| Windows 10 DLL File Information - BFE.DLL |
The following DLL report was generated by automatic DLL script that scanned and loaded all DLL files in the system32 directory of Windows 10, extracted the information from them, and then saved it into HTML reports. If you want to view a report of another DLL, go to the main page of this Web site.
General Information
| File Description: | Base Filtering Engine |
| File Version: | 10.0.10130.0 (fbl_impressive.150522-2224) |
| Company: | Microsoft Corporation |
| Product Name: | Microsoft® Windows® Operating System |
| DLL popularity | Very Low - There is no any other DLL in system32 directory that is statically linked to this file. |
| File Size: | 547 KB |
| Total Number of Exported Functions: | 4 |
| Total Number of Exported Functions With Names: | 4 |
Section Headers
| Name | Virtual Address | Raw Data Size | % of File | Characteristics | Section Contains... |
|---|---|---|---|---|---|
| .text | 0x00001000 | 513,024 Bytes | 91.6% | Read, Execute | Code |
| .data | 0x0007f000 | 5,632 Bytes | 1.0% | Write, Read | Initialized Data |
| .idata | 0x00084000 | 9,216 Bytes | 1.6% | Read | Initialized Data |
| .didat | 0x00087000 | 512 Bytes | 0.1% | Write, Read | Initialized Data |
| .rsrc | 0x00088000 | 6,656 Bytes | 1.2% | Read | Initialized Data |
| .reloc | 0x0008a000 | 24,064 Bytes | 4.3% | Read, Discardable | Initialized Data |
Static Linking
BFE.DLL is statically linked to the following files:msvcrt.dll
ntdll.dll
api-ms-win-core-libraryloader-l1-2-0.dll
api-ms-win-core-errorhandling-l1-1-1.dll
api-ms-win-core-synch-l1-2-0.dll
api-ms-win-core-handle-l1-1-0.dll
api-ms-win-core-util-l1-1-0.dll
api-ms-win-eventing-provider-l1-1-0.dll
api-ms-win-security-base-l1-2-0.dll
api-ms-win-core-string-l1-1-0.dll
api-ms-win-core-heap-l1-2-0.dll
api-ms-win-core-processthreads-l1-1-2.dll
RPCRT4.dll
api-ms-win-core-heap-l2-1-0.dll
AUTHZ.dll
api-ms-win-core-sysinfo-l1-2-1.dll
WS2_32.dll
api-ms-win-core-timezone-l1-1-0.dll
api-ms-win-core-file-l1-2-1.dll
api-ms-win-core-psapi-l1-1-0.dll
api-ms-win-core-memory-l1-1-2.dll
api-ms-win-core-string-l2-1-1.dll
api-ms-win-core-profile-l1-1-0.dll
api-ms-win-core-perfcounters-l1-1-0.dll
api-ms-win-core-threadpool-legacy-l1-1-0.dll
DNSAPI.dll
api-ms-win-core-processenvironment-l1-2-0.dll
api-ms-win-core-registry-l1-1-0.dll
api-ms-win-eventing-controller-l1-1-0.dll
api-ms-win-eventing-consumer-l1-1-0.dll
api-ms-win-core-threadpool-l1-2-0.dll
api-ms-win-core-delayload-l1-1-1.dll
api-ms-win-core-apiquery-l1-1-0.dll
api-ms-win-core-threadpool-private-l1-1-0.dll
This means that when BFE.DLL is loaded, the above files are automatically loaded too. If one of these files is corrupted or missing, BFE.DLL won't be loaded.
General Resources Information
| Resource Type | Number of Items | Total Size | % of File |
|---|---|---|---|
| Icons | 0 | 0 Bytes | 0.0% |
| Animated Icons | 0 | 0 Bytes | 0.0% |
| Cursors | 0 | 0 Bytes | 0.0% |
| Animated Cursors | 0 | 0 Bytes | 0.0% |
| Bitmaps | 0 | 0 Bytes | 0.0% |
| AVI Files | 0 | 0 Bytes | 0.0% |
| Dialog-Boxes | 0 | 0 Bytes | 0.0% |
| HTML Related Files | 0 | 0 Bytes | 0.0% |
| Menus | 0 | 0 Bytes | 0.0% |
| Strings | 217 | 21,720 Bytes | 3.9% |
| Type Libraries | 0 | 0 Bytes | 0.0% |
| Manifest | 0 | 0 Bytes | 0.0% |
| All Others | 4 | 6,970 Bytes | 1.2% |
| Total | 221 | 28,690 Bytes | 5.1% |
Icons in this file
No icons found in this file
Cursors in this file
No cursors found in this file
Dialog-boxes list (up to 1000 dialogs)
No dialog resources in this file.
