xwizards.dll

Description: Extensible Wizards Manager Module

Version: 10.0.19041.3636

Architecture: 64-bit

Operating System: Windows NT

SHA256: 5b1d2e70777f87b0a7792d8ff2e4d45b

File Size: 442.0 KB

Uploaded At: Dec. 1, 2025, 7:46 a.m.

Views: 5

Security Warning

This file has been flagged as potentially dangerous.

Reason: Detected potentially dangerous functions used for process injection: OpenProcess

Exported Functions

DllCanUnloadNow (Ordinal: 1, Address: 0x4830)
DllGetClassObject (Ordinal: 2, Address: 0x4890)
ProcessXMLFileA (Ordinal: 3, Address: 0x64a0)
ProcessXMLFileW (Ordinal: 4, Address: 0x65a0)
ResetRegistrationA (Ordinal: 5, Address: 0x5d40)
ResetRegistrationW (Ordinal: 6, Address: 0x5e40)
RunPropertySheetA (Ordinal: 7, Address: 0x7600)
RunPropertySheetW (Ordinal: 8, Address: 0x7700)
RunWizardA (Ordinal: 9, Address: 0x6ba0)
RunWizardW (Ordinal: 10, Address: 0x6ca0)
XWProcessXMLFile (Ordinal: 11, Address: 0x4d80)
XWRegisterHost (Ordinal: 12, Address: 0x4da0)
XWRegisterPageWithPage (Ordinal: 13, Address: 0x51c0)
XWRegisterPageWithTask (Ordinal: 14, Address: 0x5050)
XWRegisterTaskWithHost (Ordinal: 15, Address: 0x4ee0)
XWUnregisterHost (Ordinal: 16, Address: 0x5330)
XWUnregisterHostTaskLink (Ordinal: 17, Address: 0x56c0)
XWUnregisterPage (Ordinal: 18, Address: 0x5590)
XWUnregisterPagesLink (Ordinal: 19, Address: 0x5920)
XWUnregisterTask (Ordinal: 20, Address: 0x5460)
XWUnregisterTaskPageLink (Ordinal: 21, Address: 0x57f0)

Imported DLLs & Functions

api-ms-win-core-atoms-l1-1-0.dll

GlobalAddAtomA (Address: 0x18003bcd0)
GlobalGetAtomNameA (Address: 0x18003bcd8)
GlobalGetAtomNameW (Address: 0x18003bce0)

api-ms-win-core-com-l1-1-0.dll

CLSIDFromString (Address: 0x18003bd38)
CoCreateInstance (Address: 0x18003bd30)
CoFreeUnusedLibrariesEx (Address: 0x18003bd20)
CoInitializeEx (Address: 0x18003bcf0)
CoTaskMemAlloc (Address: 0x18003bd00)
CoTaskMemFree (Address: 0x18003bd10)
CoTaskMemRealloc (Address: 0x18003bcf8)
CoUninitialize (Address: 0x18003bd28)
StringFromCLSID (Address: 0x18003bd08)
StringFromGUID2 (Address: 0x18003bd18)

api-ms-win-core-com-midlproxystub-l1-1-0.dll

CStdStubBuffer2_Connect (Address: 0x18003bdc0)
CStdStubBuffer2_CountRefs (Address: 0x18003bdf0)
CStdStubBuffer2_Disconnect (Address: 0x18003be18)
CStdStubBuffer2_QueryInterface (Address: 0x18003bd90)
NdrProxyForwardingFunction3 (Address: 0x18003be20)
NdrProxyForwardingFunction4 (Address: 0x18003bd80)
NdrProxyForwardingFunction5 (Address: 0x18003bd70)
NdrProxyForwardingFunction6 (Address: 0x18003bdb8)
NdrProxyForwardingFunction7 (Address: 0x18003bda0)
NdrProxyForwardingFunction8 (Address: 0x18003bde8)
NdrProxyForwardingFunction9 (Address: 0x18003bd50)
ObjectStublessClient10 (Address: 0x18003bd48)
ObjectStublessClient11 (Address: 0x18003bdf8)
ObjectStublessClient12 (Address: 0x18003be08)
ObjectStublessClient13 (Address: 0x18003bda8)
ObjectStublessClient14 (Address: 0x18003be00)
ObjectStublessClient15 (Address: 0x18003bdc8)
ObjectStublessClient16 (Address: 0x18003bd78)
ObjectStublessClient17 (Address: 0x18003be10)
ObjectStublessClient18 (Address: 0x18003bdd0)
ObjectStublessClient19 (Address: 0x18003bd88)
ObjectStublessClient3 (Address: 0x18003bde0)
ObjectStublessClient4 (Address: 0x18003bdd8)
ObjectStublessClient5 (Address: 0x18003bd98)
ObjectStublessClient6 (Address: 0x18003bd68)
ObjectStublessClient7 (Address: 0x18003bdb0)
ObjectStublessClient8 (Address: 0x18003bd60)
ObjectStublessClient9 (Address: 0x18003bd58)

