xwizards.dll

Description: Extensible Wizards Manager Module

Version: 10.0.19041.3636

Architecture: 32-bit

Operating System: Windows NT

SHA256: 9706f7352b269dcbd45a7327a3b2be70

File Size: 367.5 KB

Uploaded At: Dec. 1, 2025, 8:08 a.m.

Views: 13

Security Warning

This file has been flagged as potentially dangerous.

Reason: Detected potentially dangerous functions used for process injection: OpenProcess

Exported Functions

DllCanUnloadNow (Ordinal: 1, Address: 0xc490)
DllGetClassObject (Ordinal: 2, Address: 0xc4d0)
ProcessXMLFileA (Ordinal: 3, Address: 0xd9d0)
ProcessXMLFileW (Ordinal: 4, Address: 0xda60)
ResetRegistrationA (Ordinal: 5, Address: 0xd3d0)
ResetRegistrationW (Ordinal: 6, Address: 0xd460)
RunPropertySheetA (Ordinal: 7, Address: 0xe7d0)
RunPropertySheetW (Ordinal: 8, Address: 0xe860)
RunWizardA (Ordinal: 9, Address: 0xdf20)
RunWizardW (Ordinal: 10, Address: 0xdfb0)
XWProcessXMLFile (Ordinal: 11, Address: 0xc8f0)
XWRegisterHost (Ordinal: 12, Address: 0xc920)
XWRegisterPageWithPage (Ordinal: 13, Address: 0xcbe0)
XWRegisterPageWithTask (Ordinal: 14, Address: 0xcaf0)
XWRegisterTaskWithHost (Ordinal: 15, Address: 0xca00)
XWUnregisterHost (Ordinal: 16, Address: 0xccd0)
XWUnregisterHostTaskLink (Ordinal: 17, Address: 0xcf70)
XWUnregisterPage (Ordinal: 18, Address: 0xce90)
XWUnregisterPagesLink (Ordinal: 19, Address: 0xd130)
XWUnregisterTask (Ordinal: 20, Address: 0xcdb0)
XWUnregisterTaskPageLink (Ordinal: 21, Address: 0xd050)

Imported DLLs & Functions

api-ms-win-core-atoms-l1-1-0.dll

GlobalAddAtomA (Address: 0x1003b0b0)
GlobalGetAtomNameA (Address: 0x1003b0ac)
GlobalGetAtomNameW (Address: 0x1003b0b4)

api-ms-win-core-com-l1-1-0.dll

CLSIDFromString (Address: 0x1003b0d0)
CoCreateInstance (Address: 0x1003b0bc)
CoFreeUnusedLibrariesEx (Address: 0x1003b0c8)
CoInitializeEx (Address: 0x1003b0e0)
CoTaskMemAlloc (Address: 0x1003b0d4)
CoTaskMemFree (Address: 0x1003b0cc)
CoTaskMemRealloc (Address: 0x1003b0c4)
CoUninitialize (Address: 0x1003b0dc)
StringFromCLSID (Address: 0x1003b0c0)
StringFromGUID2 (Address: 0x1003b0d8)