String resources in this dll (up to 1000 strings)
| String ID | String Text |
|---|---|
| 301 | Inbound IP Packet v4 Layer |
| 303 | Inbound IP Packet v4 Discard Layer |
| 305 | Inbound IP Packet v6 Layer |
| 307 | Inbound IP Packet v6 Discard Layer |
| 309 | Outbound IP Packet v4 Layer |
| 311 | Outbound IP Packet v4 Discard Layer |
| 313 | Outbound IP Packet v6 Layer |
| 315 | Outbound IP Packet v6 Discard Layer |
| 317 | IP Forward v4 Layer |
| 319 | IP Forward v4 Discard Layer |
| 321 | Inbound Transport v4 Layer |
| 323 | Inbound Transport v4 Discard Layer |
| 325 | Inbound Transport v6 Layer |
| 327 | Inbound Transport v6 Discard Layer |
| 329 | Outbound Transport v4 Layer |
| 331 | Outbound Transport v4 Discard Layer |
| 333 | Outbound Transport v6 Layer |
| 335 | Outbound Transport v6 Discard Layer |
| 337 | Stream v4 Layer |
| 339 | Stream v4 Discard Layer |
| 341 | Stream v6 Layer |
| 343 | Stream v6 Discard Layer |
| 345 | Datagram Data v4 Layer |
| 347 | Datagram Data v4 Discard Layer |
| 349 | Datagram Data v6 Layer |
| 351 | Datagram Data v6 Discard Layer |
| 353 | Inbound ICMP Error v4 Layer |
| 355 | Inbound ICMP Error v4 Discard Layer |
| 357 | Inbound ICMP Error v6 Layer |
| 359 | Inbound ICMP Error v6 Discard Layer |
| 361 | ALE Resource Assignment v4 Layer |
| 363 | ALE Resource Assignment v4 Discard Layer |
| 365 | ALE Resource Assignment v6 Layer |
| 367 | ALE Resource Assignment v6 Discard Layer |
| 369 | ALE Listen v4 Layer |
| 371 | ALE Listen v4 Discard Layer |
| 373 | ALE Listen v6 Layer |
| 375 | ALE Listen v6 Discard Layer |
| 377 | ALE Receive/Accept v4 Layer |
| 379 | ALE Receive/Accept v4 Discard Layer |
| 381 | ALE Receive/Accept v6 Layer |
| 383 | ALE Receive/Accept v6 Discard Layer |
| 385 | ALE Connect v4 Layer |
| 387 | ALE Connect v4 Discard Layer |
| 389 | ALE Connect v6 Layer |
| 391 | ALE Connect v6 Discard Layer |
| 393 | ALE Flow Established v4 Layer |
| 395 | ALE Flow Established v4 Discard Layer |
| 397 | ALE Flow Established v6 Layer |
| 399 | ALE Flow Established v6 Discard Layer |
| 401 | Inbound Ethernet Layer |
| 403 | Outbound Ethernet Layer |
| 405 | IPsec KM Demux v4 Layer |
| 407 | IPsec KM Demux v6 Layer |
| 409 | IPsec v4 Layer |
| 411 | IPsec v6 Layer |
| 413 | IKE v4 Layer |
| 415 | IKE v6 Layer |
| 417 | RPC UM Layer |
| 419 | RPC EPMAP Layer |
| 421 | Outbound ICMP Error v4 Layer |
| 423 | Outbound ICMP Error v4 Discard Layer |
| 425 | Outbound ICMP Error v6 Layer |
| 427 | Outbound ICMP Error v6 Discard Layer |
| 429 | RPC EP ADD Layer |
| 431 | RPC Proxy Connect Layer |
| 433 | RPC Proxy Interface Layer |
| 435 | IP Forward v6 Layer |
| 437 | IP Forward v6 Discard Layer |
| 445 | Keying Module Authorization Layer |
| 447 | Name Resolution Cache v4 Layer |
| 449 | Name Resolution Cache v6 Layer |
| 451 | ALE Resource Release v4 Layer |
| 453 | ALE Resource Release v6 Layer |
| 455 | ALE Endpoint Closure v4 Layer |
| 457 | ALE Endpoint Closure v6 Layer |
| 459 | ALE Connect Redirect v4 Layer |
| 461 | ALE Connect Redirect v6 Layer |
| 463 | ALE Bind Redirect v4 Layer |
| 465 | ALE Bind Redirect v6 Layer |
| 467 | Stream Packet v4 Layer |
| 469 | Stream Packet v6 Layer |
| 471 | Inbound Native MAC Layer |
| 473 | Outbound Native MAC Layer |
| 475 | Ingress vSwitch Ethernet layer |
| 477 | Egress vSwitch Ethernet layer |
