efssvc.dll RPC interfaces

EFS Service
efsrpc DF1941C5-FE89-4E79-BF10-463657ACF44D version 1.0
0x15 methods:

• EfsRpcOpenFileRaw
• EfsRpcReadFileRaw
• EfsRpcWriteFileRaw
• EfsRpcCloseRaw
• EfsRpcEncryptFileSrv
• EfsRpcDecryptFileSrv
• EfsRpcQueryUsersOnFile
• EfsRpcQueryRecoveryAgents
• EfsRpcRemoveUsersFromFile
• EfsRpcAddUsersToFile
• EfsRpcSetFileEncryptionKey
• EfsRpcNotSupported
• EfsRpcFileKeyInfo
• EfsRpcDuplicateEncryptionInfoFile
• EfsUsePinForEncryptedFiles
• EfsRpcAddUsersToFileEx
• EfsRpcFileKeyInfoEx
• EfsRpcGenerateEfsStream
• EfsRpcGetEncryptedFileMetadata
• EfsRpcSetEncryptedFileMetadata
• EfsRpcFlushEfsCache

efskrpc 04EEB297-CBF4-466B-8A2A-BFD6A2F10BBA version 1.0
4 methods

• EfsKRpcEstablishRpcConnection
• EfsKRpcDecryptFek
• EfsKRpcGenerateKey
• EfsKRpcGenerateDirEfs

вызывается через msrpc.sys из драйвера ntfs например