bfsvc.dll
Description: CMI boot file service plug-in
Authors: © Microsoft Corporation. All rights reserved.
Version: 10.0.19041.6271
Architecture: 64-bit
Operating System: Windows NT
SHA256: b51f008135de3128ad2b645f22b59af1
File Size: 281.9 KB
Uploaded At: Dec. 1, 2025, 8:21 a.m.
Views: 17
Exported Functions
- DllCanUnloadNow (Ordinal: 1, Address: 0x7f70)
- DllCsiGetHandler (Ordinal: 2, Address: 0x7f90)
Imported DLLs & Functions
ADVAPI32.dll
- AdjustTokenPrivileges (Address: 0x18002dee8)
- ConvertSidToStringSidW (Address: 0x18002df08)
- ConvertStringSecurityDescriptorToSecurityDescriptorW (Address: 0x18002df00)
- DuplicateTokenEx (Address: 0x18002ded0)
- GetSecurityDescriptorControl (Address: 0x18002df18)
- GetSecurityDescriptorDacl (Address: 0x18002df28)
- GetSecurityDescriptorGroup (Address: 0x18002dec0)
- GetSecurityDescriptorOwner (Address: 0x18002df10)
- GetSecurityDescriptorSacl (Address: 0x18002deb8)
- GetTokenInformation (Address: 0x18002def8)
- LookupPrivilegeValueW (Address: 0x18002def0)
- OpenProcessToken (Address: 0x18002dee0)
- OpenThreadToken (Address: 0x18002dec8)
- SetNamedSecurityInfoW (Address: 0x18002df20)
- SetThreadToken (Address: 0x18002ded8)
api-ms-win-core-debug-l1-1-0.dll
- DebugBreak (Address: 0x18002e0d0)
- IsDebuggerPresent (Address: 0x18002e0c8)
- OutputDebugStringW (Address: 0x18002e0c0)
api-ms-win-core-errorhandling-l1-1-0.dll
- GetLastError (Address: 0x18002e0f0)
- SetLastError (Address: 0x18002e0e8)
- SetUnhandledExceptionFilter (Address: 0x18002e0f8)
- UnhandledExceptionFilter (Address: 0x18002e0e0)
api-ms-win-core-handle-l1-1-0.dll
- CloseHandle (Address: 0x18002e108)
api-ms-win-core-heap-l1-1-0.dll
- GetProcessHeap (Address: 0x18002e128)
- HeapAlloc (Address: 0x18002e120)
- HeapDestroy (Address: 0x18002e118)
- HeapFree (Address: 0x18002e130)
api-ms-win-core-libraryloader-l1-1-0.dll
- DisableThreadLibraryCalls (Address: 0x18002e158)
- FindResourceExW (Address: 0x18002e178)
- FreeLibrary (Address: 0x18002e160)
- GetModuleFileNameA (Address: 0x18002e140)
- GetModuleHandleExW (Address: 0x18002e168)
- GetModuleHandleW (Address: 0x18002e170)
- GetProcAddress (Address: 0x18002e150)
- LoadResource (Address: 0x18002e148)
api-ms-win-core-localization-l1-2-0.dll
- FormatMessageW (Address: 0x18002e188)
api-ms-win-core-localization-obsolete-l1-2-0.dll
- GetSystemDefaultUILanguage (Address: 0x18002e1a0)
- GetUserDefaultUILanguage (Address: 0x18002e198)
api-ms-win-core-processenvironment-l1-1-0.dll
- SearchPathW (Address: 0x18002e1b0)
api-ms-win-core-processthreads-l1-1-0.dll
- GetCurrentProcess (Address: 0x18002e1d8)
- GetCurrentProcessId (Address: 0x18002e1d0)
- GetCurrentThreadId (Address: 0x18002e1c0)
- TerminateProcess (Address: 0x18002e1c8)
api-ms-win-core-profile-l1-1-0.dll
- QueryPerformanceCounter (Address: 0x18002e1e8)
api-ms-win-core-registry-l1-1-0.dll
- RegCloseKey (Address: 0x18002e1f8)
- RegCreateKeyExW (Address: 0x18002e208)
- RegOpenKeyExW (Address: 0x18002e210)
- RegQueryValueExW (Address: 0x18002e218)
- RegSetValueExW (Address: 0x18002e200)
api-ms-win-core-rtlsupport-l1-1-0.dll
