bfsvc.dll
Description: CMI boot file service plug-in
Authors: © Microsoft Corporation. All rights reserved.
Version: 10.0.19041.3385
Architecture: 64-bit
Operating System: Windows NT
SHA256: 08c33f2b25183ebf1861e62e1d99e770
File Size: 268.3 KB
Uploaded At: Dec. 1, 2025, 8:20 a.m.
Views: 14
Exported Functions
- DllCanUnloadNow (Ordinal: 1, Address: 0x7bb0)
- DllCsiGetHandler (Ordinal: 2, Address: 0x7bd0)
Imported DLLs & Functions
ADVAPI32.dll
- AdjustTokenPrivileges (Address: 0x18002bee8)
- ConvertSidToStringSidW (Address: 0x18002beb0)
- ConvertStringSecurityDescriptorToSecurityDescriptorW (Address: 0x18002bea8)
- GetSecurityDescriptorControl (Address: 0x18002bec8)
- GetSecurityDescriptorDacl (Address: 0x18002bee0)
- GetSecurityDescriptorGroup (Address: 0x18002bed8)
- GetSecurityDescriptorOwner (Address: 0x18002bec0)
- GetSecurityDescriptorSacl (Address: 0x18002bef0)
- GetTokenInformation (Address: 0x18002be98)
- LookupPrivilegeValueW (Address: 0x18002bef8)
- OpenProcessToken (Address: 0x18002beb8)
- OpenThreadToken (Address: 0x18002bea0)
- SetNamedSecurityInfoW (Address: 0x18002bed0)
api-ms-win-core-debug-l1-1-0.dll
- DebugBreak (Address: 0x18002c060)
- IsDebuggerPresent (Address: 0x18002c058)
- OutputDebugStringW (Address: 0x18002c068)
api-ms-win-core-errorhandling-l1-1-0.dll
- GetLastError (Address: 0x18002c090)
- SetLastError (Address: 0x18002c078)
- SetUnhandledExceptionFilter (Address: 0x18002c080)
- UnhandledExceptionFilter (Address: 0x18002c088)
api-ms-win-core-handle-l1-1-0.dll
- CloseHandle (Address: 0x18002c0a0)
api-ms-win-core-heap-l1-1-0.dll
- GetProcessHeap (Address: 0x18002c0c8)
- HeapAlloc (Address: 0x18002c0b0)
- HeapDestroy (Address: 0x18002c0c0)
- HeapFree (Address: 0x18002c0b8)
api-ms-win-core-libraryloader-l1-1-0.dll
- DisableThreadLibraryCalls (Address: 0x18002c100)
- FindResourceExW (Address: 0x18002c0f0)
- FreeLibrary (Address: 0x18002c0e0)
- GetModuleFileNameA (Address: 0x18002c108)
- GetModuleHandleExW (Address: 0x18002c0d8)
- GetModuleHandleW (Address: 0x18002c0f8)
- GetProcAddress (Address: 0x18002c110)
- LoadResource (Address: 0x18002c0e8)
api-ms-win-core-localization-l1-2-0.dll
- FormatMessageW (Address: 0x18002c120)
api-ms-win-core-localization-obsolete-l1-2-0.dll
- GetSystemDefaultUILanguage (Address: 0x18002c138)
- GetUserDefaultUILanguage (Address: 0x18002c130)
api-ms-win-core-processenvironment-l1-1-0.dll
- SearchPathW (Address: 0x18002c148)
api-ms-win-core-processthreads-l1-1-0.dll
- GetCurrentProcess (Address: 0x18002c160)
- GetCurrentProcessId (Address: 0x18002c168)
- GetCurrentThreadId (Address: 0x18002c158)
- TerminateProcess (Address: 0x18002c170)
api-ms-win-core-profile-l1-1-0.dll
- QueryPerformanceCounter (Address: 0x18002c180)
api-ms-win-core-registry-l1-1-0.dll
- RegCloseKey (Address: 0x18002c190)
- RegCreateKeyExW (Address: 0x18002c198)
- RegOpenKeyExW (Address: 0x18002c1a8)
- RegQueryValueExW (Address: 0x18002c1a0)
