| ofs | hex dump | ascii |
|---|---|---|
| 0000 | 21 3c 61 72 63 68 3e 0a 2f 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 31 35 31 36 31 36 30 37 | !<arch>./...............15161607 |
| 0020 | 36 39 20 20 30 20 20 20 20 20 30 20 20 20 20 20 30 20 20 20 20 20 20 20 32 35 38 34 20 20 20 20 | 69..0.....0.....0.......2584.... |
| 0040 | 20 20 60 0a 00 00 00 5a 00 00 0a 5c 00 00 0d 18 00 00 10 46 00 00 10 46 00 00 13 34 00 00 13 34 | ..`....Z...\.......F...F...4...4 |
| 0060 | 00 00 16 14 00 00 16 14 00 00 19 22 00 00 19 22 00 00 1b ec 00 00 1b ec 00 00 1e e4 00 00 1e e4 | ..........."..."................ |
| 0080 | 00 00 21 ba 00 00 21 ba 00 00 24 84 00 00 24 84 00 00 27 6c 00 00 27 6c 00 00 2a 70 00 00 2a 70 | ..!...!...$...$...'l..'l..*p..*p |
| 00a0 | 00 00 2d 68 00 00 2d 68 00 00 30 44 00 00 30 44 00 00 33 48 00 00 33 48 00 00 36 3c 00 00 36 3c | ..-h..-h..0D..0D..3H..3H..6<..6< |
| 00c0 | 00 00 39 34 00 00 39 34 00 00 3c 28 00 00 3c 28 00 00 3f 20 00 00 3f 20 00 00 42 14 00 00 42 14 | ..94..94..<(..<(..?...?...B...B. |
| 00e0 | 00 00 44 de 00 00 44 de 00 00 47 fc 00 00 47 fc 00 00 4a f2 00 00 4a f2 00 00 4e 0c 00 00 4e 0c | ..D...D...G...G...J...J...N...N. |
| 0100 | 00 00 51 34 00 00 51 34 00 00 54 52 00 00 54 52 00 00 57 6a 00 00 57 6a 00 00 5a 6e 00 00 5a 6e | ..Q4..Q4..TR..TR..Wj..Wj..Zn..Zn |
| 0120 | 00 00 5d 88 00 00 5d 88 00 00 60 7c 00 00 60 7c 00 00 63 66 00 00 63 66 00 00 66 80 00 00 66 80 | ..]...]...`|..`|..cf..cf..f...f. |
| 0140 | 00 00 69 7a 00 00 69 7a 00 00 6c 80 00 00 6c 80 00 00 6f 62 00 00 6f 62 00 00 72 5a 00 00 72 5a | ..iz..iz..l...l...ob..ob..rZ..rZ |
| 0160 | 00 00 75 68 00 00 75 68 00 00 78 52 00 00 78 52 00 00 7b 60 00 00 7b 60 00 00 7e 4c 00 00 7e 4c | ..uh..uh..xR..xR..{`..{`..~L..~L |
| 0180 | 00 00 81 2c 00 00 81 2c 00 00 84 2c 00 00 84 2c 00 00 87 1a 00 00 87 1a 00 00 89 e4 00 00 89 e4 | ...,...,...,...,................ |
| 01a0 | 00 00 8c c2 00 00 8c c2 00 00 8f 98 00 00 8f 98 5f 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 | ................__C__Users_Peter |
| 01c0 | 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 | _Code_winapi_rs_x86_64_lib_libwi |
| 01e0 | 6e 61 70 69 5f 6e 61 6e 6f 73 72 76 5f 77 65 76 74 61 70 69 5f 61 5f 69 6e 61 6d 65 00 5f 68 65 | napi_nanosrv_wevtapi_a_iname._he |
| 0200 | 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 | ad_C__Users_Peter_Code_winapi_rs |
| 0220 | 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 6e 61 6e 6f 73 72 76 5f 77 65 | _x86_64_lib_libwinapi_nanosrv_we |
| 0240 | 76 74 61 70 69 5f 61 00 45 76 74 55 70 64 61 74 65 42 6f 6f 6b 6d 61 72 6b 00 5f 5f 69 6d 70 5f | vtapi_a.EvtUpdateBookmark.__imp_ |
| 0260 | 45 76 74 55 70 64 61 74 65 42 6f 6f 6b 6d 61 72 6b 00 45 76 74 53 75 62 73 63 72 69 62 65 00 5f | EvtUpdateBookmark.EvtSubscribe._ |
| 0280 | 5f 69 6d 70 5f 45 76 74 53 75 62 73 63 72 69 62 65 00 45 76 74 53 65 74 43 68 61 6e 6e 65 6c 43 | _imp_EvtSubscribe.EvtSetChannelC |
| 02a0 | 6f 6e 66 69 67 50 72 6f 70 65 72 74 79 00 5f 5f 69 6d 70 5f 45 76 74 53 65 74 43 68 61 6e 6e 65 | onfigProperty.__imp_EvtSetChanne |
| 02c0 | 6c 43 6f 6e 66 69 67 50 72 6f 70 65 72 74 79 00 45 76 74 53 65 65 6b 00 5f 5f 69 6d 70 5f 45 76 | lConfigProperty.EvtSeek.__imp_Ev |
| 02e0 | 74 53 65 65 6b 00 45 76 74 53 61 76 65 43 68 61 6e 6e 65 6c 43 6f 6e 66 69 67 00 5f 5f 69 6d 70 | tSeek.EvtSaveChannelConfig.__imp |
| 0300 | 5f 45 76 74 53 61 76 65 43 68 61 6e 6e 65 6c 43 6f 6e 66 69 67 00 45 76 74 52 65 6e 64 65 72 00 | _EvtSaveChannelConfig.EvtRender. |
| 0320 | 5f 5f 69 6d 70 5f 45 76 74 52 65 6e 64 65 72 00 45 76 74 51 75 65 72 79 00 5f 5f 69 6d 70 5f 45 | __imp_EvtRender.EvtQuery.__imp_E |
| 0340 | 76 74 51 75 65 72 79 00 45 76 74 4f 70 65 6e 53 65 73 73 69 6f 6e 00 5f 5f 69 6d 70 5f 45 76 74 | vtQuery.EvtOpenSession.__imp_Evt |
| 0360 | 4f 70 65 6e 53 65 73 73 69 6f 6e 00 45 76 74 4f 70 65 6e 50 75 62 6c 69 73 68 65 72 4d 65 74 61 | OpenSession.EvtOpenPublisherMeta |
| 0380 | 64 61 74 61 00 5f 5f 69 6d 70 5f 45 76 74 4f 70 65 6e 50 75 62 6c 69 73 68 65 72 4d 65 74 61 64 | data.__imp_EvtOpenPublisherMetad |
| 03a0 | 61 74 61 00 45 76 74 4f 70 65 6e 50 75 62 6c 69 73 68 65 72 45 6e 75 6d 00 5f 5f 69 6d 70 5f 45 | ata.EvtOpenPublisherEnum.__imp_E |
| 03c0 | 76 74 4f 70 65 6e 50 75 62 6c 69 73 68 65 72 45 6e 75 6d 00 45 76 74 4f 70 65 6e 4c 6f 67 00 5f | vtOpenPublisherEnum.EvtOpenLog._ |
| 03e0 | 5f 69 6d 70 5f 45 76 74 4f 70 65 6e 4c 6f 67 00 45 76 74 4f 70 65 6e 45 76 65 6e 74 4d 65 74 61 | _imp_EvtOpenLog.EvtOpenEventMeta |
| 0400 | 64 61 74 61 45 6e 75 6d 00 5f 5f 69 6d 70 5f 45 76 74 4f 70 65 6e 45 76 65 6e 74 4d 65 74 61 64 | dataEnum.__imp_EvtOpenEventMetad |
| 0420 | 61 74 61 45 6e 75 6d 00 45 76 74 4f 70 65 6e 43 68 61 6e 6e 65 6c 45 6e 75 6d 00 5f 5f 69 6d 70 | ataEnum.EvtOpenChannelEnum.__imp |
| 0440 | 5f 45 76 74 4f 70 65 6e 43 68 61 6e 6e 65 6c 45 6e 75 6d 00 45 76 74 4f 70 65 6e 43 68 61 6e 6e | _EvtOpenChannelEnum.EvtOpenChann |
| 0460 | 65 6c 43 6f 6e 66 69 67 00 5f 5f 69 6d 70 5f 45 76 74 4f 70 65 6e 43 68 61 6e 6e 65 6c 43 6f 6e | elConfig.__imp_EvtOpenChannelCon |
| 0480 | 66 69 67 00 45 76 74 4e 65 78 74 50 75 62 6c 69 73 68 65 72 49 64 00 5f 5f 69 6d 70 5f 45 76 74 | fig.EvtNextPublisherId.__imp_Evt |
| 04a0 | 4e 65 78 74 50 75 62 6c 69 73 68 65 72 49 64 00 45 76 74 4e 65 78 74 45 76 65 6e 74 4d 65 74 61 | NextPublisherId.EvtNextEventMeta |
| 04c0 | 64 61 74 61 00 5f 5f 69 6d 70 5f 45 76 74 4e 65 78 74 45 76 65 6e 74 4d 65 74 61 64 61 74 61 00 | data.__imp_EvtNextEventMetadata. |
| 04e0 | 45 76 74 4e 65 78 74 43 68 61 6e 6e 65 6c 50 61 74 68 00 5f 5f 69 6d 70 5f 45 76 74 4e 65 78 74 | EvtNextChannelPath.__imp_EvtNext |
| 0500 | 43 68 61 6e 6e 65 6c 50 61 74 68 00 45 76 74 4e 65 78 74 00 5f 5f 69 6d 70 5f 45 76 74 4e 65 78 | ChannelPath.EvtNext.__imp_EvtNex |
| 0520 | 74 00 45 76 74 49 6e 74 57 72 69 74 65 58 6d 6c 45 76 65 6e 74 54 6f 4c 6f 63 61 6c 4c 6f 67 66 | t.EvtIntWriteXmlEventToLocalLogf |
| 0540 | 69 6c 65 00 5f 5f 69 6d 70 5f 45 76 74 49 6e 74 57 72 69 74 65 58 6d 6c 45 76 65 6e 74 54 6f 4c | ile.__imp_EvtIntWriteXmlEventToL |
