xliveinstall.dll

Description: XLiveInstall DLL

Version: 3.2.6.0

Architecture: 32-bit

Operating System: Windows NT

SHA256: 65d6f19c54f55eeb5e074714b1c98b42

File Size: 183.1 KB

Uploaded At: Feb. 19, 2026, 10:27 p.m.

Views: 5

Security Warning

This file has been flagged as potentially dangerous.

Reason: Detected potentially dangerous functions used for process injection: OpenProcess

Exported Functions

Initialize (Ordinal: 1, Address: 0x8194)
Shutdown (Ordinal: 2, Address: 0x14931)
SetActivationToken (Ordinal: 3, Address: 0x6070)
GetActivationToken (Ordinal: 4, Address: 0x60a4)
RemoveActivationToken (Ordinal: 5, Address: 0x60ce)
InstallProduct (Ordinal: 6, Address: 0x60ed)
(Ordinal: 7, Address: 0x6161)
IsProductInstalled (Ordinal: 8, Address: 0x623b)
(Ordinal: 9, Address: 0x6331)
(Ordinal: 10, Address: 0x6364)
(Ordinal: 11, Address: 0x63d1)
(Ordinal: 12, Address: 0x63f0)
GetProductData (Ordinal: 13, Address: 0x62fe)
RemoveProductEx (Ordinal: 14, Address: 0x61c9)
GetRuntimePath (Ordinal: 15, Address: 0x62df)

Imported DLLs & Functions

ADVAPI32.dll

CryptAcquireContextW (Address: 0x401010)
CryptCreateHash (Address: 0x401014)
CryptDestroyHash (Address: 0x401020)
CryptGetHashParam (Address: 0x401000)
CryptHashData (Address: 0x401018)
CryptReleaseContext (Address: 0x401024)
GetSidSubAuthority (Address: 0x40100c)
GetSidSubAuthorityCount (Address: 0x401008)
GetTokenInformation (Address: 0x401004)
OpenProcessToken (Address: 0x40101c)
RegCloseKey (Address: 0x40102c)
RegOpenKeyExW (Address: 0x401028)
RegQueryInfoKeyW (Address: 0x401030)

CRYPT32.dll

CertVerifyCertificateChainPolicy (Address: 0x401038)
CryptProtectData (Address: 0x40103c)
CryptUnprotectData (Address: 0x401040)

KERNEL32.dll

CloseHandle (Address: 0x401214)
CompareStringA (Address: 0x4011dc)
CompareStringW (Address: 0x4011e0)
CreateEventW (Address: 0x401124)
CreateFileA (Address: 0x4011d4)
CreateFileW (Address: 0x40121c)
CreateThread (Address: 0x401060)
CreateToolhelp32Snapshot (Address: 0x4010bc)
DeleteCriticalSection (Address: 0x4011f8)
DeleteFileW (Address: 0x401218)
EnterCriticalSection (Address: 0x4010e8)
ExitProcess (Address: 0x401234)
FindClose (Address: 0x401054)
FindFirstFileW (Address: 0x40105c)
FindNextFileW (Address: 0x401058)
FlushFileBuffers (Address: 0x4011d8)
FreeEnvironmentStringsA (Address: 0x40113c)
FreeEnvironmentStringsW (Address: 0x401144)
FreeLibrary (Address: 0x40108c)
GetACP (Address: 0x401178)
GetCommandLineA (Address: 0x4010fc)
GetCommandLineW (Address: 0x4010c4)
GetConsoleCP (Address: 0x4011a8)
GetConsoleMode (Address: 0x4011ac)
GetConsoleOutputCP (Address: 0x4011cc)
GetCPInfo (Address: 0x401174)
GetCurrentProcess (Address: 0x401088)
GetCurrentProcessId (Address: 0x4010b0)
GetCurrentThreadId (Address: 0x4010f8)
GetDateFormatA (Address: 0x401194)
GetDriveTypeW (Address: 0x401074)
GetEnvironmentStrings (Address: 0x401140)
GetEnvironmentStringsW (Address: 0x401148)
GetExitCodeProcess (Address: 0x4010d4)
GetExitCodeThread (Address: 0x4010c8)
GetFileSize (Address: 0x40120c)
GetFileSizeEx (Address: 0x401078)
GetFileTime (Address: 0x401220)
GetFileType (Address: 0x401130)
GetFullPathNameW (Address: 0x4010d8)
GetLastError (Address: 0x401238)
GetLocaleInfoA (Address: 0x4011bc)
GetModuleFileNameA (Address: 0x401138)
GetModuleFileNameW (Address: 0x4011f0)
GetModuleHandleA (Address: 0x401184)
GetModuleHandleW (Address: 0x401098)
GetOEMCP (Address: 0x40117c)
GetPrivateProfileStringW (Address: 0x40106c)
GetProcAddress (Address: 0x401090)
GetProcessHeap (Address: 0x4010a8)
GetProcessId (Address: 0x4010d0)
GetStartupInfoA (Address: 0x401134)
GetStdHandle (Address: 0x40112c)
GetStringTypeA (Address: 0x4011b4)
GetStringTypeW (Address: 0x4011b8)
GetSystemDirectoryW (Address: 0x40107c)
GetSystemInfo (Address: 0x4010f0)
GetSystemTime (Address: 0x4010ec)
GetSystemTimeAsFileTime (Address: 0x40115c)
GetSystemWow64DirectoryW (Address: 0x401080)
GetTempFileNameW (Address: 0x401048)
GetTempPathW (Address: 0x401050)
GetTickCount (Address: 0x40104c)
GetTimeFormatA (Address: 0x401190)
GetTimeZoneInformation (Address: 0x4011c0)
GetUserDefaultLCID (Address: 0x40109c)
GetUserDefaultUILanguage (Address: 0x401070)
GetVersionExW (Address: 0x4010f4)
HeapAlloc (Address: 0x4010a4)
HeapCreate (Address: 0x40114c)
HeapDestroy (Address: 0x401150)
HeapFree (Address: 0x4010ac)
HeapReAlloc (Address: 0x401100)
HeapSize (Address: 0x401198)
InitializeCriticalSection (Address: 0x4011fc)
InitializeCriticalSectionAndSpinCount (Address: 0x4011a4)
InterlockedDecrement (Address: 0x40111c)
InterlockedExchange (Address: 0x40119c)
InterlockedIncrement (Address: 0x401114)
IsDebuggerPresent (Address: 0x40116c)
IsValidCodePage (Address: 0x401180)
IsWow64Process (Address: 0x401084)
LCMapStringA (Address: 0x4011b0)
LCMapStringW (Address: 0x401188)
LeaveCriticalSection (Address: 0x4010e0)
LoadLibraryA (Address: 0x4011a0)
LoadLibraryW (Address: 0x401094)
LocalAlloc (Address: 0x40122c)
LocalFree (Address: 0x401230)
MultiByteToWideChar (Address: 0x401210)
OpenEventW (Address: 0x4010c0)
OpenProcess (Address: 0x4010a0)
Process32FirstW (Address: 0x4010b8)
Process32NextW (Address: 0x4010b4)
QueryPerformanceCounter (Address: 0x401158)
QueueUserWorkItem (Address: 0x4011e8)
RaiseException (Address: 0x401068)
ReadFile (Address: 0x401208)
RemoveDirectoryW (Address: 0x401064)
RtlUnwind (Address: 0x40118c)
SetEnvironmentVariableA (Address: 0x4011e4)
SetEvent (Address: 0x4011f4)
SetFilePointer (Address: 0x4010e4)
SetHandleCount (Address: 0x401128)
SetLastError (Address: 0x401118)
SetStdHandle (Address: 0x4011c4)
SetUnhandledExceptionFilter (Address: 0x401168)
Sleep (Address: 0x401120)
SystemTimeToTzSpecificLocalTime (Address: 0x4010dc)
TerminateProcess (Address: 0x401160)
TlsAlloc (Address: 0x401108)
TlsFree (Address: 0x401110)
TlsGetValue (Address: 0x401104)
TlsSetValue (Address: 0x40110c)
UnhandledExceptionFilter (Address: 0x401164)
VerifyVersionInfoA (Address: 0x401228)
VerSetConditionMask (Address: 0x401224)
VirtualAlloc (Address: 0x401170)
VirtualFree (Address: 0x401154)
WaitForMultipleObjects (Address: 0x4010cc)
WaitForSingleObject (Address: 0x4011ec)
WideCharToMultiByte (Address: 0x401200)
WriteConsoleA (Address: 0x4011c8)
WriteConsoleW (Address: 0x4011d0)
WriteFile (Address: 0x401204)