- RegSetValueExW (Address: 0x18002c1b0)
api-ms-win-core-rtlsupport-l1-1-0.dll
- RtlCaptureContext (Address: 0x18002c1d0)
- RtlCompareMemory (Address: 0x18002c1d8)
- RtlLookupFunctionEntry (Address: 0x18002c1c0)
- RtlVirtualUnwind (Address: 0x18002c1c8)
api-ms-win-core-synch-l1-1-0.dll
- AcquireSRWLockExclusive (Address: 0x18002c1f8)
- AcquireSRWLockShared (Address: 0x18002c1e8)
- CreateMutexExW (Address: 0x18002c228)
- CreateSemaphoreExW (Address: 0x18002c260)
- DeleteCriticalSection (Address: 0x18002c250)
- EnterCriticalSection (Address: 0x18002c238)
- InitializeCriticalSection (Address: 0x18002c218)
- InitializeCriticalSectionEx (Address: 0x18002c240)
- LeaveCriticalSection (Address: 0x18002c220)
- OpenSemaphoreW (Address: 0x18002c248)
- ReleaseMutex (Address: 0x18002c210)
- ReleaseSemaphore (Address: 0x18002c208)
- ReleaseSRWLockExclusive (Address: 0x18002c1f0)
- ReleaseSRWLockShared (Address: 0x18002c200)
- WaitForSingleObject (Address: 0x18002c258)
- WaitForSingleObjectEx (Address: 0x18002c230)
api-ms-win-core-synch-l1-2-0.dll
- Sleep (Address: 0x18002c270)
api-ms-win-core-sysinfo-l1-1-0.dll
- GetSystemTimeAsFileTime (Address: 0x18002c288)
- GetSystemWindowsDirectoryW (Address: 0x18002c290)
- GetTickCount (Address: 0x18002c298)
- GetVersionExW (Address: 0x18002c280)
api-ms-win-core-threadpool-l1-2-0.dll
- CloseThreadpoolTimer (Address: 0x18002c2c0)
- CreateThreadpoolTimer (Address: 0x18002c2b0)
- SetThreadpoolTimer (Address: 0x18002c2b8)
- WaitForThreadpoolTimerCallbacks (Address: 0x18002c2a8)
api-ms-win-eventing-provider-l1-1-0.dll
- EventRegister (Address: 0x18002c2d0)
- EventUnregister (Address: 0x18002c2d8)
- EventWriteTransfer (Address: 0x18002c2e0)
imagehlp.dll
- CheckSumMappedFile (Address: 0x18002c2f0)
KERNEL32.dll
- CopyFileExW (Address: 0x18002bf70)
- CreateDirectoryW (Address: 0x18002bff8)
- CreateFileMappingW (Address: 0x18002bfb0)
- CreateFileW (Address: 0x18002bfd0)
- DeleteFileW (Address: 0x18002bf10)
- DeviceIoControl (Address: 0x18002bfe0)
- FindClose (Address: 0x18002bf60)
- FindFirstFileW (Address: 0x18002bf88)
- FindNextFileW (Address: 0x18002bf80)
- FlushFileBuffers (Address: 0x18002bfa0)
- GetCurrentThread (Address: 0x18002bfb8)
- GetFileAttributesW (Address: 0x18002bf58)
- GetFileInformationByHandle (Address: 0x18002bf20)
- GetFileInformationByHandleEx (Address: 0x18002bf28)
- GetFileSizeEx (Address: 0x18002bfe8)
- GetFullPathNameW (Address: 0x18002bf08)
- GetLocaleInfoW (Address: 0x18002bf30)
- GetPrivateProfileSectionW (Address: 0x18002bf68)
- GetVolumeInformationW (Address: 0x18002bf90)
- GetVolumeNameForVolumeMountPointW (Address: 0x18002bfc0)
- GetVolumePathNameW (Address: 0x18002bfd8)
- LoadLibraryExW (Address: 0x18002bf98)
- LoadLibraryW (Address: 0x18002bf40)
- LocalFree (Address: 0x18002bf38)
- MapViewOfFile (Address: 0x18002bfa8)
- MoveFileExW (Address: 0x18002bf48)
