Extract the key and decrypt it:

openssl pkcs12 -in cert.pfx -nocerts -out cert-encrypted.key
openssl rsa -in cert-encrypted.key -out cert.key

extract the certificate:

openssl pkcs12 -in cert.pfx -clcerts -nokeys -out cert.crt

extract the bundle:

openssl pkcs12 -in cert.pfx -nokeys -nodes -cacerts -out ca-bundle.crt

convert crt and key to pfx:

openssl pkcs12 -export -inkey cert.key -in cert.crt -out cert.p12 -legacy

-legacy is needed by older Windows versions (e.g. Server 2016)