securebootai.dll

Description: CSI Secure Boot Servicing Plugin

Authors: © Microsoft Corporation. All rights reserved.

Version: 10.0.19041.6271

Architecture: 64-bit

Operating System: Windows NT

SHA256: f03b3fe138422ea84afd8247c0d999c3

File Size: 420.9 KB

Uploaded At: Dec. 1, 2025, 8:21 a.m.

Views: 26

Exported Functions

  • DllCanUnloadNow (Ordinal: 1, Address: 0xb3c0)
  • DllCsiGetHandler (Ordinal: 2, Address: 0xb3e0)

Imported DLLs & Functions

api-ms-win-core-com-l1-1-0.dll
  • CoCreateInstance (Address: 0x18003f640)
  • CoInitializeEx (Address: 0x18003f638)
  • CoInitializeSecurity (Address: 0x18003f650)
  • CoSetProxyBlanket (Address: 0x18003f648)
  • CoUninitialize (Address: 0x18003f658)
api-ms-win-core-debug-l1-1-0.dll
  • DebugBreak (Address: 0x18003f668)
  • IsDebuggerPresent (Address: 0x18003f670)
  • OutputDebugStringW (Address: 0x18003f678)
api-ms-win-core-errorhandling-l1-1-0.dll
  • GetLastError (Address: 0x18003f6a0)
  • SetLastError (Address: 0x18003f688)
  • SetUnhandledExceptionFilter (Address: 0x18003f690)
  • UnhandledExceptionFilter (Address: 0x18003f698)
api-ms-win-core-file-l1-1-0.dll
  • CreateDirectoryW (Address: 0x18003f720)
  • CreateFileW (Address: 0x18003f748)
  • DeleteFileW (Address: 0x18003f6b8)
  • FindClose (Address: 0x18003f750)
  • FindFirstFileW (Address: 0x18003f730)
  • FindFirstVolumeW (Address: 0x18003f6c0)
  • FindNextFileW (Address: 0x18003f740)
  • FindNextVolumeW (Address: 0x18003f6f0)
  • FindVolumeClose (Address: 0x18003f710)
  • FlushFileBuffers (Address: 0x18003f6f8)
  • GetFileAttributesW (Address: 0x18003f6e8)
  • GetFileInformationByHandle (Address: 0x18003f6d8)
  • GetFileSizeEx (Address: 0x18003f738)
  • GetFullPathNameW (Address: 0x18003f6b0)
  • GetVolumeInformationW (Address: 0x18003f700)
  • GetVolumePathNameW (Address: 0x18003f6e0)
  • QueryDosDeviceW (Address: 0x18003f6c8)
  • ReadFile (Address: 0x18003f728)
  • SetFileAttributesW (Address: 0x18003f718)
  • SetFileInformationByHandle (Address: 0x18003f6d0)
  • WriteFile (Address: 0x18003f708)
api-ms-win-core-file-l1-2-0.dll
  • GetVolumeNameForVolumeMountPointW (Address: 0x18003f760)
api-ms-win-core-file-l2-1-0.dll
  • CopyFileExW (Address: 0x18003f780)
  • GetFileInformationByHandleEx (Address: 0x18003f770)
  • MoveFileExW (Address: 0x18003f778)
api-ms-win-core-handle-l1-1-0.dll
  • CloseHandle (Address: 0x18003f790)
api-ms-win-core-heap-l1-1-0.dll
  • GetProcessHeap (Address: 0x18003f7a8)
  • HeapAlloc (Address: 0x18003f7a0)
  • HeapDestroy (Address: 0x18003f7b8)
  • HeapFree (Address: 0x18003f7b0)
api-ms-win-core-heap-obsolete-l1-1-0.dll
  • LocalAlloc (Address: 0x18003f7c8)
  • LocalFree (Address: 0x18003f7d0)
api-ms-win-core-interlocked-l1-1-0.dll