- QueryDosDeviceW (Address: 0x18002bff0)
- SetFileAttributesW (Address: 0x18002bf50)
- SetFileInformationByHandle (Address: 0x18002bf18)
- UnmapViewOfFile (Address: 0x18002bfc8)
- WriteFile (Address: 0x18002bf78)
msvcrt.dll
- __C_specific_handler (Address: 0x18002c300)
- __dllonexit (Address: 0x18002c330)
- __iob_func (Address: 0x18002c450)
- _amsg_exit (Address: 0x18002c418)
- _callnewh (Address: 0x18002c400)
- _initterm (Address: 0x18002c438)
- _lock (Address: 0x18002c320)
- _onexit (Address: 0x18002c338)
- _purecall (Address: 0x18002c308)
- _snwscanf_s (Address: 0x18002c3b8)
- _ultow_s (Address: 0x18002c3a0)
- _unlock (Address: 0x18002c328)
- _vsnwprintf (Address: 0x18002c440)
- _vsnwprintf_s (Address: 0x18002c358)
- _wcsicmp (Address: 0x18002c370)
- _wcslwr (Address: 0x18002c3c0)
- _wcsnicmp (Address: 0x18002c378)
- _wcsupr (Address: 0x18002c398)
- _wfopen_s (Address: 0x18002c348)
- _XcptFilter (Address: 0x18002c408)
- bsearch (Address: 0x18002c3f0)
- fclose (Address: 0x18002c350)
- fflush (Address: 0x18002c340)
- free (Address: 0x18002c410)
- fwprintf (Address: 0x18002c360)
- malloc (Address: 0x18002c388)
- memcmp (Address: 0x18002c428)
- memcpy (Address: 0x18002c430)
- memcpy_s (Address: 0x18002c448)
- memmove (Address: 0x18002c3f8)
- memmove_s (Address: 0x18002c318)
- memset (Address: 0x18002c458)
- strcpy_s (Address: 0x18002c3d8)
- strncmp (Address: 0x18002c3e0)
- swprintf_s (Address: 0x18002c420)
- wcscat_s (Address: 0x18002c380)
- wcschr (Address: 0x18002c390)
- wcscpy_s (Address: 0x18002c368)
- wcsncmp (Address: 0x18002c3e8)
- wcsncpy_s (Address: 0x18002c3b0)
- wcsnlen (Address: 0x18002c3d0)
- wcsrchr (Address: 0x18002c310)
- wcsstr (Address: 0x18002c3c8)
- wcstoul (Address: 0x18002c3a8)
ntdll.dll
- LdrAccessResource (Address: 0x18002c4d0)
- LdrFindResource_U (Address: 0x18002c4c8)
- LdrGetDllHandle (Address: 0x18002c688)
- LdrGetProcedureAddress (Address: 0x18002c680)
- NtAdjustPrivilegesToken (Address: 0x18002c6b0)
- NtClose (Address: 0x18002c6e0)
- NtCreateEvent (Address: 0x18002c490)
- NtDeviceIoControlFile (Address: 0x18002c480)
- NtEnumerateBootEntries (Address: 0x18002c5e0)
- NtOpenDirectoryObject (Address: 0x18002c5d0)
- NtOpenFile (Address: 0x18002c4b8)
- NtOpenKey (Address: 0x18002c570)
- NtOpenProcess (Address: 0x18002c5a0)
- NtOpenProcessTokenEx (Address: 0x18002c6b8)
- NtOpenSymbolicLinkObject (Address: 0x18002c560)
- NtOpenThreadTokenEx (Address: 0x18002c6c0)
- NtQueryBootEntryOrder (Address: 0x18002c5b8)
- NtQueryBootOptions (Address: 0x18002c5c0)
- NtQueryDirectoryObject (Address: 0x18002c5d8)
- NtQueryInformationFile (Address: 0x18002c498)
- NtQueryInformationProcess (Address: 0x18002c6e8)
- NtQueryInformationThread (Address: 0x18002c4a0)
- NtQuerySymbolicLinkObject (Address: 0x18002c578)
- NtQuerySystemInformation (Address: 0x18002c4c0)
- NtQueryValueKey (Address: 0x18002c5b0)
- NtReadFile (Address: 0x18002c470)