| 0560 | 6f 63 61 6c 4c 6f 67 66 69 6c 65 00 45 76 74 49 6e 74 52 65 74 72 61 63 74 43 6f 6e 66 69 67 00 | ocalLogfile.EvtIntRetractConfig. |
| 0580 | 5f 5f 69 6d 70 5f 45 76 74 49 6e 74 52 65 74 72 61 63 74 43 6f 6e 66 69 67 00 45 76 74 49 6e 74 | __imp_EvtIntRetractConfig.EvtInt |
| 05a0 | 52 65 70 6f 72 74 45 76 65 6e 74 41 6e 64 53 6f 75 72 63 65 41 73 79 6e 63 00 5f 5f 69 6d 70 5f | ReportEventAndSourceAsync.__imp_ |
| 05c0 | 45 76 74 49 6e 74 52 65 70 6f 72 74 45 76 65 6e 74 41 6e 64 53 6f 75 72 63 65 41 73 79 6e 63 00 | EvtIntReportEventAndSourceAsync. |
| 05e0 | 45 76 74 49 6e 74 52 65 70 6f 72 74 41 75 74 68 7a 45 76 65 6e 74 41 6e 64 53 6f 75 72 63 65 41 | EvtIntReportAuthzEventAndSourceA |
| 0600 | 73 79 6e 63 00 5f 5f 69 6d 70 5f 45 76 74 49 6e 74 52 65 70 6f 72 74 41 75 74 68 7a 45 76 65 6e | sync.__imp_EvtIntReportAuthzEven |
| 0620 | 74 41 6e 64 53 6f 75 72 63 65 41 73 79 6e 63 00 45 76 74 49 6e 74 52 65 6e 64 65 72 52 65 73 6f | tAndSourceAsync.EvtIntRenderReso |
| 0640 | 75 72 63 65 45 76 65 6e 74 54 65 6d 70 6c 61 74 65 00 5f 5f 69 6d 70 5f 45 76 74 49 6e 74 52 65 | urceEventTemplate.__imp_EvtIntRe |
| 0660 | 6e 64 65 72 52 65 73 6f 75 72 63 65 45 76 65 6e 74 54 65 6d 70 6c 61 74 65 00 45 76 74 49 6e 74 | nderResourceEventTemplate.EvtInt |
| 0680 | 47 65 74 43 6c 61 73 73 69 63 4c 6f 67 44 69 73 70 6c 61 79 4e 61 6d 65 00 5f 5f 69 6d 70 5f 45 | GetClassicLogDisplayName.__imp_E |
| 06a0 | 76 74 49 6e 74 47 65 74 43 6c 61 73 73 69 63 4c 6f 67 44 69 73 70 6c 61 79 4e 61 6d 65 00 45 76 | vtIntGetClassicLogDisplayName.Ev |
| 06c0 | 74 49 6e 74 43 72 65 61 74 65 4c 6f 63 61 6c 4c 6f 67 66 69 6c 65 00 5f 5f 69 6d 70 5f 45 76 74 | tIntCreateLocalLogfile.__imp_Evt |
| 06e0 | 49 6e 74 43 72 65 61 74 65 4c 6f 63 61 6c 4c 6f 67 66 69 6c 65 00 45 76 74 49 6e 74 43 72 65 61 | IntCreateLocalLogfile.EvtIntCrea |
| 0700 | 74 65 42 69 6e 58 4d 4c 46 72 6f 6d 43 75 73 74 6f 6d 58 4d 4c 00 5f 5f 69 6d 70 5f 45 76 74 49 | teBinXMLFromCustomXML.__imp_EvtI |
| 0720 | 6e 74 43 72 65 61 74 65 42 69 6e 58 4d 4c 46 72 6f 6d 43 75 73 74 6f 6d 58 4d 4c 00 45 76 74 49 | ntCreateBinXMLFromCustomXML.EvtI |
| 0740 | 6e 74 41 73 73 65 72 74 43 6f 6e 66 69 67 00 5f 5f 69 6d 70 5f 45 76 74 49 6e 74 41 73 73 65 72 | ntAssertConfig.__imp_EvtIntAsser |
| 0760 | 74 43 6f 6e 66 69 67 00 45 76 74 47 65 74 51 75 65 72 79 49 6e 66 6f 00 5f 5f 69 6d 70 5f 45 76 | tConfig.EvtGetQueryInfo.__imp_Ev |
| 0780 | 74 47 65 74 51 75 65 72 79 49 6e 66 6f 00 45 76 74 47 65 74 50 75 62 6c 69 73 68 65 72 4d 65 74 | tGetQueryInfo.EvtGetPublisherMet |
| 07a0 | 61 64 61 74 61 50 72 6f 70 65 72 74 79 00 5f 5f 69 6d 70 5f 45 76 74 47 65 74 50 75 62 6c 69 73 | adataProperty.__imp_EvtGetPublis |
| 07c0 | 68 65 72 4d 65 74 61 64 61 74 61 50 72 6f 70 65 72 74 79 00 45 76 74 47 65 74 4f 62 6a 65 63 74 | herMetadataProperty.EvtGetObject |
| 07e0 | 41 72 72 61 79 53 69 7a 65 00 5f 5f 69 6d 70 5f 45 76 74 47 65 74 4f 62 6a 65 63 74 41 72 72 61 | ArraySize.__imp_EvtGetObjectArra |
| 0800 | 79 53 69 7a 65 00 45 76 74 47 65 74 4f 62 6a 65 63 74 41 72 72 61 79 50 72 6f 70 65 72 74 79 00 | ySize.EvtGetObjectArrayProperty. |
| 0820 | 5f 5f 69 6d 70 5f 45 76 74 47 65 74 4f 62 6a 65 63 74 41 72 72 61 79 50 72 6f 70 65 72 74 79 00 | __imp_EvtGetObjectArrayProperty. |
| 0840 | 45 76 74 47 65 74 4c 6f 67 49 6e 66 6f 00 5f 5f 69 6d 70 5f 45 76 74 47 65 74 4c 6f 67 49 6e 66 | EvtGetLogInfo.__imp_EvtGetLogInf |
| 0860 | 6f 00 45 76 74 47 65 74 45 78 74 65 6e 64 65 64 53 74 61 74 75 73 00 5f 5f 69 6d 70 5f 45 76 74 | o.EvtGetExtendedStatus.__imp_Evt |
| 0880 | 47 65 74 45 78 74 65 6e 64 65 64 53 74 61 74 75 73 00 45 76 74 47 65 74 45 76 65 6e 74 4d 65 74 | GetExtendedStatus.EvtGetEventMet |
| 08a0 | 61 64 61 74 61 50 72 6f 70 65 72 74 79 00 5f 5f 69 6d 70 5f 45 76 74 47 65 74 45 76 65 6e 74 4d | adataProperty.__imp_EvtGetEventM |
| 08c0 | 65 74 61 64 61 74 61 50 72 6f 70 65 72 74 79 00 45 76 74 47 65 74 45 76 65 6e 74 49 6e 66 6f 00 | etadataProperty.EvtGetEventInfo. |
| 08e0 | 5f 5f 69 6d 70 5f 45 76 74 47 65 74 45 76 65 6e 74 49 6e 66 6f 00 45 76 74 47 65 74 43 68 61 6e | __imp_EvtGetEventInfo.EvtGetChan |
| 0900 | 6e 65 6c 43 6f 6e 66 69 67 50 72 6f 70 65 72 74 79 00 5f 5f 69 6d 70 5f 45 76 74 47 65 74 43 68 | nelConfigProperty.__imp_EvtGetCh |
| 0920 | 61 6e 6e 65 6c 43 6f 6e 66 69 67 50 72 6f 70 65 72 74 79 00 45 76 74 46 6f 72 6d 61 74 4d 65 73 | annelConfigProperty.EvtFormatMes |
| 0940 | 73 61 67 65 00 5f 5f 69 6d 70 5f 45 76 74 46 6f 72 6d 61 74 4d 65 73 73 61 67 65 00 45 76 74 45 | sage.__imp_EvtFormatMessage.EvtE |
| 0960 | 78 70 6f 72 74 4c 6f 67 00 5f 5f 69 6d 70 5f 45 76 74 45 78 70 6f 72 74 4c 6f 67 00 45 76 74 43 | xportLog.__imp_EvtExportLog.EvtC |
| 0980 | 72 65 61 74 65 52 65 6e 64 65 72 43 6f 6e 74 65 78 74 00 5f 5f 69 6d 70 5f 45 76 74 43 72 65 61 | reateRenderContext.__imp_EvtCrea |
| 09a0 | 74 65 52 65 6e 64 65 72 43 6f 6e 74 65 78 74 00 45 76 74 43 72 65 61 74 65 42 6f 6f 6b 6d 61 72 | teRenderContext.EvtCreateBookmar |
| 09c0 | 6b 00 5f 5f 69 6d 70 5f 45 76 74 43 72 65 61 74 65 42 6f 6f 6b 6d 61 72 6b 00 45 76 74 43 6c 6f | k.__imp_EvtCreateBookmark.EvtClo |
| 09e0 | 73 65 00 5f 5f 69 6d 70 5f 45 76 74 43 6c 6f 73 65 00 45 76 74 43 6c 65 61 72 4c 6f 67 00 5f 5f | se.__imp_EvtClose.EvtClearLog.__ |
| 0a00 | 69 6d 70 5f 45 76 74 43 6c 65 61 72 4c 6f 67 00 45 76 74 43 61 6e 63 65 6c 00 5f 5f 69 6d 70 5f | imp_EvtClearLog.EvtCancel.__imp_ |
| 0a20 | 45 76 74 43 61 6e 63 65 6c 00 45 76 74 41 72 63 68 69 76 65 45 78 70 6f 72 74 65 64 4c 6f 67 00 | EvtCancel.EvtArchiveExportedLog. |
| 0a40 | 5f 5f 69 6d 70 5f 45 76 74 41 72 63 68 69 76 65 45 78 70 6f 72 74 65 64 4c 6f 67 00 64 6f 6a 65 | __imp_EvtArchiveExportedLog.doje |
| 0a60 | 74 2e 6f 2f 20 20 20 20 20 20 20 20 31 35 31 36 31 36 30 37 36 39 20 20 30 20 20 20 20 20 30 20 | t.o/........1516160769..0.....0. |
| 0a80 | 20 20 20 20 31 30 30 36 36 36 20 20 36 33 39 20 20 20 20 20 20 20 60 0a 64 86 06 00 00 00 00 00 | ....100666..639.......`.d....... |
| 0aa0 | 20 01 00 00 0f 00 00 00 00 00 05 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | .............text............... |
| 0ac0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 50 60 2e 64 61 74 61 00 00 00 00 00 00 00 | ..................P`.data....... |