- RtlCaptureContext (Address: 0x18002e228)
- RtlCompareMemory (Address: 0x18002e230)
- RtlLookupFunctionEntry (Address: 0x18002e240)
- RtlVirtualUnwind (Address: 0x18002e238)
api-ms-win-core-synch-l1-1-0.dll
- AcquireSRWLockExclusive (Address: 0x18002e288)
- AcquireSRWLockShared (Address: 0x18002e278)
- CreateMutexExW (Address: 0x18002e2c8)
- CreateSemaphoreExW (Address: 0x18002e2b0)
- DeleteCriticalSection (Address: 0x18002e298)
- EnterCriticalSection (Address: 0x18002e268)
- InitializeCriticalSection (Address: 0x18002e250)
- InitializeCriticalSectionEx (Address: 0x18002e290)
- LeaveCriticalSection (Address: 0x18002e2b8)
- OpenSemaphoreW (Address: 0x18002e2a8)
- ReleaseMutex (Address: 0x18002e2c0)
- ReleaseSemaphore (Address: 0x18002e258)
- ReleaseSRWLockExclusive (Address: 0x18002e280)
- ReleaseSRWLockShared (Address: 0x18002e270)
- WaitForSingleObject (Address: 0x18002e2a0)
- WaitForSingleObjectEx (Address: 0x18002e260)
api-ms-win-core-synch-l1-2-0.dll
- Sleep (Address: 0x18002e2d8)
api-ms-win-core-sysinfo-l1-1-0.dll
- GetSystemTimeAsFileTime (Address: 0x18002e2f8)
- GetTickCount (Address: 0x18002e2f0)
- GetVersionExW (Address: 0x18002e2e8)
api-ms-win-core-threadpool-l1-2-0.dll
- CloseThreadpoolTimer (Address: 0x18002e310)
- CreateThreadpoolTimer (Address: 0x18002e308)
- SetThreadpoolTimer (Address: 0x18002e320)
- WaitForThreadpoolTimerCallbacks (Address: 0x18002e318)
api-ms-win-eventing-provider-l1-1-0.dll
- EventRegister (Address: 0x18002e330)
- EventUnregister (Address: 0x18002e338)
- EventWriteTransfer (Address: 0x18002e340)
bcrypt.dll
- BCryptCloseAlgorithmProvider (Address: 0x18002e358)
- BCryptCreateHash (Address: 0x18002e370)
- BCryptDestroyHash (Address: 0x18002e360)
- BCryptFinishHash (Address: 0x18002e378)
- BCryptHash (Address: 0x18002e380)
- BCryptHashData (Address: 0x18002e368)
- BCryptOpenAlgorithmProvider (Address: 0x18002e350)
CRYPT32.dll
- CertGetNameStringW (Address: 0x18002df38)
imagehlp.dll
- CheckSumMappedFile (Address: 0x18002e390)
KERNEL32.dll
- CopyFileExW (Address: 0x18002e040)
- CreateDirectoryW (Address: 0x18002e028)
- CreateFileMappingW (Address: 0x18002df80)
- CreateFileW (Address: 0x18002dfd8)
- DeleteFileW (Address: 0x18002df48)
- DeviceIoControl (Address: 0x18002df90)
- FindClose (Address: 0x18002dfe8)
- FindFirstFileW (Address: 0x18002e008)
- FindNextFileW (Address: 0x18002e000)
- FlushFileBuffers (Address: 0x18002df70)
- GetCurrentThread (Address: 0x18002e030)
- GetFileAttributesW (Address: 0x18002dfd0)
- GetFileInformationByHandle (Address: 0x18002df58)
- GetFileInformationByHandleEx (Address: 0x18002df60)
- GetFileSizeEx (Address: 0x18002df98)
- GetFullPathNameW (Address: 0x18002e038)
- GetLocaleInfoW (Address: 0x18002df68)
- GetPrivateProfileSectionW (Address: 0x18002dff0)
- GetVolumeInformationW (Address: 0x18002e010)
- GetVolumeNameForVolumeMountPointW (Address: 0x18002dfc8)
- GetVolumePathNameW (Address: 0x18002dfe0)
- LoadLibraryExW (Address: 0x18002e020)
- LoadLibraryW (Address: 0x18002dfb0)
- LocalAlloc (Address: 0x18002dfa8)
- LocalFree (Address: 0x18002dfa0)