  • InitializeSListHead (Address: 0x18003f7e0)
api-ms-win-core-io-l1-1-0.dll
  • DeviceIoControl (Address: 0x18003f7f0)
api-ms-win-core-kernel32-legacy-l1-1-0.dll
  • CopyFileW (Address: 0x18003f800)
  • FindResourceW (Address: 0x18003f810)
  • LoadLibraryW (Address: 0x18003f808)
api-ms-win-core-libraryloader-l1-1-0.dll
  • DisableThreadLibraryCalls (Address: 0x18003f840)
  • FindResourceExW (Address: 0x18003f868)
  • FreeLibrary (Address: 0x18003f830)
  • GetModuleFileNameA (Address: 0x18003f858)
  • GetModuleHandleExW (Address: 0x18003f828)
  • GetModuleHandleW (Address: 0x18003f850)
  • GetProcAddress (Address: 0x18003f838)
  • LoadLibraryExW (Address: 0x18003f820)
  • LoadResource (Address: 0x18003f848)
  • SizeofResource (Address: 0x18003f860)
api-ms-win-core-localization-l1-2-0.dll
  • FormatMessageW (Address: 0x18003f878)
  • GetLocaleInfoW (Address: 0x18003f880)
api-ms-win-core-localization-obsolete-l1-2-0.dll
  • GetSystemDefaultUILanguage (Address: 0x18003f890)
  • GetUserDefaultUILanguage (Address: 0x18003f898)
api-ms-win-core-memory-l1-1-0.dll
  • CreateFileMappingW (Address: 0x18003f8b0)
  • MapViewOfFile (Address: 0x18003f8a8)
  • UnmapViewOfFile (Address: 0x18003f8b8)
api-ms-win-core-privateprofile-l1-1-0.dll
  • GetPrivateProfileSectionW (Address: 0x18003f8c8)
api-ms-win-core-processenvironment-l1-1-0.dll
  • SearchPathW (Address: 0x18003f8d8)
api-ms-win-core-processthreads-l1-1-0.dll
  • GetCurrentProcess (Address: 0x18003f8f0)
  • GetCurrentProcessId (Address: 0x18003f918)
  • GetCurrentThread (Address: 0x18003f8f8)
  • GetCurrentThreadId (Address: 0x18003f908)
  • OpenProcessToken (Address: 0x18003f910)
  • OpenThreadToken (Address: 0x18003f8e8)
  • SetThreadToken (Address: 0x18003f900)
  • TerminateProcess (Address: 0x18003f920)
api-ms-win-core-processthreads-l1-1-1.dll
  • IsProcessorFeaturePresent (Address: 0x18003f930)
api-ms-win-core-profile-l1-1-0.dll
  • QueryPerformanceCounter (Address: 0x18003f940)
api-ms-win-core-registry-l1-1-0.dll
  • RegCloseKey (Address: 0x18003f960)
  • RegCreateKeyExW (Address: 0x18003f968)
  • RegDeleteKeyExW (Address: 0x18003f950)
  • RegGetValueW (Address: 0x18003f958)
  • RegOpenKeyExW (Address: 0x18003f980)
  • RegQueryValueExW (Address: 0x18003f970)
  • RegSetValueExW (Address: 0x18003f978)
api-ms-win-core-rtlsupport-l1-1-0.dll
  • RtlCaptureContext (Address: 0x18003f998)
  • RtlCompareMemory (Address: 0x18003f9a8)
  • RtlLookupFunctionEntry (Address: 0x18003f9a0)
  • RtlVirtualUnwind (Address: 0x18003f990)
api-ms-win-core-shlwapi-legacy-l1-1-0.dll
  • PathRemoveBackslashW (Address: 0x18003f9b8)
api-ms-win-core-shlwapi-obsolete-l1-1-0.dll
  • StrCmpIW (Address: 0x18003f9c8)
  • StrStrIW (Address: 0x18003f9d0)