- NtSetInformationFile (Address: 0x18002c4e0)
- NtSetInformationThread (Address: 0x18002c478)
- NtTranslateFilePath (Address: 0x18002c5c8)
- NtWaitForSingleObject (Address: 0x18002c4b0)
- NtWriteFile (Address: 0x18002c6d0)
- RtlAddAccessAllowedAceEx (Address: 0x18002c580)
- RtlAllocateAndInitializeSid (Address: 0x18002c588)
- RtlAllocateHeap (Address: 0x18002c4f8)
- RtlAppendUnicodeToString (Address: 0x18002c510)
- RtlCreateAcl (Address: 0x18002c6d8)
- RtlCreateSecurityDescriptor (Address: 0x18002c5a8)
- RtlFreeHeap (Address: 0x18002c4f0)
- RtlFreeSid (Address: 0x18002c598)
- RtlFreeUnicodeString (Address: 0x18002c4d8)
- RtlGUIDFromString (Address: 0x18002c508)
- RtlImageNtHeader (Address: 0x18002c488)
- RtlImpersonateSelf (Address: 0x18002c6c8)
- RtlInitAnsiString (Address: 0x18002c698)
- RtlInitUnicodeString (Address: 0x18002c468)
- RtlLengthSecurityDescriptor (Address: 0x18002c550)
- RtlLengthSid (Address: 0x18002c590)
- RtlNtStatusToDosError (Address: 0x18002c4a8)
- RtlSetDaclSecurityDescriptor (Address: 0x18002c568)
- RtlSetOwnerSecurityDescriptor (Address: 0x18002c558)
- RtlStringFromGUID (Address: 0x18002c4e8)
- ZwAllocateUuids (Address: 0x18002c650)
- ZwClose (Address: 0x18002c548)
- ZwCreateFile (Address: 0x18002c5e8)
- ZwCreateKey (Address: 0x18002c5f0)
- ZwDeleteKey (Address: 0x18002c618)
- ZwDeleteValueKey (Address: 0x18002c608)
- ZwDeviceIoControlFile (Address: 0x18002c660)
- ZwEnumerateKey (Address: 0x18002c620)
- ZwFlushKey (Address: 0x18002c600)
- ZwLoadKey (Address: 0x18002c5f8)
- ZwOpenDirectoryObject (Address: 0x18002c678)
- ZwOpenFile (Address: 0x18002c538)
- ZwOpenKey (Address: 0x18002c648)
- ZwOpenMutant (Address: 0x18002c540)
- ZwOpenProcess (Address: 0x18002c6a8)
- ZwOpenSymbolicLinkObject (Address: 0x18002c670)
- ZwQueryAttributesFile (Address: 0x18002c518)
- ZwQueryDirectoryObject (Address: 0x18002c668)
- ZwQueryInformationFile (Address: 0x18002c6a0)
- ZwQueryInformationProcess (Address: 0x18002c690)
- ZwQueryKey (Address: 0x18002c528)
- ZwQuerySymbolicLinkObject (Address: 0x18002c658)
- ZwQuerySystemInformation (Address: 0x18002c500)
- ZwQueryValueKey (Address: 0x18002c628)
- ZwReleaseMutant (Address: 0x18002c530)
- ZwSaveKey (Address: 0x18002c610)
- ZwSetSecurityObject (Address: 0x18002c630)
- ZwSetValueKey (Address: 0x18002c640)
- ZwUnloadKey (Address: 0x18002c638)
- ZwWaitForSingleObject (Address: 0x18002c520)
RPCRT4.dll
- UuidCreate (Address: 0x18002c008)
SHLWAPI.dll
- PathRemoveBackslashW (Address: 0x18002c018)
WCP.dll
- ?RtlGetFacilityTracingFlags@Rtl@WCP@Windows@@YAKPEAU_RTL_TRACING_FACILITY@123@@Z (Address: 0x18002c038)
- ?RtlTraceFormat_PCWSTR@Rtl@WCP@Windows@@YAXPEAUIRtlFormattedOutputStream@13@PEBX@Z (Address: 0x18002c028)
- ?RtlTraceVa@Rtl@WCP@Windows@@YAXKKPEAU_RTL_TRACING_FACILITY@123@QEBD_KPEAD@Z (Address: 0x18002c030)
- RtlFreeLUnicodeString (Address: 0x18002c048)
- RtlReportErrorOrigination (Address: 0x18002c040)