| 479 | Ingress vSwitch Transport v4 layer |
| 481 | Ingress vSwitch Transport v6 layer |
| 483 | Egress vSwitch Transport v4 layer |
| 485 | Egress vSwitch Transport v6 layer |
| 487 | Inbound Transport v4 Layer fast |
| 489 | Outbound Transport v4 Layer fast |
| 491 | Inbound Native MAC Layer fast |
| 493 | Outbound Native MAC Layer fast |
| 501 | WFP Built-in Universal Sublayer |
| 503 | WFP Built-in Legacy IPsec Sublayer |
| 505 | WFP Built-in Secure Socket Sublayer |
| 507 | WFP Built-in TCP Chimney Offload Sublayer |
| 509 | WFP Built-in Inspection Sublayer |
| 511 | RPC Built-in Audit Sublayer |
| 513 | WFP Built-in IPsec Tunnel Sublayer |
| 515 | WFP Built-in Edge Traversal Sublayer |
| 517 | WFP Built-in IPsec Forward Outbound Tunnel Sublayer |
| 519 | WFP Built-in IPsec DoS Protection Sublayer |
| 521 | WFP Built-in TCP Templates Sublayer |
| 522 | WFP Built-in IPsec Security Realm Sublayer |
| 601 | Condition ID: %ls Match value: %ls Condition value: %ls |
| 602 | Equal to |
| 603 | Greater than |
| 604 | Less than |
| 605 | Greater than or equal to |
| 606 | Less than or equal to |
| 607 | In range |
| 608 | All flags set |
| 609 | Any flags set |
| 610 | No flags set |
| 611 | Equal to (case insensitive) |
| 613 | Not equal to |
| 701 | WFP Built-in Default Secure Socket AuthIP Policy Provider Context |
| 702 | Authenticated Internet Protocol (AuthIP) main mode default policy for secure sockets. |
| 703 | WFP Built-in Default Secure Socket IPsec Policy Provider Context |
| 704 | Internet Protocol Security (IPsec) quick mode default policy for secure sockets. |
| 801 | WFP Built-in IPsec Inbound Transport v4 Layer Callout |
| 802 | Verifies that each received packet that is supposed to arrive over a transport mode security association arrives securely. |
| 803 | WFP Built-in IPsec Inbound Transport v6 Layer Callout |
| 804 | Verifies that each received packet that is supposed to arrive over a transport mode security association arrives securely. |
| 805 | WFP Built-in IPsec Outbound Transport v4 Layer Callout |
| 806 | Indicates to IPsec the outbound traffic that must be secured over transport mode security associations. |
| 807 | WFP Built-in IPsec Outbound Transport v6 Layer Callout |
| 808 | Indicates to IPsec the outbound traffic that must be secured over transport mode security associations. |
| 809 | WFP Built-in IPsec Inbound Tunnel v4 Layer Callout |
| 810 | Verifies that each received packet that is supposed to arrive over a tunnel mode security association arrives securely. |
| 811 | WFP Built-in IPsec Inbound Tunnel v6 Layer Callout |
| 812 | Verifies that each received packet that is supposed to arrive over a tunnel mode security association arrives securely. |
| 813 | WFP Built-in IPsec Outbound Tunnel v4 Layer Callout |
| 814 | Indicates to IPsec the outbound traffic that must be secured over tunnel mode security associations. |
| 815 | WFP Built-in IPsec Outbound Tunnel v6 Layer Callout |
| 816 | Indicates to IPsec the outbound traffic that must be secured over tunnel mode security associations. |
| 817 | WFP Built-in IPsec Forward Inbound Tunnel v4 Layer Callout |
| 818 | Verifies that each received packet that is supposed to arrive over a tunnel mode security association arrives securely. |
| 819 | WFP Built-in IPsec Forward Inbound Tunnel v6 Layer Callout |