msi.dll

(Address: 0x40131c)
(Address: 0x4012e4)
(Address: 0x4012e8)
(Address: 0x4012ec)
(Address: 0x4012f0)
(Address: 0x4012f4)
(Address: 0x4012f8)
(Address: 0x4012fc)
(Address: 0x401300)
(Address: 0x401304)
(Address: 0x401308)
(Address: 0x40130c)
(Address: 0x401310)
(Address: 0x401314)
(Address: 0x401318)
(Address: 0x401320)
(Address: 0x401324)

ole32.dll

CoCreateInstance (Address: 0x401330)
CoInitialize (Address: 0x401334)
CoUninitialize (Address: 0x401338)
IIDFromString (Address: 0x40133c)
StringFromGUID2 (Address: 0x40132c)

OLEAUT32.dll

SysAllocString (Address: 0x40124c)
SysAllocStringByteLen (Address: 0x401248)
SysFreeString (Address: 0x401258)
SysStringByteLen (Address: 0x401244)
SysStringLen (Address: 0x401240)
VariantClear (Address: 0x401250)
VariantInit (Address: 0x401254)

SETUPAPI.dll

SetupIterateCabinetW (Address: 0x401260)

SHELL32.dll

SHCreateDirectoryExW (Address: 0x40126c)
ShellExecuteExW (Address: 0x401268)
SHFileOperationW (Address: 0x401274)
SHGetFolderPathW (Address: 0x401270)

SHLWAPI.dll

PathAddBackslashW (Address: 0x401298)
PathCombineW (Address: 0x401284)
PathFileExistsW (Address: 0x401288)
PathFindFileNameW (Address: 0x40129c)
PathIsDirectoryW (Address: 0x40128c)
PathMatchSpecW (Address: 0x4012a4)
PathRemoveExtensionW (Address: 0x4012a0)
PathRemoveFileSpecW (Address: 0x4012ac)
PathStripPathW (Address: 0x4012a8)
PathStripToRootW (Address: 0x401290)
SHEnumKeyExW (Address: 0x401294)
SHGetValueW (Address: 0x40127c)
SHSetValueW (Address: 0x401280)

USER32.dll

CharLowerBuffW (Address: 0x4012b4)
MessageBoxW (Address: 0x4012b8)

VERSION.dll

GetFileVersionInfoSizeW (Address: 0x4012c0)
GetFileVersionInfoW (Address: 0x4012c4)
VerQueryValueW (Address: 0x4012c8)

WINTRUST.dll

IsCatalogFile (Address: 0x4012d4)
WinVerifyTrustEx (Address: 0x4012d8)
WTHelperGetProvSignerFromChain (Address: 0x4012d0)
WTHelperProvDataFromStateData (Address: 0x4012dc)