| 0ae0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 50 c0 2e 62 73 73 | ........................@.P..bss |
| 0b00 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................................ |
| 0b20 | 80 00 50 c0 2e 69 64 61 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 04 01 00 00 00 00 00 00 | ..P..idata$4.................... |
| 0b40 | 00 00 00 00 00 00 00 00 40 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 | ........@.0..idata$5............ |
| 0b60 | 0c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 | ................@.0..idata$7.... |
| 0b80 | 00 00 00 00 0c 00 00 00 14 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 00 00 00 00 | ........................@.0..... |
| 0ba0 | 00 00 00 00 00 00 00 00 00 00 00 00 77 65 76 74 61 70 69 2e 64 6c 6c 00 2e 66 69 6c 65 00 00 00 | ............wevtapi.dll..file... |
| 0bc0 | 00 00 00 00 fe ff 00 00 67 01 66 61 6b 65 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 | ........g.fake...............tex |
| 0be0 | 74 00 00 00 00 00 00 00 01 00 00 00 03 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | t............................... |
| 0c00 | 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | .data........................... |
| 0c20 | 00 00 00 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 01 00 00 00 00 00 00 00 00 00 00 | .....bss........................ |
| 0c40 | 00 00 00 00 00 00 00 00 2e 69 64 61 74 61 24 34 00 00 00 00 04 00 00 00 03 01 08 00 00 00 00 00 | .........idata$4................ |
| 0c60 | 00 00 00 00 00 00 00 00 00 00 00 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 01 08 00 | .............idata$5............ |
| 0c80 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 69 64 61 74 61 24 37 00 00 00 00 06 00 00 00 | .................idata$7........ |
| 0ca0 | 03 01 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 | ................................ |
| 0cc0 | 06 00 00 00 02 00 51 00 00 00 5f 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f | ......Q...__C__Users_Peter_Code_ |
| 0ce0 | 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 6e | winapi_rs_x86_64_lib_libwinapi_n |
| 0d00 | 61 6e 6f 73 72 76 5f 77 65 76 74 61 70 69 5f 61 5f 69 6e 61 6d 65 00 0a 64 6f 6a 65 68 2e 6f 2f | anosrv_wevtapi_a_iname..dojeh.o/ |
| 0d20 | 20 20 20 20 20 20 20 20 31 35 31 36 31 36 30 37 36 39 20 20 30 20 20 20 20 20 30 20 20 20 20 20 | ........1516160769..0.....0..... |
| 0d40 | 31 30 30 36 36 36 20 20 37 35 34 20 20 20 20 20 20 20 60 0a 64 86 06 00 00 00 00 00 36 01 00 00 | 100666..754.......`.d.......6... |
| 0d60 | 10 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | .........text................... |
| 0d80 | 00 00 00 00 00 00 00 00 00 00 00 00 20 00 50 60 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 00 00 | ..............P`.data........... |
| 0da0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 50 c0 2e 62 73 73 00 00 00 00 | ....................@.P..bss.... |
| 0dc0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 50 c0 | ..............................P. |
| 0de0 | 2e 69 64 61 74 61 24 32 00 00 00 00 00 00 00 00 14 00 00 00 04 01 00 00 18 01 00 00 00 00 00 00 | .idata$2........................ |
| 0e00 | 03 00 00 00 40 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ....@.0..idata$5................ |
| 0e20 | 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 00 00 00 00 | ............@.0..idata$4........ |
| 0e40 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 00 00 00 00 00 00 00 00 | ....................@.0......... |
| 0e60 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 00 00 00 03 00 0c 00 00 00 0f 00 00 00 03 00 | ................................ |
| 0e80 | 10 00 00 00 0d 00 00 00 03 00 2e 66 69 6c 65 00 00 00 00 00 00 00 fe ff 00 00 67 01 66 61 6b 65 | ...........file...........g.fake |
| 0ea0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 6e 61 6d 65 00 00 00 00 00 00 00 06 00 00 00 03 00 | ..............hname............. |
| 0ec0 | 66 74 68 75 6e 6b 00 00 00 00 00 00 05 00 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 | fthunk.............text......... |
| 0ee0 | 00 00 03 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 64 61 74 61 00 00 00 00 00 | .......................data..... |
| 0f00 | 00 00 02 00 00 00 03 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 62 73 73 00 00 | ...........................bss.. |
| 0f20 | 00 00 00 00 00 00 03 00 00 00 03 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 69 | ...............................i |
| 0f40 | 64 61 74 61 24 32 00 00 00 00 04 00 00 00 03 01 14 00 00 00 03 00 00 00 00 00 00 00 00 00 00 00 | data$2.......................... |
| 0f60 | 00 00 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 | ...idata$4...........idata$5.... |
| 0f80 | 05 00 00 00 03 00 00 00 00 00 04 00 00 00 00 00 00 00 04 00 00 00 02 00 00 00 00 00 4f 00 00 00 | ............................O... |
| 0fa0 | 00 00 00 00 00 00 00 00 02 00 9c 00 00 00 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 | .............._head_C__Users_Pet |
| 0fc0 | 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 | er_Code_winapi_rs_x86_64_lib_lib |
| 0fe0 | 77 69 6e 61 70 69 5f 6e 61 6e 6f 73 72 76 5f 77 65 76 74 61 70 69 5f 61 00 5f 5f 43 5f 5f 55 73 | winapi_nanosrv_wevtapi_a.__C__Us |
| 1000 | 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f | ers_Peter_Code_winapi_rs_x86_64_ |
| 1020 | 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 6e 61 6e 6f 73 72 76 5f 77 65 76 74 61 70 69 5f 61 5f | lib_libwinapi_nanosrv_wevtapi_a_ |
| 1040 | 69 6e 61 6d 65 00 64 6f 6a 65 73 30 30 30 34 33 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 37 36 39 | iname.dojes00043.o/...1516160769 |
| 1060 | 20 20 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 36 38 39 20 20 20 20 20 20 20 | ..0.....0.....100666..689....... |
| 1080 | 60 0a 64 86 07 00 00 00 00 00 84 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 | `.d....................text..... |