api-ms-win-core-com-midlproxystub-l1-1-0.dll

CStdStubBuffer2_Connect (Address: 0x1003b124)
CStdStubBuffer2_CountRefs (Address: 0x1003b140)
CStdStubBuffer2_Disconnect (Address: 0x1003b128)
CStdStubBuffer2_QueryInterface (Address: 0x1003b10c)
NdrProxyForwardingFunction3 (Address: 0x1003b110)
NdrProxyForwardingFunction4 (Address: 0x1003b100)
NdrProxyForwardingFunction5 (Address: 0x1003b0fc)
NdrProxyForwardingFunction6 (Address: 0x1003b154)
NdrProxyForwardingFunction7 (Address: 0x1003b118)
NdrProxyForwardingFunction8 (Address: 0x1003b13c)
NdrProxyForwardingFunction9 (Address: 0x1003b0f0)
ObjectStublessClient10 (Address: 0x1003b0ec)
ObjectStublessClient11 (Address: 0x1003b144)
ObjectStublessClient12 (Address: 0x1003b14c)
ObjectStublessClient13 (Address: 0x1003b11c)
ObjectStublessClient14 (Address: 0x1003b148)
ObjectStublessClient15 (Address: 0x1003b12c)
ObjectStublessClient16 (Address: 0x1003b104)
ObjectStublessClient17 (Address: 0x1003b0e8)
ObjectStublessClient18 (Address: 0x1003b134)
ObjectStublessClient19 (Address: 0x1003b108)
ObjectStublessClient3 (Address: 0x1003b138)
ObjectStublessClient4 (Address: 0x1003b130)
ObjectStublessClient5 (Address: 0x1003b114)
ObjectStublessClient6 (Address: 0x1003b0f8)
ObjectStublessClient7 (Address: 0x1003b120)
ObjectStublessClient8 (Address: 0x1003b0f4)
ObjectStublessClient9 (Address: 0x1003b150)

api-ms-win-core-debug-l1-1-0.dll

OutputDebugStringA (Address: 0x1003b15c)

api-ms-win-core-delayload-l1-1-0.dll

DelayLoadFailureHook (Address: 0x1003b164)

api-ms-win-core-delayload-l1-1-1.dll

ResolveDelayLoadedAPI (Address: 0x1003b16c)

api-ms-win-core-errorhandling-l1-1-0.dll

GetLastError (Address: 0x1003b17c)
RaiseException (Address: 0x1003b180)
SetLastError (Address: 0x1003b178)
SetUnhandledExceptionFilter (Address: 0x1003b184)
UnhandledExceptionFilter (Address: 0x1003b174)

api-ms-win-core-file-l1-1-0.dll

CreateFileW (Address: 0x1003b18c)
FindFirstFileW (Address: 0x1003b194)
FindNextFileW (Address: 0x1003b19c)
GetFullPathNameW (Address: 0x1003b198)
WriteFile (Address: 0x1003b190)

api-ms-win-core-handle-l1-1-0.dll

CloseHandle (Address: 0x1003b1a4)
DuplicateHandle (Address: 0x1003b1a8)

api-ms-win-core-heap-l1-1-0.dll

GetProcessHeap (Address: 0x1003b1b4)
HeapAlloc (Address: 0x1003b1b0)
HeapFree (Address: 0x1003b1b8)

api-ms-win-core-heap-l2-1-0.dll

LocalAlloc (Address: 0x1003b1c4)
LocalFree (Address: 0x1003b1c0)

api-ms-win-core-libraryloader-l1-2-0.dll

DisableThreadLibraryCalls (Address: 0x1003b1e8)
FindResourceExW (Address: 0x1003b1d4)
FreeLibrary (Address: 0x1003b1d0)
GetModuleFileNameW (Address: 0x1003b1e0)
GetModuleHandleW (Address: 0x1003b1cc)
GetProcAddress (Address: 0x1003b1dc)
LoadLibraryExW (Address: 0x1003b1e4)
LoadResource (Address: 0x1003b1d8)
SizeofResource (Address: 0x1003b1ec)

api-ms-win-core-localization-l1-2-0.dll

FormatMessageW (Address: 0x1003b1f4)

api-ms-win-core-memory-l1-1-0.dll

CreateFileMappingW (Address: 0x1003b200)
MapViewOfFile (Address: 0x1003b1fc)
UnmapViewOfFile (Address: 0x1003b204)

api-ms-win-core-processthreads-l1-1-0.dll

CreateProcessW (Address: 0x1003b220)
GetCurrentProcess (Address: 0x1003b224)
GetCurrentProcessId (Address: 0x1003b20c)
GetCurrentThreadId (Address: 0x1003b234)
GetExitCodeProcess (Address: 0x1003b230)
GetThreadId (Address: 0x1003b218)
TerminateProcess (Address: 0x1003b210)
TlsAlloc (Address: 0x1003b228)
TlsFree (Address: 0x1003b22c)
TlsGetValue (Address: 0x1003b21c)
TlsSetValue (Address: 0x1003b214)