| 820 | Verifies that each received packet that is supposed to arrive over a tunnel mode security association arrives securely. |
| 821 | WFP Built-in IPsec Forward Outbound Tunnel v4 Layer Callout |
| 822 | Indicates to IPsec the outbound traffic that must be secured over a tunnel mode security association. |
| 823 | WFP Built-in IPsec Forward Outbound Tunnel v6 Layer Callout |
| 824 | Indicates to IPsec the outbound traffic that must be secured over a tunnel mode security association. |
| 825 | WFP Built-in IPsec Inbound Initiate Secure v4 Layer Callout |
| 826 | Verifies that each incoming connection that is supposed to arrive secure arrives securely. |
| 827 | WFP Built-in IPsec Inbound Initiate Secure v6 Layer Callout |
| 828 | Verifies that each incoming connection that is supposed to arrive secure arrives securely. |
| 829 | WFP Built-in IPsec ALE Connect v4 Layer Callout |
| 830 | Applies IPsec policy modifiers to client applications. |
| 831 | WFP Built-in IPsec ALE Connect v6 Layer Callout |
| 832 | Applies IPsec policy modifiers to client applications. |
| 833 | WFP Built-in Silent Drop Transport v4 Discard Layer Callout |
| 834 | Implements stealth-mode filtering by silently dropping all incoming packets for which TCP does not have a listening endpoint. |
| 835 | WFP Built-in Silent Drop Transport v6 Discard Layer Callout |
| 836 | Implements stealth-mode filtering by silently dropping all incoming packets for which TCP does not have a listening endpoint. |
| 837 | WFP Built-in TCP Chimney Offload ALE Connect v4 Layer Callout |
| 838 | Enables or disables TCP Chimney Offload for each outgoing connection. |
| 839 | WFP Built-in TCP Chimney Offload ALE Connect v6 Layer Callout |
| 840 | Enables or disables TCP Chimney Offload for each outgoing connection. |
| 841 | WFP Built-in TCP Chimney Offload ALE Receive/Accept v4 Layer Callout |
| 842 | Enables or disables TCP Chimney Offload for each incoming connection. |
| 843 | WFP Built-in TCP Chimney Offload ALE Receive/Accept v6 Layer Callout |
| 844 | Enables or disables TCP Chimney Offload for each incoming connection. |
| 845 | WFP Built-in Set Option ALE Connect v4 Layer Callout |
| 846 | Sets classify options on outbound flows. |
| 847 | WFP Built-in Set Option ALE Connect v6 Layer Callout |
| 848 | Sets classify options on outbound flows. |
| 849 | WFP Built-in IPsec Inbound Tunnel ALE Receive/Accept v4 Layer Callout |
| 850 | Permits IPsec tunnel mode IP-in-IP packets when they get classified at the ALE receive/accept layer. |
| 851 | WFP Built-in IPsec Inbound Tunnel ALE Receive/Accept v6 Layer Callout |
| 852 | Permits IPsec tunnel mode IP-in-IP packets when they get classified at the ALE receive/accept layer. |
| 853 | WFP Built-in Edge Traversal ALE Resource Assignment v4 Layer Callout |
| 854 | Signals Windows when an application is attempting to bind to an interface and has opted in for edge traversing traffic. |
| 855 | WFP Built-in Edge Traversal ALE Resource Assignment v6 Layer Callout |
| 856 | Signals Windows when an application is attempting to bind to an interface and has opted in for edge traversing traffic. |
| 857 | WFP Built-in Edge Traversal ALE Listen v4 Layer Callout |
| 858 | Signals Windows when an application is attempting to listen on an interface and has opted in for edge traversing traffic. |