api-ms-win-core-debug-l1-1-0.dll

OutputDebugStringA (Address: 0x18003be30)

api-ms-win-core-delayload-l1-1-0.dll

DelayLoadFailureHook (Address: 0x18003be40)

api-ms-win-core-delayload-l1-1-1.dll

ResolveDelayLoadedAPI (Address: 0x18003be50)

api-ms-win-core-errorhandling-l1-1-0.dll

GetLastError (Address: 0x18003be80)
RaiseException (Address: 0x18003be68)
SetLastError (Address: 0x18003be60)
SetUnhandledExceptionFilter (Address: 0x18003be70)
UnhandledExceptionFilter (Address: 0x18003be78)

api-ms-win-core-file-l1-1-0.dll

CreateFileW (Address: 0x18003bea8)
FindFirstFileW (Address: 0x18003bea0)
FindNextFileW (Address: 0x18003beb0)
GetFullPathNameW (Address: 0x18003be98)
WriteFile (Address: 0x18003be90)

api-ms-win-core-handle-l1-1-0.dll

CloseHandle (Address: 0x18003bec0)
DuplicateHandle (Address: 0x18003bec8)

api-ms-win-core-heap-l1-1-0.dll

GetProcessHeap (Address: 0x18003bed8)
HeapAlloc (Address: 0x18003bee8)
HeapFree (Address: 0x18003bee0)

api-ms-win-core-heap-l2-1-0.dll

LocalAlloc (Address: 0x18003bf00)
LocalFree (Address: 0x18003bef8)

api-ms-win-core-libraryloader-l1-2-0.dll

DisableThreadLibraryCalls (Address: 0x18003bf48)
FindResourceExW (Address: 0x18003bf28)
FreeLibrary (Address: 0x18003bf20)
GetModuleFileNameW (Address: 0x18003bf50)
GetModuleHandleW (Address: 0x18003bf18)
GetProcAddress (Address: 0x18003bf38)
LoadLibraryExW (Address: 0x18003bf40)
LoadResource (Address: 0x18003bf10)
SizeofResource (Address: 0x18003bf30)

api-ms-win-core-localization-l1-2-0.dll

FormatMessageW (Address: 0x18003bf60)

api-ms-win-core-memory-l1-1-0.dll

CreateFileMappingW (Address: 0x18003bf78)
MapViewOfFile (Address: 0x18003bf70)
UnmapViewOfFile (Address: 0x18003bf80)

api-ms-win-core-processthreads-l1-1-0.dll

CreateProcessW (Address: 0x18003bfb8)
GetCurrentProcess (Address: 0x18003bfe0)
GetCurrentProcessId (Address: 0x18003bfd8)
GetCurrentThreadId (Address: 0x18003bfa0)
GetExitCodeProcess (Address: 0x18003bfb0)
GetThreadId (Address: 0x18003bf90)
TerminateProcess (Address: 0x18003bfc8)
TlsAlloc (Address: 0x18003bfc0)
TlsFree (Address: 0x18003bf98)
TlsGetValue (Address: 0x18003bfd0)
TlsSetValue (Address: 0x18003bfa8)

api-ms-win-core-processthreads-l1-1-1.dll

OpenProcess (Address: 0x18003bff0)

api-ms-win-core-profile-l1-1-0.dll

QueryPerformanceCounter (Address: 0x18003c000)