api-ms-win-core-processthreads-l1-1-1.dll

OpenProcess (Address: 0x1003b23c)

api-ms-win-core-profile-l1-1-0.dll

QueryPerformanceCounter (Address: 0x1003b244)

api-ms-win-core-registry-l1-1-0.dll

RegCloseKey (Address: 0x1003b25c)
RegCreateKeyExW (Address: 0x1003b264)
RegDeleteValueW (Address: 0x1003b250)
RegEnumKeyExW (Address: 0x1003b268)
RegOpenKeyExW (Address: 0x1003b254)
RegQueryInfoKeyW (Address: 0x1003b260)
RegQueryValueExW (Address: 0x1003b24c)
RegSetValueExW (Address: 0x1003b258)

api-ms-win-core-string-l1-1-0.dll

CompareStringW (Address: 0x1003b274)
MultiByteToWideChar (Address: 0x1003b278)
WideCharToMultiByte (Address: 0x1003b270)

api-ms-win-core-string-l2-1-0.dll

CharNextW (Address: 0x1003b280)

api-ms-win-core-string-obsolete-l1-1-0.dll

lstrcmpiW (Address: 0x1003b288)

api-ms-win-core-synch-l1-1-0.dll

CreateMutexW (Address: 0x1003b2b4)
DeleteCriticalSection (Address: 0x1003b2b0)
EnterCriticalSection (Address: 0x1003b290)
InitializeCriticalSection (Address: 0x1003b2a4)
InitializeCriticalSectionAndSpinCount (Address: 0x1003b294)
LeaveCriticalSection (Address: 0x1003b2a0)
OpenMutexW (Address: 0x1003b29c)
ReleaseMutex (Address: 0x1003b298)
ReleaseSemaphore (Address: 0x1003b2a8)
WaitForSingleObject (Address: 0x1003b2ac)

api-ms-win-core-synch-l1-2-0.dll

Sleep (Address: 0x1003b2bc)

api-ms-win-core-synch-l1-2-1.dll

CreateSemaphoreW (Address: 0x1003b2c4)

api-ms-win-core-sysinfo-l1-1-0.dll

GetSystemTimeAsFileTime (Address: 0x1003b2d4)
GetTickCount (Address: 0x1003b2cc)
GetVersionExW (Address: 0x1003b2d0)

api-ms-win-eventing-classicprovider-l1-1-0.dll

GetTraceEnableFlags (Address: 0x1003b2ec)
GetTraceEnableLevel (Address: 0x1003b2e8)
GetTraceLoggerHandle (Address: 0x1003b2e0)
RegisterTraceGuidsW (Address: 0x1003b2f0)
TraceMessage (Address: 0x1003b2e4)
UnregisterTraceGuids (Address: 0x1003b2dc)

api-ms-win-eventing-provider-l1-1-0.dll

EventRegister (Address: 0x1003b2f8)
EventUnregister (Address: 0x1003b300)
EventWriteTransfer (Address: 0x1003b2fc)

api-ms-win-shcore-obsolete-l1-1-0.dll

CommandLineToArgvW (Address: 0x1003b308)