api-ms-win-core-string-l1-1-0.dll
  • MultiByteToWideChar (Address: 0x18003f9e0)
api-ms-win-core-synch-l1-1-0.dll
  • AcquireSRWLockExclusive (Address: 0x18003fa18)
  • AcquireSRWLockShared (Address: 0x18003fa10)
  • CreateMutexExW (Address: 0x18003fa60)
  • CreateSemaphoreExW (Address: 0x18003fa50)
  • DeleteCriticalSection (Address: 0x18003fa30)
  • EnterCriticalSection (Address: 0x18003f9f8)
  • InitializeCriticalSection (Address: 0x18003fa48)
  • InitializeCriticalSectionEx (Address: 0x18003fa00)
  • LeaveCriticalSection (Address: 0x18003fa58)
  • OpenSemaphoreW (Address: 0x18003fa68)
  • ReleaseMutex (Address: 0x18003fa20)
  • ReleaseSemaphore (Address: 0x18003fa40)
  • ReleaseSRWLockExclusive (Address: 0x18003fa28)
  • ReleaseSRWLockShared (Address: 0x18003fa08)
  • WaitForSingleObject (Address: 0x18003fa38)
  • WaitForSingleObjectEx (Address: 0x18003f9f0)
api-ms-win-core-synch-l1-2-0.dll
  • InitOnceBeginInitialize (Address: 0x18003fa78)
  • InitOnceComplete (Address: 0x18003fa80)
  • Sleep (Address: 0x18003fa88)
api-ms-win-core-sysinfo-l1-1-0.dll
  • GetSystemDirectoryW (Address: 0x18003faa8)
  • GetSystemInfo (Address: 0x18003faa0)
  • GetSystemTimeAsFileTime (Address: 0x18003fab8)
  • GetVersionExW (Address: 0x18003fab0)
  • GetWindowsDirectoryW (Address: 0x18003fa98)
api-ms-win-core-threadpool-l1-2-0.dll
  • CloseThreadpoolTimer (Address: 0x18003fac8)
  • CreateThreadpoolTimer (Address: 0x18003fae0)
  • SetThreadpoolTimer (Address: 0x18003fad8)
  • WaitForThreadpoolTimerCallbacks (Address: 0x18003fad0)
api-ms-win-crt-private-l1-1-0.dll
  • __C_specific_handler (Address: 0x18003fc40)
  • __CxxFrameHandler3 (Address: 0x18003fc48)
  • _CxxThrowException (Address: 0x18003fc58)
  • _o___acrt_iob_func (Address: 0x18003fc38)
  • _o___std_exception_copy (Address: 0x18003fc30)
  • _o___std_exception_destroy (Address: 0x18003fc28)
  • _o___std_type_info_destroy_list (Address: 0x18003fc20)
  • _o___stdio_common_vfwprintf (Address: 0x18003fc18)
  • _o___stdio_common_vsnprintf_s (Address: 0x18003fc10)
  • _o___stdio_common_vsnwprintf_s (Address: 0x18003fc08)
  • _o___stdio_common_vswprintf (Address: 0x18003fc00)
  • _o___stdio_common_vswprintf_s (Address: 0x18003fbf8)
  • _o___stdio_common_vswscanf (Address: 0x18003fbf0)
  • _o__callnewh (Address: 0x18003fbe8)
  • _o__cexit (Address: 0x18003fbe0)
  • _o__configure_narrow_argv (Address: 0x18003fbc8)
  • _o__crt_atexit (Address: 0x18003fbc0)
  • _o__errno (Address: 0x18003fbb8)
  • _o__execute_onexit_table (Address: 0x18003fbb0)
  • _o__initialize_narrow_environment (Address: 0x18003faf0)
  • _o__initialize_onexit_table (Address: 0x18003faf8)
  • _o__invalid_parameter_noinfo (Address: 0x18003fb00)
  • _o__purecall (Address: 0x18003fb08)