api-ms-win-core-registry-l1-1-0.dll

RegCloseKey (Address: 0x18003c040)
RegCreateKeyExW (Address: 0x18003c030)
RegDeleteValueW (Address: 0x18003c018)
RegEnumKeyExW (Address: 0x18003c028)
RegOpenKeyExW (Address: 0x18003c020)
RegQueryInfoKeyW (Address: 0x18003c038)
RegQueryValueExW (Address: 0x18003c010)
RegSetValueExW (Address: 0x18003c048)

api-ms-win-core-rtlsupport-l1-1-0.dll

RtlCaptureContext (Address: 0x18003c058)
RtlLookupFunctionEntry (Address: 0x18003c060)
RtlVirtualUnwind (Address: 0x18003c068)

api-ms-win-core-string-l1-1-0.dll

CompareStringW (Address: 0x18003c088)
MultiByteToWideChar (Address: 0x18003c080)
WideCharToMultiByte (Address: 0x18003c078)

api-ms-win-core-string-l2-1-0.dll

CharNextW (Address: 0x18003c098)

api-ms-win-core-string-obsolete-l1-1-0.dll

lstrcmpiW (Address: 0x18003c0a8)

api-ms-win-core-synch-l1-1-0.dll

CreateMutexW (Address: 0x18003c0c8)
DeleteCriticalSection (Address: 0x18003c0e0)
EnterCriticalSection (Address: 0x18003c0c0)
InitializeCriticalSection (Address: 0x18003c0f0)
InitializeCriticalSectionAndSpinCount (Address: 0x18003c0b8)
LeaveCriticalSection (Address: 0x18003c0e8)
OpenMutexW (Address: 0x18003c0d8)
ReleaseMutex (Address: 0x18003c0d0)
ReleaseSemaphore (Address: 0x18003c100)
WaitForSingleObject (Address: 0x18003c0f8)

api-ms-win-core-synch-l1-2-0.dll

Sleep (Address: 0x18003c110)

api-ms-win-core-synch-l1-2-1.dll

CreateSemaphoreW (Address: 0x18003c120)

api-ms-win-core-sysinfo-l1-1-0.dll

GetSystemTimeAsFileTime (Address: 0x18003c130)
GetTickCount (Address: 0x18003c138)
GetVersionExW (Address: 0x18003c140)

api-ms-win-eventing-classicprovider-l1-1-0.dll

GetTraceEnableFlags (Address: 0x18003c150)
GetTraceEnableLevel (Address: 0x18003c170)
GetTraceLoggerHandle (Address: 0x18003c158)
RegisterTraceGuidsW (Address: 0x18003c168)
TraceMessage (Address: 0x18003c178)
UnregisterTraceGuids (Address: 0x18003c160)

api-ms-win-eventing-provider-l1-1-0.dll

EventRegister (Address: 0x18003c188)
EventUnregister (Address: 0x18003c190)
EventWriteTransfer (Address: 0x18003c198)

api-ms-win-shcore-obsolete-l1-1-0.dll

CommandLineToArgvW (Address: 0x18003c1a8)