| 859 | WFP Built-in Edge Traversal ALE Listen v6 Layer Callout |
| 860 | Signals Windows when an application is attempting to listen on an interface and has opted in for edge traversing traffic. |
| 861 | WFP Built-in IPsec DoS Protection Forward v4 Layer Callout |
| 862 | Inspection point for IPsec Denial of Service Protection at the forward layer to create state and prevent DoS. |
| 863 | WFP Built-in IPsec DoS Protection Forward v6 Layer Callout |
| 864 | Inspection point for IPsec Denial of Service Protection at the forward layer to create state and prevent DoS. |
| 865 | WFP Built-in TCP Templates ALE Connect v4 Layer Callout |
| 866 | Applies TCP Template for each outgoing connection. |
| 867 | WFP Built-in TCP Templates ALE Connect v6 Layer Callout |
| 868 | Applies TCP Template for each outgoing connection. |
| 869 | WFP Built-in TCP Templates ALE Receive/Accept v4 Layer Callout |
| 870 | Applies TCP Template for each incoming connection. |
| 871 | WFP Built-in TCP Templates ALE Receive/Accept v6 Layer Callout |
| 872 | Applies TCP Template for each incoming connection. |
| 873 | WFP Built-in Reserved callout |
| 874 | WFP Built-in Reserved callout |
| 875 | WFP Built-in Reserved callout |
| 876 | WFP Built-in Reserved callout |
| 877 | WFP Built-in Set Option ALE Receive/Accept v4 Layer Callout |
| 878 | Sets classify options on inbound flows. |
| 879 | WFP Built-in Set Option ALE Receive/Accept v6 Layer Callout |
| 880 | Sets classify options on inbound flows. |
| 901 | WFP Built-in IKE Exemption Filter |
| 902 | Default exemption filter for IKE traffic. |
| 1001 | Base Filtering Engine |
| 1002 | The Base Filtering Engine (BFE) is a service that manages firewall and Internet Protocol security (IPsec) policies and implements user mode filtering. Stopping or disabling the BFE service will significantly reduce the security of the system. It will also result in unpredictable behavior in IPsec management and firewall applications. |
| 1101 | Default WinPE Policy |
| 1201 | Microsoft Corporation |
| 1202 | Microsoft Windows WFP Built-in IKEEXT provider used to identify filters added by IKE/AuthIP. |
| 1203 | Microsoft Corporation |
| 1204 | Microsoft Windows WFP Built-in TCP Chimney Offload provider used to identify filters added by TCP Chimney Offload. |
| 1205 | Microsoft Corporation |
| 1206 | Microsoft Windows WFP Built-in IPsec DoS Protection configuration provider used to identify filters added by IPsec Denial of Service Protection. |
| 1207 | Microsoft Corporation |
| 1208 | Microsoft Windows WFP Built-in TCP Templates provider used to identify filters added by TCP Template based configuration. |
| 2001 | Microsoft Corporation |
| 2002 | This task adjusts the start type for firewall-triggered services when the start type of the Base Filtering Engine (BFE) is disabled. |
COM Classes/Interfaces
There is no type library in this file with COM classes/interfaces information
Exported Functions List
The following functions are exported by this dll:| BfeGetDirectDispatchTable | BfeOnServiceStartTypeChange | BfeServiceMain | SvchostPushServiceGlobals |
Imported Functions List
The following functions are imported by this dll:- msvcrt.dll:
_CIlog _XcptFilter _amsg_exit _except_handler4_common _ftol2 _i64toa_s _initterm _ltoa_s _ui64toa_s _ultoa_s _ultow _vsnwprintf _wcsicmp _wcslwr _wcsnicmp bsearch free isprint iswctype malloc memcmp memcpy memmove memset qsort sprintf_s strpbrk strstr tolower wcschr wcscspn wcsnlen wcstol wcstoul - ntdll.dll:
CsrIdentifyAlertableThread EtwEventActivityIdControl EtwEventEnabled EtwEventRegister EtwEventUnregister EtwEventWrite EtwGetTraceEnableFlags EtwGetTraceEnableLevel EtwGetTraceLoggerHandle EtwRegisterTraceGuidsW EtwTraceMessage EtwUnregisterTraceGuids NtCreateTransaction NtDeviceIoControlFile NtQueryObject RtlAbsoluteToSelfRelativeSD RtlAdjustPrivilege RtlAllocateHeap RtlApplicationVerifierStop RtlContractHashTable RtlCreateHashTable RtlCreateServiceSid RtlDeleteHashTable RtlEndEnumerationHashTable RtlEnumerateEntryHashTable RtlEqualSid RtlEthernetAddressToStringA RtlExpandHashTable RtlGetNextEntryHashTable RtlGetOwnerSecurityDescriptor RtlGetSaclSecurityDescriptor RtlInitEnumerationHashTable RtlInitUnicodeString RtlInitializeBitMap RtlInsertEntryHashTable RtlIntegerToUnicodeString RtlIpv4AddressToStringA RtlIpv4AddressToStringW RtlIpv6AddressToStringA RtlIpv6AddressToStringW RtlLengthSecurityDescriptor RtlLengthSid RtlLookupEntryHashTable RtlNtStatusToDosError RtlNumberOfSetBits RtlRemoveEntryHashTable RtlSelfRelativeToAbsoluteSD2 RtlSetOwnerSecurityDescriptor RtlSetThreadPreferredUILanguages RtlSubAuthorityCountSid RtlValidRelativeSecurityDescriptor RtlValidSid TpAllocTimer TpIsTimerSet TpReleaseTimer TpSetTimer TpWaitForTimer WinSqmAddToAverageDWORD WinSqmAddToStream - api-ms-win-core-libraryloader-l1-2-0.dll:
KernelBase!DisableThreadLibraryCalls KernelBase!GetModuleHandleExW KernelBase!GetProcAddress KernelBase!LoadStringW - api-ms-win-core-errorhandling-l1-1-1.dll:
KernelBase!GetLastError KernelBase!SetUnhandledExceptionFilter KernelBase!UnhandledExceptionFilter - api-ms-win-core-synch-l1-2-0.dll:
KernelBase!CreateEventW KernelBase!CreateSemaphoreExW KernelBase!InitializeCriticalSectionAndSpinCount KernelBase!ReleaseSemaphore KernelBase!SetEvent KernelBase!Sleep KernelBase!WaitForSingleObject ntdll!RtlAcquireSRWLockExclusive ntdll!RtlAcquireSRWLockShared ntdll!RtlDeleteCriticalSection ntdll!RtlEnterCriticalSection ntdll!RtlInitializeConditionVariable ntdll!RtlLeaveCriticalSection ntdll!RtlReleaseSRWLockExclusive ntdll!RtlReleaseSRWLockShared - api-ms-win-core-handle-l1-1-0.dll:
KernelBase!CloseHandle - api-ms-win-core-util-l1-1-0.dll:
ntdll!RtlDecodePointer ntdll!RtlEncodePointer - api-ms-win-eventing-provider-l1-1-0.dll:
ntdll!EtwEventWriteTransfer - api-ms-win-security-base-l1-2-0.dll:
KernelBase!AddAccessAllowedAce KernelBase!AllocateAndInitializeSid KernelBase!CopySid KernelBase!CreatePrivateObjectSecurityEx KernelBase!CreateWellKnownSid KernelBase!DestroyPrivateObjectSecurity KernelBase!EqualSid KernelBase!FreeSid KernelBase!GetLengthSid KernelBase!GetPrivateObjectSecurity KernelBase!GetSecurityDescriptorControl KernelBase!GetSecurityDescriptorLength KernelBase!InitializeAcl KernelBase!InitializeSecurityDescriptor KernelBase!MapGenericMask KernelBase!PrivilegeCheck KernelBase!SetPrivateObjectSecurityEx KernelBase!SetSecurityDescriptorControl KernelBase!SetSecurityDescriptorDacl - api-ms-win-core-string-l1-1-0.dll:
KernelBase!CompareStringW KernelBase!MultiByteToWideChar KernelBase!WideCharToMultiByte - api-ms-win-core-heap-l1-2-0.dll:
KernelBase!GetProcessHeap KernelBase!HeapCreate KernelBase!HeapDestroy ntdll!RtlAllocateHeap ntdll!RtlFreeHeap ntdll!RtlReAllocateHeap ntdll!RtlSizeHeap - api-ms-win-core-processthreads-l1-1-2.dll:
KernelBase!OpenThreadToken kernel32!CreateThread kernel32!GetCurrentProcess kernel32!GetCurrentProcessId kernel32!GetCurrentThread kernel32!GetCurrentThreadId kernel32!GetProcessId kernel32!OpenProcess kernel32!TerminateProcess kernel32!TlsAlloc kernel32!TlsFree kernel32!TlsGetValue kernel32!TlsSetValue - RPCRT4.dll:
I_RpcBindingInqLocalClientPID I_RpcExceptionFilter MesDecodeBufferHandleCreate MesEncodeDynBufferHandleCreate MesHandleFree NdrMesTypeDecode2 NdrMesTypeEncode2 NdrServerCall2 RpcBindingVectorFree RpcEpRegisterW RpcEpUnregister RpcFreeAuthorizationContext RpcGetAuthorizationContextForClient RpcImpersonateClient RpcRaiseException RpcRevertToSelf RpcServerInqBindings RpcServerInqCallAttributesW RpcServerRegisterIf3 RpcServerUnregisterIfEx RpcServerUseProtseqW UuidCreate UuidFromStringW - api-ms-win-core-heap-l2-1-0.dll:
KernelBase!LocalAlloc KernelBase!LocalFree - AUTHZ.dll:
AuthzAccessCheck AuthzFreeAuditEvent AuthzFreeContext AuthzFreeResourceManager AuthzGetInformationFromContext AuthzInitializeContextFromSid AuthzInitializeResourceManager AuthziFreeAuditEventType AuthziInitializeAuditEvent AuthziInitializeAuditEventType AuthziInitializeAuditParamsFromArray AuthziLogAuditEvent - api-ms-win-core-sysinfo-l1-2-1.dll:
KernelBase!GetSystemTime KernelBase!GetSystemTimeAsFileTime KernelBase!GetTickCount KernelBase!GetTickCount64 - WS2_32.dll:
htonl - api-ms-win-core-timezone-l1-1-0.dll:
KernelBase!FileTimeToSystemTime - api-ms-win-core-file-l1-2-1.dll:
KernelBase!CreateFileW - api-ms-win-core-psapi-l1-1-0.dll:
KernelBase!QueryFullProcessImageNameW - api-ms-win-core-memory-l1-1-2.dll:
KernelBase!CreateFileMappingW KernelBase!MapViewOfFile KernelBase!UnmapViewOfFile - api-ms-win-core-string-l2-1-1.dll:
KernelBase!SHLoadIndirectString - api-ms-win-core-profile-l1-1-0.dll:
ntdll!RtlQueryPerformanceCounter - api-ms-win-core-perfcounters-l1-1-0.dll:
KernelBase!PerfCreateInstance KernelBase!PerfSetCounterSetInfo KernelBase!PerfSetULongCounterValue KernelBase!PerfSetULongLongCounterValue KernelBase!PerfStartProvider KernelBase!PerfStopProvider - api-ms-win-core-threadpool-legacy-l1-1-0.dll:
KernelBase!CreateTimerQueue KernelBase!CreateTimerQueueTimer KernelBase!DeleteTimerQueueEx KernelBase!DeleteTimerQueueTimer KernelBase!UnregisterWaitEx - DNSAPI.dll:
DnsValidateName_W - api-ms-win-core-processenvironment-l1-2-0.dll:
KernelBase!ExpandEnvironmentStringsW - api-ms-win-core-registry-l1-1-0.dll:
KernelBase!RegCloseKey KernelBase!RegCreateKeyExW KernelBase!RegDeleteValueW KernelBase!RegEnumValueW KernelBase!RegOpenKeyExW KernelBase!RegQueryInfoKeyW KernelBase!RegQueryValueExW KernelBase!RegSetValueExW - api-ms-win-eventing-controller-l1-1-0.dll:
sechost!ControlTraceW sechost!EnableTraceEx2 sechost!StartTraceW - api-ms-win-eventing-consumer-l1-1-0.dll:
sechost!CloseTrace sechost!OpenTraceW sechost!ProcessTrace - api-ms-win-core-threadpool-l1-2-0.dll:
KernelBase!CreateThreadpoolTimer ntdll!TpReleaseTimer ntdll!TpSetTimer ntdll!TpWaitForTimer - api-ms-win-core-delayload-l1-1-1.dll:
KernelBase!DelayLoadFailureHook KernelBase!ResolveDelayLoadedAPI - api-ms-win-core-apiquery-l1-1-0.dll:
ntdll!ApiSetQueryApiSetPresence - api-ms-win-core-threadpool-private-l1-1-0.dll:
KernelBase!RegisterWaitForSingleObjectEx