EventRegister 0x10089444
EventSetInformation 0x10089434
EventUnregister 0x10089438
EventWriteTransfer 0x10089440
api-ms-win-security-base-l1-1-0.dll 9
CopySid 0x10089454
EqualSid 0x10089464
GetAce 0x1008946c
GetLengthSid 0x1008944c
GetSidSubAuthority 0x10089450
GetSidSubAuthorityCount 0x10089458
GetTokenInformation 0x1008945c
ImpersonateLoggedOnUser 0x10089468
RevertToSelf 0x10089460
api-ms-win-security-sddl-l1-1-0.dll 2
ConvertSidToStringSidW 0x10089474
ConvertStringSidToSidW 0x10089478
api-ms-win-service-private-l1-1-0.dll 1
I_QueryTagInformation 0x10089480
combase.dll 3
0x10089490
0x10089488
0x1008948c
MPR.dll 1
WNetGetUniversalNameW 0x10089000
msvcrt.dll 47
__CxxFrameHandler3 0x1008954c
__dllonexit 0x100894f4
_amsg_exit 0x100894bc
_callnewh 0x100894b8
_CxxThrowException 0x100894a8
_except_handler4_common 0x10089540
_initterm 0x100894c4
_lock 0x100894ec
_onexit 0x10089500
_purecall 0x100894d8
_ui64tow_s 0x100894d4
_unlock 0x100894f0
_vsnprintf_s 0x100894e8
_vsnwprintf 0x10089548
_wcsicmp 0x100894e4
_wcsnicmp 0x10089524
_XcptFilter 0x10089498
??_V@YAXPAX@Z 0x10089510
??0exception@@QAE@ABQBD@Z 0x100894b4
??0exception@@QAE@ABQBDH@Z 0x100894b0
??0exception@@QAE@ABV0@@Z 0x100894f8
??0exception@@QAE@XZ 0x100894fc
??1exception@@UAE@XZ 0x10089504
??1type_info@@UAE@XZ 0x10089508
??3@YAXPAX@Z 0x1008950c
?terminate@@YAXXZ 0x100894dc
?what@exception@@UBEPBDXZ 0x100894ac
free 0x100894c0
iswalpha 0x10089520
malloc 0x100894c8
memcmp 0x100894a4
memcpy 0x100894a0
memcpy_s 0x10089544
memmove 0x1008949c
memmove_s 0x100894cc
memset 0x10089550
qsort 0x100894e0
realloc 0x10089514
toupper 0x1008953c
wcschr 0x10089534
wcscpy_s 0x1008951c
wcsncmp 0x10089528
wcsnlen 0x10089530
wcsrchr 0x100894d0
wcsstr 0x1008952c
wcstok_s 0x10089518
wcstoul 0x10089538
ntdll.dll 42
NtClose 0x10089564
NtDeviceIoControlFile 0x10089568
NtDuplicateObject 0x10089560
NtDuplicateToken 0x10089570
NtFsControlFile 0x1008959c
NtOpenFile 0x10089558
NtOpenProcessToken 0x10089574
NtOpenThreadToken 0x1008955c
NtQuerySecurityAttributesToken 0x1008957c
NtQuerySecurityObject 0x100895a4
NtQueryWnfStateData 0x100895d8
NtSetInformationThread 0x1008956c
NtSetSecurityObject 0x100895bc
RtlAddAccessAllowedAce 0x100895b0
RtlAddAce 0x100895b8
RtlAllocateHeap 0x10089588
RtlCompareMemory 0x10089578
RtlCompareUnicodeString 0x1008958c
RtlConvertSidToUnicodeString 0x100895e4
RtlCopyUnicodeString 0x10089584
RtlCreateAcl 0x100895ac
RtlCreateSecurityDescriptor 0x100895fc
RtlFreeHeap 0x10089580
RtlFreeUnicodeString 0x100895f8
RtlGetAce 0x100895c4
RtlGetDaclSecurityDescriptor 0x100895a0
RtlInitUnicodeString 0x100895cc
RtlIsMultiSessionSku 0x10089598
RtlLengthSid 0x100895b4
RtlNtStatusToDosError 0x10089594
RtlPublishWnfStateData 0x100895d0
RtlQueryInformationAcl 0x100895c0
RtlQueryPackageClaims 0x10089590
RtlSetDaclSecurityDescriptor 0x100895c8
RtlSubscribeWnfStateChangeNotification 0x100895dc
RtlUnsubscribeWnfNotificationWaitForCompletion 0x100895d4
ZwClose 0x100895ec
ZwOpenProcessTokenEx 0x100895f0
ZwOpenThreadTokenEx 0x100895e8
ZwQueryInformationProcess 0x100895f4
ZwQueryInformationToken 0x100895e0
ZwQueryWnfStateData 0x100895a8
OLEAUT32.dll 1
SysFreeString 0x10089008
RPCRT4.dll 23
CStdStubBuffer_AddRef 0x10089044
CStdStubBuffer_Connect 0x10089058
CStdStubBuffer_CountRefs 0x1008905c
CStdStubBuffer_DebugServerQueryInterface 0x10089048
CStdStubBuffer_DebugServerRelease 0x10089060
CStdStubBuffer_Disconnect 0x10089064
CStdStubBuffer_Invoke 0x1008902c
CStdStubBuffer_IsIIDSupported 0x10089054
CStdStubBuffer_QueryInterface 0x10089028
I_RpcBindingInqLocalClientPID 0x1008904c
IUnknown_AddRef_Proxy 0x1008903c
IUnknown_QueryInterface_Proxy 0x10089068
IUnknown_Release_Proxy 0x10089034
NdrCStdStubBuffer_Release 0x10089018
NdrCStdStubBuffer2_Release 0x10089024
NdrDllCanUnloadNow 0x10089010
NdrDllGetClassObject 0x1008901c
NdrOleAllocate 0x10089040
NdrOleFree 0x10089050
NdrStubCall2 0x10089038
NdrStubForwardingFunction 0x10089030
UuidCreateNil 0x10089020
UuidFromStringW 0x10089014