  • _o__register_onexit_function (Address: 0x18003fb10)
  • _o__seh_filter_dll (Address: 0x18003fb18)
  • _o__ultow_s (Address: 0x18003fb20)
  • _o__wcsicmp (Address: 0x18003fb28)
  • _o__wcslwr (Address: 0x18003fb30)
  • _o__wcsnicmp (Address: 0x18003fb38)
  • _o__wcsupr (Address: 0x18003fb40)
  • _o__wfopen_s (Address: 0x18003fc50)
  • _o_bsearch (Address: 0x18003fb50)
  • _o_fclose (Address: 0x18003fb58)
  • _o_fflush (Address: 0x18003fb60)
  • _o_free (Address: 0x18003fb68)
  • _o_malloc (Address: 0x18003fb70)
  • _o_strcpy_s (Address: 0x18003fb78)
  • _o_wcscat_s (Address: 0x18003fb80)
  • _o_wcscpy_s (Address: 0x18003fb88)
  • _o_wcsncpy_s (Address: 0x18003fb90)
  • _o_wcstol (Address: 0x18003fb98)
  • _o_wcstoul (Address: 0x18003fba0)
  • memcmp (Address: 0x18003fc60)
  • memcpy (Address: 0x18003fc68)
  • memmove (Address: 0x18003fb48)
  • wcschr (Address: 0x18003fbd8)
  • wcsrchr (Address: 0x18003fbd0)
  • wcsstr (Address: 0x18003fba8)
api-ms-win-crt-runtime-l1-1-0.dll
  • _initterm (Address: 0x18003fc78)
  • _initterm_e (Address: 0x18003fc80)
api-ms-win-crt-string-l1-1-0.dll
  • memset (Address: 0x18003fcb0)
  • strcmp (Address: 0x18003fca8)
  • strncmp (Address: 0x18003fc98)
  • wcscmp (Address: 0x18003fc90)
  • wcsncmp (Address: 0x18003fcc0)
  • wcsncpy (Address: 0x18003fcb8)
  • wcsnlen (Address: 0x18003fca0)
api-ms-win-eventing-provider-l1-1-0.dll
  • EventRegister (Address: 0x18003fce0)
  • EventUnregister (Address: 0x18003fcd8)
  • EventWriteTransfer (Address: 0x18003fcd0)
api-ms-win-security-base-l1-1-0.dll
  • AdjustTokenPrivileges (Address: 0x18003fd28)
  • DuplicateTokenEx (Address: 0x18003fcf8)
  • GetSecurityDescriptorControl (Address: 0x18003fd08)
  • GetSecurityDescriptorDacl (Address: 0x18003fd00)
  • GetSecurityDescriptorGroup (Address: 0x18003fcf0)
  • GetSecurityDescriptorOwner (Address: 0x18003fd20)
  • GetSecurityDescriptorSacl (Address: 0x18003fd10)
  • GetTokenInformation (Address: 0x18003fd18)
api-ms-win-security-lsalookup-l2-1-0.dll
  • LookupPrivilegeValueW (Address: 0x18003fd38)
api-ms-win-security-provider-l1-1-0.dll
  • SetNamedSecurityInfoW (Address: 0x18003fd48)
api-ms-win-security-sddl-l1-1-0.dll
  • ConvertSidToStringSidW (Address: 0x18003fd60)
  • ConvertStringSecurityDescriptorToSecurityDescriptorW (Address: 0x18003fd58)
bcrypt.dll
  • BCryptCloseAlgorithmProvider (Address: 0x18003fd98)
  • BCryptCreateHash (Address: 0x18003fd80)
  • BCryptDestroyHash (Address: 0x18003fd90)
  • BCryptFinishHash (Address: 0x18003fd78)
  • BCryptHash (Address: 0x18003fd70)
  • BCryptHashData (Address: 0x18003fd88)
  • BCryptOpenAlgorithmProvider (Address: 0x18003fda0)
CRYPT32.dll
  • CertCloseStore (Address: 0x18003f578)
  • CertComparePublicKeyInfo (Address: 0x18003f558)