| 10a0 | 00 00 00 00 00 00 08 00 00 00 2c 01 00 00 5c 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 | ..........,...\.............0`.d |
| 10c0 | 61 74 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ata............................. |
| 10e0 | 00 00 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ..@.0..bss...................... |
| 1100 | 00 00 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 | ............0..idata$7.......... |
| 1120 | 00 00 34 01 00 00 66 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 | ..4...f.............0..idata$5.. |
| 1140 | 00 00 00 00 00 00 08 00 00 00 38 01 00 00 70 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 | ..........8...p.............0..i |
| 1160 | 64 61 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 7a 01 00 00 00 00 00 00 01 00 | data$4............@...z......... |
| 1180 | 00 00 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 14 00 00 00 48 01 00 00 00 00 | ....0..idata$6............H..... |
| 11a0 | 00 00 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 | ...............%................ |
| 11c0 | 00 00 00 00 00 00 00 00 00 00 2b 00 45 76 74 55 70 64 61 74 65 42 6f 6f 6b 6d 61 72 6b 00 02 00 | ..........+.EvtUpdateBookmark... |
| 11e0 | 00 00 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 | ................................ |
| 1200 | 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 | .......text..............data... |
| 1220 | 00 00 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 | ...........bss...............ida |
| 1240 | 74 61 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 | ta$7...........idata$5.......... |
| 1260 | 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 | .idata$4...........idata$6...... |
| 1280 | 00 00 03 00 00 00 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 16 00 00 00 00 00 | ................................ |
| 12a0 | 00 00 05 00 00 00 02 00 00 00 00 00 2e 00 00 00 00 00 00 00 00 00 00 00 02 00 79 00 00 00 45 76 | ..........................y...Ev |
| 12c0 | 74 55 70 64 61 74 65 42 6f 6f 6b 6d 61 72 6b 00 5f 5f 69 6d 70 5f 45 76 74 55 70 64 61 74 65 42 | tUpdateBookmark.__imp_EvtUpdateB |
| 12e0 | 6f 6f 6b 6d 61 72 6b 00 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 | ookmark._head_C__Users_Peter_Cod |
| 1300 | 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 | e_winapi_rs_x86_64_lib_libwinapi |
| 1320 | 5f 6e 61 6e 6f 73 72 76 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 6f 6a 65 73 30 30 30 34 32 2e 6f | _nanosrv_wevtapi_a..dojes00042.o |
| 1340 | 2f 20 20 20 31 35 31 36 31 36 30 37 36 39 20 20 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 | /...1516160769..0.....0.....1006 |
| 1360 | 36 36 20 20 36 37 35 20 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 80 01 00 00 0a 00 00 00 | 66..675.......`.d............... |
| 1380 | 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 2c 01 00 00 58 01 00 00 | .....text...............,...X... |
| 13a0 | 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ..........0`.data............... |
| 13c0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 | ................@.0..bss........ |
| 13e0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 | ..........................0..ida |
| 1400 | 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 62 01 00 00 00 00 00 00 01 00 00 00 | ta$7............4...b........... |
| 1420 | 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 38 01 00 00 6c 01 00 00 | ..0..idata$5............8...l... |
| 1440 | 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 | ..........0..idata$4............ |
| 1460 | 40 01 00 00 76 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 | @...v.............0..idata$6.... |
| 1480 | 00 00 00 00 10 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 | ........H....................%.. |
| 14a0 | 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2a 00 45 76 74 53 75 62 | ........................*.EvtSub |
| 14c0 | 73 63 72 69 62 65 00 00 02 00 00 00 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 | scribe.......................... |
| 14e0 | 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 | .................text........... |
| 1500 | 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 | ...data..............bss........ |
| 1520 | 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 | .......idata$7...........idata$5 |
| 1540 | 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 | ...........idata$4...........ida |
| 1560 | 74 61 24 36 00 00 00 00 07 00 00 00 03 00 00 00 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 | ta$6............................ |
| 1580 | 00 00 00 00 11 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 00 00 24 00 00 00 00 00 00 00 00 00 | ......................$......... |
| 15a0 | 00 00 02 00 6f 00 00 00 45 76 74 53 75 62 73 63 72 69 62 65 00 5f 5f 69 6d 70 5f 45 76 74 53 75 | ....o...EvtSubscribe.__imp_EvtSu |
| 15c0 | 62 73 63 72 69 62 65 00 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 | bscribe._head_C__Users_Peter_Cod |
| 15e0 | 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 | e_winapi_rs_x86_64_lib_libwinapi |
| 1600 | 5f 6e 61 6e 6f 73 72 76 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 6f 6a 65 73 30 30 30 34 31 2e 6f | _nanosrv_wevtapi_a..dojes00041.o |
| 1620 | 2f 20 20 20 31 35 31 36 31 36 30 37 36 39 20 20 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 | /...1516160769..0.....0.....1006 |
| 1640 | 36 36 20 20 37 32 31 20 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 90 01 00 00 0a 00 00 00 | 66..721.......`.d............... |
| 1660 | 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 2c 01 00 00 68 01 00 00 | .....text...............,...h... |
| 1680 | 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ..........0`.data............... |
| 16a0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 | ................@.0..bss........ |
| 16c0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 | ..........................0..ida |
| 16e0 | 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 72 01 00 00 00 00 00 00 01 00 00 00 | ta$7............4...r........... |