msvcrt.dll

__CxxFrameHandler3 (Address: 0x1003b320)
__dllonexit (Address: 0x1003b348)
__RTDynamicCast (Address: 0x1003b324)
_amsg_exit (Address: 0x1003b368)
_callnewh (Address: 0x1003b37c)
_CxxThrowException (Address: 0x1003b378)
_errno (Address: 0x1003b35c)
_except_handler4_common (Address: 0x1003b360)
_initterm (Address: 0x1003b364)
_lock (Address: 0x1003b350)
_onexit (Address: 0x1003b344)
_purecall (Address: 0x1003b3a8)
_unlock (Address: 0x1003b34c)
_vsnprintf (Address: 0x1003b32c)
_vsnwprintf (Address: 0x1003b334)
_wcsicmp (Address: 0x1003b3ac)
_wcstoi64 (Address: 0x1003b328)
_wcstoui64 (Address: 0x1003b390)
_XcptFilter (Address: 0x1003b36c)
??0exception@@QAE@ABQBD@Z (Address: 0x1003b374)
??0exception@@QAE@ABV0@@Z (Address: 0x1003b388)
??0exception@@QAE@XZ (Address: 0x1003b38c)
??1exception@@UAE@XZ (Address: 0x1003b384)
??1type_info@@UAE@XZ (Address: 0x1003b340)
?terminate@@YAXXZ (Address: 0x1003b354)
?what@exception@@UBEPBDXZ (Address: 0x1003b380)
free (Address: 0x1003b3a4)
iswdigit (Address: 0x1003b318)
iswxdigit (Address: 0x1003b338)
malloc (Address: 0x1003b3a0)
memcmp (Address: 0x1003b394)
memcpy (Address: 0x1003b33c)
memcpy_s (Address: 0x1003b3b0)
memmove_s (Address: 0x1003b398)
memset (Address: 0x1003b3b8)
realloc (Address: 0x1003b358)
sscanf_s (Address: 0x1003b370)
toupper (Address: 0x1003b314)
towlower (Address: 0x1003b330)
wcsncpy_s (Address: 0x1003b39c)
wcstod (Address: 0x1003b3b4)
wcstol (Address: 0x1003b31c)
wcstoul (Address: 0x1003b310)

ntdll.dll

NtClose (Address: 0x1003b3c8)
NtOpenProcessToken (Address: 0x1003b3c4)
NtOpenThreadToken (Address: 0x1003b3cc)
NtQueryInformationToken (Address: 0x1003b3c0)

RPCRT4.dll

CStdStubBuffer_AddRef (Address: 0x1003b014)
CStdStubBuffer_Connect (Address: 0x1003b030)
CStdStubBuffer_CountRefs (Address: 0x1003b04c)
CStdStubBuffer_DebugServerQueryInterface (Address: 0x1003b03c)
CStdStubBuffer_DebugServerRelease (Address: 0x1003b00c)
CStdStubBuffer_Disconnect (Address: 0x1003b01c)
CStdStubBuffer_Invoke (Address: 0x1003b000)
CStdStubBuffer_IsIIDSupported (Address: 0x1003b028)
CStdStubBuffer_QueryInterface (Address: 0x1003b004)
IUnknown_AddRef_Proxy (Address: 0x1003b040)
IUnknown_QueryInterface_Proxy (Address: 0x1003b024)
IUnknown_Release_Proxy (Address: 0x1003b010)
NdrCStdStubBuffer_Release (Address: 0x1003b034)
NdrCStdStubBuffer2_Release (Address: 0x1003b038)
NdrDllCanUnloadNow (Address: 0x1003b02c)
NdrDllGetClassObject (Address: 0x1003b018)
NdrOleAllocate (Address: 0x1003b008)
NdrOleFree (Address: 0x1003b020)
NdrStubCall2 (Address: 0x1003b044)
NdrStubForwardingFunction (Address: 0x1003b048)

SHLWAPI.dll

(Address: 0x1003b054)
PathFileExistsW (Address: 0x1003b058)
PathUnExpandEnvStringsW (Address: 0x1003b05c)

USER32.dll

DispatchMessageW (Address: 0x1003b074)
EnumChildWindows (Address: 0x1003b07c)
FindWindowW (Address: 0x1003b064)
GetParent (Address: 0x1003b068)
GetPropW (Address: 0x1003b084)
GetWindowLongW (Address: 0x1003b098)
IsWindow (Address: 0x1003b08c)
MessageBoxW (Address: 0x1003b0a0)
MsgWaitForMultipleObjectsEx (Address: 0x1003b0a4)
PeekMessageW (Address: 0x1003b070)
ReplyMessage (Address: 0x1003b094)
SetForegroundWindow (Address: 0x1003b06c)
SetProcessDPIAware (Address: 0x1003b080)
SetPropW (Address: 0x1003b090)
SetWindowLongW (Address: 0x1003b078)
ShowWindowAsync (Address: 0x1003b088)
TranslateMessage (Address: 0x1003b09c)