  • CertCreateCertificateContext (Address: 0x18003f528)
  • CertEnumCertificatesInStore (Address: 0x18003f540)
  • CertFindCertificateInStore (Address: 0x18003f550)
  • CertFreeCertificateContext (Address: 0x18003f548)
  • CertGetCertificateContextProperty (Address: 0x18003f560)
  • CertGetNameStringW (Address: 0x18003f570)
  • CryptMsgClose (Address: 0x18003f568)
  • CryptMsgGetParam (Address: 0x18003f530)
  • CryptQueryObject (Address: 0x18003f538)
imagehlp.dll
  • CheckSumMappedFile (Address: 0x18003fdb0)
ntdll.dll
  • LdrAccessResource (Address: 0x18003fe38)
  • LdrFindResource_U (Address: 0x18003fe30)
  • LdrGetDllHandle (Address: 0x18003ffa8)
  • LdrGetProcedureAddress (Address: 0x18003ffa0)
  • NtAdjustPrivilegesToken (Address: 0x180040000)
  • NtClose (Address: 0x18003fde0)
  • NtCreateEvent (Address: 0x18003fde8)
  • NtDeviceIoControlFile (Address: 0x18003fdd0)
  • NtEnumerateBootEntries (Address: 0x18003ff30)
  • NtOpenDirectoryObject (Address: 0x18003ff20)
  • NtOpenFile (Address: 0x18003fe08)
  • NtOpenKey (Address: 0x18003fec0)
  • NtOpenProcess (Address: 0x18003fe48)
  • NtOpenProcessTokenEx (Address: 0x180040008)
  • NtOpenSymbolicLinkObject (Address: 0x18003feb0)
  • NtOpenThreadTokenEx (Address: 0x180040010)
  • NtQueryBootEntryOrder (Address: 0x18003ff08)
  • NtQueryBootOptions (Address: 0x18003ff10)
  • NtQueryDirectoryObject (Address: 0x18003ff28)
  • NtQueryInformationFile (Address: 0x18003fdf0)
  • NtQueryInformationProcess (Address: 0x18003fee8)
  • NtQueryInformationThread (Address: 0x18003fdf8)
  • NtQuerySymbolicLinkObject (Address: 0x18003fec8)
  • NtQuerySystemEnvironmentValueEx (Address: 0x180040038)
  • NtQuerySystemInformation (Address: 0x180040050)
  • NtQueryValueKey (Address: 0x18003ff00)
  • NtReadFile (Address: 0x18003fdc0)
  • NtSetInformationFile (Address: 0x18003fe18)
  • NtSetInformationThread (Address: 0x18003fdc8)
  • NtSetSystemEnvironmentValueEx (Address: 0x180040040)
  • NtTranslateFilePath (Address: 0x18003ff18)
  • NtWaitForSingleObject (Address: 0x18003fe00)
  • NtWriteFile (Address: 0x180040020)
  • RtlAddAccessAllowedAceEx (Address: 0x18003fed0)
  • RtlAllocateAndInitializeSid (Address: 0x18003fed8)
  • RtlAllocateHeap (Address: 0x18003fe40)
  • RtlAppendUnicodeToString (Address: 0x18003fe90)
  • RtlCreateAcl (Address: 0x18003fef0)
  • RtlCreateSecurityDescriptor (Address: 0x18003fef8)
  • RtlFreeHeap (Address: 0x18003fe28)
  • RtlFreeSid (Address: 0x180040058)
  • RtlFreeUnicodeString (Address: 0x18003fe10)
  • RtlGUIDFromString (Address: 0x18003fe88)
  • RtlImageNtHeader (Address: 0x18003fdd8)
  • RtlImageNtHeaderEx (Address: 0x180040028)
  • RtlImpersonateSelf (Address: 0x180040018)
  • RtlInitAnsiString (Address: 0x18003ffb8)