| 1700 | 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 38 01 00 00 7c 01 00 00 | ..0..idata$5............8...|... |
| 1720 | 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 | ..........0..idata$4............ |
| 1740 | 40 01 00 00 86 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 | @.................0..idata$6.... |
| 1760 | 00 00 00 00 1e 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 | ........H....................%.. |
| 1780 | 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 29 00 45 76 74 53 65 74 | ........................).EvtSet |
| 17a0 | 43 68 61 6e 6e 65 6c 43 6f 6e 66 69 67 50 72 6f 70 65 72 74 79 00 00 00 02 00 00 00 08 00 00 00 | ChannelConfigProperty........... |
| 17c0 | 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 | ................................ |
| 17e0 | 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 | .text..............data......... |
| 1800 | 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 | .....bss...............idata$7.. |
| 1820 | 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 | .........idata$5...........idata |
| 1840 | 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 00 00 | $4...........idata$6............ |
| 1860 | 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 20 00 00 00 00 00 00 00 05 00 00 00 | ................................ |
| 1880 | 02 00 00 00 00 00 42 00 00 00 00 00 00 00 00 00 00 00 02 00 8d 00 00 00 45 76 74 53 65 74 43 68 | ......B.................EvtSetCh |
| 18a0 | 61 6e 6e 65 6c 43 6f 6e 66 69 67 50 72 6f 70 65 72 74 79 00 5f 5f 69 6d 70 5f 45 76 74 53 65 74 | annelConfigProperty.__imp_EvtSet |
| 18c0 | 43 68 61 6e 6e 65 6c 43 6f 6e 66 69 67 50 72 6f 70 65 72 74 79 00 5f 68 65 61 64 5f 43 5f 5f 55 | ChannelConfigProperty._head_C__U |
| 18e0 | 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 | sers_Peter_Code_winapi_rs_x86_64 |
| 1900 | 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 6e 61 6e 6f 73 72 76 5f 77 65 76 74 61 70 69 5f 61 | _lib_libwinapi_nanosrv_wevtapi_a |
| 1920 | 00 0a 64 6f 6a 65 73 30 30 30 34 30 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 37 36 39 20 20 30 20 | ..dojes00040.o/...1516160769..0. |
| 1940 | 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 36 35 33 20 20 20 20 20 20 20 60 0a 64 86 | ....0.....100666..653.......`.d. |
| 1960 | 07 00 00 00 00 00 7c 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 | ......|............text......... |
| 1980 | 00 00 08 00 00 00 2c 01 00 00 54 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 | ......,...T.............0`.data. |
| 19a0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 | ..............................@. |
| 19c0 | 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | 0..bss.......................... |
| 19e0 | 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 | ........0..idata$7............4. |
| 1a00 | 00 00 5e 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 | ..^.............0..idata$5...... |
| 1a20 | 00 00 08 00 00 00 38 01 00 00 68 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 | ......8...h.............0..idata |
| 1a40 | 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 72 01 00 00 00 00 00 00 01 00 00 00 00 00 | $4............@...r............. |
| 1a60 | 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 0a 00 00 00 48 01 00 00 00 00 00 00 00 00 | 0..idata$6............H......... |
| 1a80 | 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ...........%.................... |
| 1aa0 | 00 00 00 00 00 00 28 00 45 76 74 53 65 65 6b 00 00 00 02 00 00 00 08 00 00 00 04 00 00 00 00 00 | ......(.EvtSeek................. |
| 1ac0 | 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 | ...........................text. |
| 1ae0 | 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 | .............data..............b |
| 1b00 | 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 00 00 | ss...............idata$7........ |
| 1b20 | 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 | ...idata$5...........idata$4.... |
| 1b40 | 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 45 76 74 53 65 65 6b 00 | .......idata$6..........EvtSeek. |
| 1b60 | 00 00 00 00 01 00 00 00 02 00 00 00 00 00 04 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 00 00 | ................................ |
| 1b80 | 12 00 00 00 00 00 00 00 00 00 00 00 02 00 5d 00 00 00 5f 5f 69 6d 70 5f 45 76 74 53 65 65 6b 00 | ..............]...__imp_EvtSeek. |
| 1ba0 | 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 | _head_C__Users_Peter_Code_winapi |
| 1bc0 | 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 6e 61 6e 6f 73 72 76 | _rs_x86_64_lib_libwinapi_nanosrv |
| 1be0 | 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 6f 6a 65 73 30 30 30 33 39 2e 6f 2f 20 20 20 31 35 31 36 | _wevtapi_a..dojes00039.o/...1516 |
| 1c00 | 31 36 30 37 36 39 20 20 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 36 39 39 20 | 160769..0.....0.....100666..699. |
| 1c20 | 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 88 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 | ......`.d....................tex |
| 1c40 | 74 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 2c 01 00 00 60 01 00 00 00 00 00 00 01 00 00 00 | t...............,...`........... |
| 1c60 | 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ..0`.data....................... |
| 1c80 | 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ........@.0..bss................ |
| 1ca0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 | ..................0..idata$7.... |
| 1cc0 | 00 00 00 00 04 00 00 00 34 01 00 00 6a 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 | ........4...j.............0..ida |
| 1ce0 | 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 38 01 00 00 74 01 00 00 00 00 00 00 01 00 00 00 | ta$5............8...t........... |
| 1d00 | 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 7e 01 00 00 | ..0..idata$4............@...~... |
| 1d20 | 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 18 00 00 00 | ..........0..idata$6............ |