msvcrt.dll

__C_specific_handler (Address: 0x18003c300)
__CxxFrameHandler3 (Address: 0x18003c1f0)
__dllonexit (Address: 0x18003c230)
__RTDynamicCast (Address: 0x18003c1e8)
_amsg_exit (Address: 0x18003c268)
_callnewh (Address: 0x18003c298)
_CxxThrowException (Address: 0x18003c278)
_errno (Address: 0x18003c258)
_initterm (Address: 0x18003c260)
_lock (Address: 0x18003c240)
_onexit (Address: 0x18003c228)
_purecall (Address: 0x18003c2e8)
_unlock (Address: 0x18003c238)
_vsnprintf (Address: 0x18003c200)
_vsnwprintf (Address: 0x18003c210)
_wcsicmp (Address: 0x18003c2f0)
_wcstoi64 (Address: 0x18003c1d0)
_wcstoui64 (Address: 0x18003c308)
_XcptFilter (Address: 0x18003c270)
??0exception@@QEAA@AEBQEBD@Z (Address: 0x18003c290)
??0exception@@QEAA@AEBQEBDH@Z (Address: 0x18003c2b8)
??0exception@@QEAA@AEBV0@@Z (Address: 0x18003c2b0)
??0exception@@QEAA@XZ (Address: 0x18003c288)
??1exception@@UEAA@XZ (Address: 0x18003c2a8)
??1type_info@@UEAA@XZ (Address: 0x18003c220)
?terminate@@YAXXZ (Address: 0x18003c248)
?what@exception@@UEBAPEBDXZ (Address: 0x18003c2a0)
free (Address: 0x18003c2e0)
iswdigit (Address: 0x18003c1f8)
iswxdigit (Address: 0x18003c2c8)
malloc (Address: 0x18003c2d8)
memcmp (Address: 0x18003c1e0)
memcpy (Address: 0x18003c218)
memcpy_s (Address: 0x18003c2f8)
memmove_s (Address: 0x18003c2c0)
memset (Address: 0x18003c310)
realloc (Address: 0x18003c250)
sscanf_s (Address: 0x18003c280)
toupper (Address: 0x18003c1b8)
towlower (Address: 0x18003c208)
wcsncpy_s (Address: 0x18003c2d0)
wcstod (Address: 0x18003c1c0)
wcstol (Address: 0x18003c1d8)
wcstoul (Address: 0x18003c1c8)

ntdll.dll

NtClose (Address: 0x18003c330)
NtOpenProcessToken (Address: 0x18003c328)
NtOpenThreadToken (Address: 0x18003c338)
NtQueryInformationToken (Address: 0x18003c320)

RPCRT4.dll

CStdStubBuffer_AddRef (Address: 0x18003bba8)
CStdStubBuffer_Connect (Address: 0x18003bbe0)
CStdStubBuffer_CountRefs (Address: 0x18003bc10)
CStdStubBuffer_DebugServerQueryInterface (Address: 0x18003bbf8)
CStdStubBuffer_DebugServerRelease (Address: 0x18003bb90)
CStdStubBuffer_Disconnect (Address: 0x18003bbb0)
CStdStubBuffer_Invoke (Address: 0x18003bb78)
CStdStubBuffer_IsIIDSupported (Address: 0x18003bbd0)
CStdStubBuffer_QueryInterface (Address: 0x18003bb80)
IUnknown_AddRef_Proxy (Address: 0x18003bc00)
IUnknown_QueryInterface_Proxy (Address: 0x18003bbc0)
IUnknown_Release_Proxy (Address: 0x18003bba0)
NdrCStdStubBuffer_Release (Address: 0x18003bbf0)
NdrCStdStubBuffer2_Release (Address: 0x18003bbe8)
NdrDllCanUnloadNow (Address: 0x18003bbd8)
NdrDllGetClassObject (Address: 0x18003bb98)
NdrOleAllocate (Address: 0x18003bb88)
NdrOleFree (Address: 0x18003bbb8)
NdrStubCall3 (Address: 0x18003bbc8)
NdrStubForwardingFunction (Address: 0x18003bc08)

SHLWAPI.dll

(Address: 0x18003bc28)
PathFileExistsW (Address: 0x18003bc20)
PathUnExpandEnvStringsW (Address: 0x18003bc30)

USER32.dll

DispatchMessageW (Address: 0x18003bc60)
EnumChildWindows (Address: 0x18003bc78)
FindWindowW (Address: 0x18003bc40)
GetParent (Address: 0x18003bc48)
GetPropW (Address: 0x18003bcb0)
GetWindowLongPtrW (Address: 0x18003bc98)
IsWindow (Address: 0x18003bc70)
MessageBoxW (Address: 0x18003bc80)
MsgWaitForMultipleObjectsEx (Address: 0x18003bc68)
PeekMessageW (Address: 0x18003bc58)
ReplyMessage (Address: 0x18003bc90)
SetForegroundWindow (Address: 0x18003bc50)
SetProcessDPIAware (Address: 0x18003bca8)
SetPropW (Address: 0x18003bc88)
SetWindowLongPtrW (Address: 0x18003bca0)
ShowWindowAsync (Address: 0x18003bcb8)
TranslateMessage (Address: 0x18003bcc0)