- MapViewOfFile (Address: 0x18002df78)
- MoveFileExW (Address: 0x18002dfb8)
- QueryDosDeviceW (Address: 0x18002e018)
- SetFileAttributesW (Address: 0x18002dfc0)
- SetFileInformationByHandle (Address: 0x18002df50)
- UnmapViewOfFile (Address: 0x18002df88)
- WriteFile (Address: 0x18002dff8)
msvcrt.dll
- __C_specific_handler (Address: 0x18002e3a0)
- __dllonexit (Address: 0x18002e4b8)
- __iob_func (Address: 0x18002e4f8)
- _amsg_exit (Address: 0x18002e3e0)
- _callnewh (Address: 0x18002e3a8)
- _initterm (Address: 0x18002e4a0)
- _lock (Address: 0x18002e4a8)
- _onexit (Address: 0x18002e4c0)
- _purecall (Address: 0x18002e3d8)
- _snwscanf_s (Address: 0x18002e478)
- _ultow_s (Address: 0x18002e458)
- _unlock (Address: 0x18002e4b0)
- _vsnwprintf (Address: 0x18002e3c0)
- _vsnwprintf_s (Address: 0x18002e400)
- _wcsicmp (Address: 0x18002e410)
- _wcslwr (Address: 0x18002e480)
- _wcsnicmp (Address: 0x18002e418)
- _wcsupr (Address: 0x18002e450)
- _wfopen_s (Address: 0x18002e3f0)
- _XcptFilter (Address: 0x18002e4d0)
- bsearch (Address: 0x18002e498)
- fclose (Address: 0x18002e3f8)
- fflush (Address: 0x18002e3e8)
- free (Address: 0x18002e3c8)
- fwprintf (Address: 0x18002e408)
- malloc (Address: 0x18002e3d0)
- memcmp (Address: 0x18002e4e0)
- memcpy (Address: 0x18002e4e8)
- memcpy_s (Address: 0x18002e4d8)
- memmove (Address: 0x18002e4f0)
- memmove_s (Address: 0x18002e3b8)
- memset (Address: 0x18002e4c8)
- strcpy_s (Address: 0x18002e468)
- strncmp (Address: 0x18002e490)
- swprintf_s (Address: 0x18002e448)
- wcscat_s (Address: 0x18002e430)
- wcschr (Address: 0x18002e440)
- wcscmp (Address: 0x18002e500)
- wcscpy_s (Address: 0x18002e428)
- wcsncmp (Address: 0x18002e420)
- wcsncpy_s (Address: 0x18002e438)
- wcsnlen (Address: 0x18002e488)
- wcsrchr (Address: 0x18002e3b0)
- wcsstr (Address: 0x18002e470)
- wcstoul (Address: 0x18002e460)
ntdll.dll
- LdrAccessResource (Address: 0x18002e578)
- LdrFindResource_U (Address: 0x18002e570)
- LdrGetDllHandle (Address: 0x18002e6e0)
- LdrGetProcedureAddress (Address: 0x18002e6d8)
- NtAdjustPrivilegesToken (Address: 0x18002e708)
- NtClose (Address: 0x18002e790)
- NtCreateEvent (Address: 0x18002e548)
- NtDeviceIoControlFile (Address: 0x18002e538)
- NtEnumerateBootEntries (Address: 0x18002e770)
- NtOpenDirectoryObject (Address: 0x18002e760)
- NtOpenFile (Address: 0x18002e568)
- NtOpenKey (Address: 0x18002e730)
- NtOpenProcess (Address: 0x18002e520)
- NtOpenProcessTokenEx (Address: 0x18002e710)
- NtOpenSymbolicLinkObject (Address: 0x18002e728)
- NtOpenThreadTokenEx (Address: 0x18002e718)
- NtQueryBootEntryOrder (Address: 0x18002e748)
- NtQueryBootOptions (Address: 0x18002e750)
- NtQueryDirectoryObject (Address: 0x18002e768)
- NtQueryInformationFile (Address: 0x18002e550)
- NtQueryInformationProcess (Address: 0x18002e518)
- NtQueryInformationThread (Address: 0x18002e558)
- NtQuerySymbolicLinkObject (Address: 0x18002e738)
- NtQuerySystemEnvironmentValueEx (Address: 0x18002e798)
- NtQuerySystemInformation (Address: 0x18002e788)
- NtQueryValueKey (Address: 0x18002e740)
- NtReadFile (Address: 0x18002e528)