| 1d40 | 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 | H....................%.......... |
| 1d60 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 27 00 45 76 74 53 61 76 65 43 68 61 6e 6e 65 6c | ................'.EvtSaveChannel |
| 1d80 | 43 6f 6e 66 69 67 00 00 02 00 00 00 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 | Config.......................... |
| 1da0 | 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 | .................text........... |
| 1dc0 | 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 | ...data..............bss........ |
| 1de0 | 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 | .......idata$7...........idata$5 |
| 1e00 | 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 | ...........idata$4...........ida |
| 1e20 | 74 61 24 36 00 00 00 00 07 00 00 00 03 00 00 00 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 | ta$6............................ |
| 1e40 | 00 00 00 00 19 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 00 00 34 00 00 00 00 00 00 00 00 00 | ......................4......... |
| 1e60 | 00 00 02 00 7f 00 00 00 45 76 74 53 61 76 65 43 68 61 6e 6e 65 6c 43 6f 6e 66 69 67 00 5f 5f 69 | ........EvtSaveChannelConfig.__i |
| 1e80 | 6d 70 5f 45 76 74 53 61 76 65 43 68 61 6e 6e 65 6c 43 6f 6e 66 69 67 00 5f 68 65 61 64 5f 43 5f | mp_EvtSaveChannelConfig._head_C_ |
| 1ea0 | 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f | _Users_Peter_Code_winapi_rs_x86_ |
| 1ec0 | 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 6e 61 6e 6f 73 72 76 5f 77 65 76 74 61 70 69 | 64_lib_libwinapi_nanosrv_wevtapi |
| 1ee0 | 5f 61 00 0a 64 6f 6a 65 73 30 30 30 33 38 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 37 36 39 20 20 | _a..dojes00038.o/...1516160769.. |
| 1f00 | 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 36 36 35 20 20 20 20 20 20 20 60 0a | 0.....0.....100666..665.......`. |
| 1f20 | 64 86 07 00 00 00 00 00 7c 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 | d.......|............text....... |
| 1f40 | 00 00 00 00 08 00 00 00 2c 01 00 00 54 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 | ........,...T.............0`.dat |
| 1f60 | 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | a............................... |
| 1f80 | 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | @.0..bss........................ |
| 1fa0 | 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 | ..........0..idata$7............ |
| 1fc0 | 34 01 00 00 5e 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 | 4...^.............0..idata$5.... |
| 1fe0 | 00 00 00 00 08 00 00 00 38 01 00 00 68 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 | ........8...h.............0..ida |
| 2000 | 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 72 01 00 00 00 00 00 00 01 00 00 00 | ta$4............@...r........... |
| 2020 | 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 0c 00 00 00 48 01 00 00 00 00 00 00 | ..0..idata$6............H....... |
| 2040 | 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 | .............%.................. |
| 2060 | 00 00 00 00 00 00 00 00 26 00 45 76 74 52 65 6e 64 65 72 00 02 00 00 00 08 00 00 00 04 00 00 00 | ........&.EvtRender............. |
| 2080 | 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 | .............................tex |
| 20a0 | 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 | t..............data............. |
| 20c0 | 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 | .bss...............idata$7...... |
| 20e0 | 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 | .....idata$5...........idata$4.. |
| 2100 | 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 00 00 00 00 04 00 | .........idata$6................ |
| 2120 | 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 0e 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 | ................................ |
| 2140 | 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 02 00 69 00 00 00 45 76 74 52 65 6e 64 65 72 00 5f 5f | ................i...EvtRender.__ |
| 2160 | 69 6d 70 5f 45 76 74 52 65 6e 64 65 72 00 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 | imp_EvtRender._head_C__Users_Pet |
| 2180 | 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 | er_Code_winapi_rs_x86_64_lib_lib |
| 21a0 | 77 69 6e 61 70 69 5f 6e 61 6e 6f 73 72 76 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 6f 6a 65 73 30 | winapi_nanosrv_wevtapi_a..dojes0 |
| 21c0 | 30 30 33 37 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 37 36 39 20 20 30 20 20 20 20 20 30 20 20 20 | 0037.o/...1516160769..0.....0... |
| 21e0 | 20 20 31 30 30 36 36 36 20 20 36 35 34 20 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 7c 01 | ..100666..654.......`.d.......|. |
| 2200 | 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 2c 01 | ...........text...............,. |
| 2220 | 00 00 54 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 | ..T.............0`.data......... |
| 2240 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 00 00 | ......................@.0..bss.. |
| 2260 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 | ................................ |
| 2280 | 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 5e 01 00 00 00 00 | 0..idata$7............4...^..... |
| 22a0 | 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 38 01 | ........0..idata$5............8. |
| 22c0 | 00 00 68 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 00 00 | ..h.............0..idata$4...... |
| 22e0 | 00 00 08 00 00 00 40 01 00 00 72 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 | ......@...r.............0..idata |
| 2300 | 24 36 00 00 00 00 00 00 00 00 0c 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | $6............H................. |
| 2320 | 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 25 00 | ...%..........................%. |
| 2340 | 45 76 74 51 75 65 72 79 00 00 02 00 00 00 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 | EvtQuery........................ |
| 2360 | 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 | ...................text......... |