  • RtlInitUnicodeString (Address: 0x180040048)
  • RtlLengthSecurityDescriptor (Address: 0x18003fea0)
  • RtlLengthSid (Address: 0x18003fee0)
  • RtlNtStatusToDosError (Address: 0x180040030)
  • RtlSetDaclSecurityDescriptor (Address: 0x18003feb8)
  • RtlSetOwnerSecurityDescriptor (Address: 0x18003fea8)
  • RtlStringFromGUID (Address: 0x18003fe20)
  • ZwAllocateUuids (Address: 0x18003fff8)
  • ZwClose (Address: 0x18003fe78)
  • ZwCreateFile (Address: 0x18003ff38)
  • ZwCreateKey (Address: 0x18003ff40)
  • ZwDeleteKey (Address: 0x18003ff68)
  • ZwDeleteValueKey (Address: 0x18003ff58)
  • ZwDeviceIoControlFile (Address: 0x18003ffd8)
  • ZwEnumerateKey (Address: 0x18003ff70)
  • ZwFlushKey (Address: 0x18003ff50)
  • ZwLoadKey (Address: 0x18003ff48)
  • ZwOpenDirectoryObject (Address: 0x18003fff0)
  • ZwOpenFile (Address: 0x18003fe68)
  • ZwOpenKey (Address: 0x18003ff98)
  • ZwOpenMutant (Address: 0x18003fe70)
  • ZwOpenProcess (Address: 0x18003ffc8)
  • ZwOpenSymbolicLinkObject (Address: 0x18003ffe8)
  • ZwQueryAttributesFile (Address: 0x18003fe98)
  • ZwQueryDirectoryObject (Address: 0x18003ffe0)
  • ZwQueryInformationFile (Address: 0x18003ffc0)
  • ZwQueryInformationProcess (Address: 0x18003ffb0)
  • ZwQueryKey (Address: 0x18003fe58)
  • ZwQuerySymbolicLinkObject (Address: 0x18003ffd0)
  • ZwQuerySystemInformation (Address: 0x18003fe80)
  • ZwQueryValueKey (Address: 0x18003ff78)
  • ZwReleaseMutant (Address: 0x18003fe60)
  • ZwSaveKey (Address: 0x18003ff60)
  • ZwSetSecurityObject (Address: 0x18003ff80)
  • ZwSetValueKey (Address: 0x18003ff90)
  • ZwUnloadKey (Address: 0x18003ff88)
  • ZwWaitForSingleObject (Address: 0x18003fe50)
OLEAUT32.dll
  • SafeArrayGetElement (Address: 0x18003f588)
  • SafeArrayGetLBound (Address: 0x18003f590)
  • SafeArrayGetUBound (Address: 0x18003f5b0)
  • SysAllocString (Address: 0x18003f598)
  • SysFreeString (Address: 0x18003f5c0)
  • SysStringLen (Address: 0x18003f5a0)
  • VariantClear (Address: 0x18003f5a8)
  • VariantInit (Address: 0x18003f5b8)
RPCRT4.dll
  • UuidCreate (Address: 0x18003f5d0)
WCP.dll
  • ?RtlGetFacilityTracingFlags@Rtl@WCP@Windows@@YAKPEAU_RTL_TRACING_FACILITY@123@@Z (Address: 0x18003f5e0)
  • ?RtlTraceFormat_PCWSTR@Rtl@WCP@Windows@@YAXPEAUIRtlFormattedOutputStream@13@PEBX@Z (Address: 0x18003f608)
  • ?RtlTraceVa@Rtl@WCP@Windows@@YAXKKPEAU_RTL_TRACING_FACILITY@123@QEBD_KPEAD@Z (Address: 0x18003f600)
  • ConvertNtStatusToHResult (Address: 0x18003f5e8)
  • RtlFreeLBlob (Address: 0x18003f5f8)
  • RtlReportErrorOrigination (Address: 0x18003f5f0)
WINTRUST.dll
  • WinVerifyTrust (Address: 0x18003f618)
  • WTHelperGetProvSignerFromChain (Address: 0x18003f628)
  • WTHelperProvDataFromStateData (Address: 0x18003f620)