- NtSetInformationFile (Address: 0x18002e588)
- NtSetInformationThread (Address: 0x18002e530)
- NtTranslateFilePath (Address: 0x18002e758)
- NtWaitForSingleObject (Address: 0x18002e560)
- NtWriteFile (Address: 0x18002e648)
- RtlAddAccessAllowedAceEx (Address: 0x18002e628)
- RtlAllocateAndInitializeSid (Address: 0x18002e630)
- RtlAllocateHeap (Address: 0x18002e5a0)
- RtlAppendUnicodeToString (Address: 0x18002e5b8)
- RtlCreateAcl (Address: 0x18002e678)
- RtlCreateSecurityDescriptor (Address: 0x18002e690)
- RtlFreeHeap (Address: 0x18002e598)
- RtlFreeSid (Address: 0x18002e658)
- RtlFreeUnicodeString (Address: 0x18002e580)
- RtlGUIDFromString (Address: 0x18002e5b0)
- RtlImageNtHeader (Address: 0x18002e540)
- RtlImpersonateSelf (Address: 0x18002e720)
- RtlInitAnsiString (Address: 0x18002e6f0)
- RtlInitUnicodeString (Address: 0x18002e778)
- RtlLengthSecurityDescriptor (Address: 0x18002e5f8)
- RtlLengthSid (Address: 0x18002e638)
- RtlNtStatusToDosError (Address: 0x18002e510)
- RtlSetDaclSecurityDescriptor (Address: 0x18002e608)
- RtlSetOwnerSecurityDescriptor (Address: 0x18002e600)
- RtlStringFromGUID (Address: 0x18002e590)
- ZwAllocateUuids (Address: 0x18002e6a8)
- ZwClose (Address: 0x18002e5f0)
- ZwCreateFile (Address: 0x18002e610)
- ZwCreateKey (Address: 0x18002e618)
- ZwDeleteKey (Address: 0x18002e660)
- ZwDeleteValueKey (Address: 0x18002e780)
- ZwDeviceIoControlFile (Address: 0x18002e6b8)
- ZwEnumerateKey (Address: 0x18002e668)
- ZwFlushKey (Address: 0x18002e640)
- ZwLoadKey (Address: 0x18002e620)
- ZwOpenDirectoryObject (Address: 0x18002e6d0)
- ZwOpenFile (Address: 0x18002e5e0)
- ZwOpenKey (Address: 0x18002e6a0)
- ZwOpenMutant (Address: 0x18002e5e8)
- ZwOpenProcess (Address: 0x18002e700)
- ZwOpenSymbolicLinkObject (Address: 0x18002e6c8)
- ZwQueryAttributesFile (Address: 0x18002e5c0)
- ZwQueryDirectoryObject (Address: 0x18002e6c0)
- ZwQueryInformationFile (Address: 0x18002e6f8)
- ZwQueryInformationProcess (Address: 0x18002e6e8)
- ZwQueryKey (Address: 0x18002e5d0)
- ZwQuerySymbolicLinkObject (Address: 0x18002e6b0)
- ZwQuerySystemInformation (Address: 0x18002e5a8)
- ZwQueryValueKey (Address: 0x18002e670)
- ZwReleaseMutant (Address: 0x18002e5d8)
- ZwSaveKey (Address: 0x18002e650)
- ZwSetSecurityObject (Address: 0x18002e680)
- ZwSetValueKey (Address: 0x18002e698)
- ZwUnloadKey (Address: 0x18002e688)
- ZwWaitForSingleObject (Address: 0x18002e5c8)
RPCRT4.dll
- UuidCreate (Address: 0x18002e050)
SHLWAPI.dll
- PathRemoveBackslashW (Address: 0x18002e060)
WCP.dll
- ?RtlGetFacilityTracingFlags@Rtl@WCP@Windows@@YAKPEAU_RTL_TRACING_FACILITY@123@@Z (Address: 0x18002e088)
- ?RtlTraceFormat_PCWSTR@Rtl@WCP@Windows@@YAXPEAUIRtlFormattedOutputStream@13@PEBX@Z (Address: 0x18002e080)
- ?RtlTraceVa@Rtl@WCP@Windows@@YAXKKPEAU_RTL_TRACING_FACILITY@123@QEBD_KPEAD@Z (Address: 0x18002e070)
- RtlFreeLUnicodeString (Address: 0x18002e090)
- RtlReportErrorOrigination (Address: 0x18002e078)
WINTRUST.dll
- WinVerifyTrust (Address: 0x18002e0b0)
- WTHelperGetProvSignerFromChain (Address: 0x18002e0a8)
- WTHelperProvDataFromStateData (Address: 0x18002e0a0)