| 2380 | 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 | .....data..............bss...... |
| 23a0 | 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 | .........idata$7...........idata |
| 23c0 | 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 | $5...........idata$4...........i |
| 23e0 | 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 45 76 74 51 75 65 72 79 00 00 00 00 01 00 00 00 | data$6..........EvtQuery........ |
| 2400 | 02 00 00 00 00 00 04 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 00 00 13 00 00 00 00 00 00 00 | ................................ |
| 2420 | 00 00 00 00 02 00 5e 00 00 00 5f 5f 69 6d 70 5f 45 76 74 51 75 65 72 79 00 5f 68 65 61 64 5f 43 | ......^...__imp_EvtQuery._head_C |
| 2440 | 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 | __Users_Peter_Code_winapi_rs_x86 |
| 2460 | 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 6e 61 6e 6f 73 72 76 5f 77 65 76 74 61 70 | _64_lib_libwinapi_nanosrv_wevtap |
| 2480 | 69 5f 61 00 64 6f 6a 65 73 30 30 30 33 36 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 37 36 39 20 20 | i_a.dojes00036.o/...1516160769.. |
| 24a0 | 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 36 38 33 20 20 20 20 20 20 20 60 0a | 0.....0.....100666..683.......`. |
| 24c0 | 64 86 07 00 00 00 00 00 84 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 | d....................text....... |
| 24e0 | 00 00 00 00 08 00 00 00 2c 01 00 00 5c 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 | ........,...\.............0`.dat |
| 2500 | 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | a............................... |
| 2520 | 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | @.0..bss........................ |
| 2540 | 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 | ..........0..idata$7............ |
| 2560 | 34 01 00 00 66 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 | 4...f.............0..idata$5.... |
| 2580 | 00 00 00 00 08 00 00 00 38 01 00 00 70 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 | ........8...p.............0..ida |
| 25a0 | 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 7a 01 00 00 00 00 00 00 01 00 00 00 | ta$4............@...z........... |
| 25c0 | 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 12 00 00 00 48 01 00 00 00 00 00 00 | ..0..idata$6............H....... |
| 25e0 | 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 | .............%.................. |
| 2600 | 00 00 00 00 00 00 00 00 24 00 45 76 74 4f 70 65 6e 53 65 73 73 69 6f 6e 00 00 00 00 02 00 00 00 | ........$.EvtOpenSession........ |
| 2620 | 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 | ................................ |
| 2640 | 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 | .....text..............data..... |
| 2660 | 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 | .........bss...............idata |
| 2680 | 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 | $7...........idata$5...........i |
| 26a0 | 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 | data$4...........idata$6........ |
| 26c0 | 03 00 00 00 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 13 00 00 00 00 00 00 00 | ................................ |
| 26e0 | 05 00 00 00 02 00 00 00 00 00 28 00 00 00 00 00 00 00 00 00 00 00 02 00 73 00 00 00 45 76 74 4f | ..........(.............s...EvtO |
| 2700 | 70 65 6e 53 65 73 73 69 6f 6e 00 5f 5f 69 6d 70 5f 45 76 74 4f 70 65 6e 53 65 73 73 69 6f 6e 00 | penSession.__imp_EvtOpenSession. |
| 2720 | 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 | _head_C__Users_Peter_Code_winapi |
| 2740 | 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 6e 61 6e 6f 73 72 76 | _rs_x86_64_lib_libwinapi_nanosrv |
| 2760 | 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 6f 6a 65 73 30 30 30 33 35 2e 6f 2f 20 20 20 31 35 31 36 | _wevtapi_a..dojes00035.o/...1516 |
| 2780 | 31 36 30 37 36 39 20 20 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 37 31 31 20 | 160769..0.....0.....100666..711. |
| 27a0 | 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 8c 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 | ......`.d....................tex |
| 27c0 | 74 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 2c 01 00 00 64 01 00 00 00 00 00 00 01 00 00 00 | t...............,...d........... |
| 27e0 | 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ..0`.data....................... |
| 2800 | 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ........@.0..bss................ |
| 2820 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 | ..................0..idata$7.... |
| 2840 | 00 00 00 00 04 00 00 00 34 01 00 00 6e 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 | ........4...n.............0..ida |
| 2860 | 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 38 01 00 00 78 01 00 00 00 00 00 00 01 00 00 00 | ta$5............8...x........... |
| 2880 | 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 82 01 00 00 | ..0..idata$4............@....... |
| 28a0 | 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 1c 00 00 00 | ..........0..idata$6............ |
| 28c0 | 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 | H....................%.......... |
| 28e0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 23 00 45 76 74 4f 70 65 6e 50 75 62 6c 69 73 68 | ................#.EvtOpenPublish |
| 2900 | 65 72 4d 65 74 61 64 61 74 61 00 00 02 00 00 00 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 | erMetadata...................... |
| 2920 | 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 | .....................text....... |
| 2940 | 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 | .......data..............bss.... |
| 2960 | 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 | ...........idata$7...........ida |
| 2980 | 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 | ta$5...........idata$4.......... |
| 29a0 | 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 00 00 00 00 04 00 00 00 00 00 00 00 01 00 | .idata$6........................ |
| 29c0 | 00 00 02 00 00 00 00 00 1d 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 00 00 3c 00 00 00 00 00 | ..........................<..... |
| 29e0 | 00 00 00 00 00 00 02 00 87 00 00 00 45 76 74 4f 70 65 6e 50 75 62 6c 69 73 68 65 72 4d 65 74 61 | ............EvtOpenPublisherMeta |
| 2a00 | 64 61 74 61 00 5f 5f 69 6d 70 5f 45 76 74 4f 70 65 6e 50 75 62 6c 69 73 68 65 72 4d 65 74 61 64 | data.__imp_EvtOpenPublisherMetad |
| 2a20 | 61 74 61 00 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 | ata._head_C__Users_Peter_Code_wi |
| 2a40 | 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 6e 61 6e | napi_rs_x86_64_lib_libwinapi_nan |
| 2a60 | 6f 73 72 76 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 6f 6a 65 73 30 30 30 33 34 2e 6f 2f 20 20 20 | osrv_wevtapi_a..dojes00034.o/... |
| 2a80 | 31 35 31 36 31 36 30 37 36 39 20 20 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 | 1516160769..0.....0.....100666.. |
| 2aa0 | 36 39 39 20 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 88 01 00 00 0a 00 00 00 00 00 04 00 | 699.......`.d................... |
| 2ac0 | 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 2c 01 00 00 60 01 00 00 00 00 00 00 | .text...............,...`....... |
| 2ae0 | 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ......0`.data................... |
| 2b00 | 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 | ............@.0..bss............ |
| 2b20 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 | ......................0..idata$7 |
| 2b40 | 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 6a 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 | ............4...j.............0. |
| 2b60 | 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 38 01 00 00 74 01 00 00 00 00 00 00 | .idata$5............8...t....... |
| 2b80 | 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 | ......0..idata$4............@... |
| 2ba0 | 7e 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 | ~.............0..idata$6........ |
| 2bc0 | 18 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 | ....H....................%...... |
| 2be0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 00 45 76 74 4f 70 65 6e 50 75 62 | ....................".EvtOpenPub |
| 2c00 | 6c 69 73 68 65 72 45 6e 75 6d 00 00 02 00 00 00 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 | lisherEnum...................... |
| 2c20 | 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 | .....................text....... |
| 2c40 | 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 | .......data..............bss.... |
| 2c60 | 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 | ...........idata$7...........ida |
| 2c80 | 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 | ta$5...........idata$4.......... |
| 2ca0 | 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 00 00 00 00 04 00 00 00 00 00 00 00 01 00 | .idata$6........................ |
| 2cc0 | 00 00 02 00 00 00 00 00 19 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 00 00 34 00 00 00 00 00 | ..........................4..... |
| 2ce0 | 00 00 00 00 00 00 02 00 7f 00 00 00 45 76 74 4f 70 65 6e 50 75 62 6c 69 73 68 65 72 45 6e 75 6d | ............EvtOpenPublisherEnum |
| 2d00 | 00 5f 5f 69 6d 70 5f 45 76 74 4f 70 65 6e 50 75 62 6c 69 73 68 65 72 45 6e 75 6d 00 5f 68 65 61 | .__imp_EvtOpenPublisherEnum._hea |
| 2d20 | 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f | d_C__Users_Peter_Code_winapi_rs_ |
| 2d40 | 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 6e 61 6e 6f 73 72 76 5f 77 65 76 | x86_64_lib_libwinapi_nanosrv_wev |
| 2d60 | 74 61 70 69 5f 61 00 0a 64 6f 6a 65 73 30 30 30 33 33 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 37 | tapi_a..dojes00033.o/...15161607 |
| 2d80 | 36 39 20 20 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 36 37 31 20 20 20 20 20 | 69..0.....0.....100666..671..... |
| 2da0 | 20 20 60 0a 64 86 07 00 00 00 00 00 80 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 | ..`.d....................text... |
| 2dc0 | 00 00 00 00 00 00 00 00 08 00 00 00 2c 01 00 00 58 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 | ............,...X.............0` |
| 2de0 | 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | .data........................... |
| 2e00 | 00 00 00 00 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ....@.0..bss.................... |
| 2e20 | 00 00 00 00 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 | ..............0..idata$7........ |
| 2e40 | 04 00 00 00 34 01 00 00 62 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 | ....4...b.............0..idata$5 |
| 2e60 | 00 00 00 00 00 00 00 00 08 00 00 00 38 01 00 00 6c 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 | ............8...l.............0. |
| 2e80 | 2e 69 64 61 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 76 01 00 00 00 00 00 00 | .idata$4............@...v....... |
| 2ea0 | 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 0e 00 00 00 48 01 00 00 | ......0..idata$6............H... |
| 2ec0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 | .................%.............. |
| 2ee0 | 00 00 00 00 00 00 00 00 00 00 00 00 21 00 45 76 74 4f 70 65 6e 4c 6f 67 00 00 00 00 02 00 00 00 | ............!.EvtOpenLog........ |
| 2f00 | 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 | ................................ |
| 2f20 | 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 | .....text..............data..... |
| 2f40 | 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 | .........bss...............idata |
| 2f60 | 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 | $7...........idata$5...........i |
| 2f80 | 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 | data$4...........idata$6........ |
| 2fa0 | 03 00 00 00 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 0f 00 00 00 00 00 00 00 | ................................ |
| 2fc0 | 05 00 00 00 02 00 00 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 02 00 6b 00 00 00 45 76 74 4f | ........................k...EvtO |
| 2fe0 | 70 65 6e 4c 6f 67 00 5f 5f 69 6d 70 5f 45 76 74 4f 70 65 6e 4c 6f 67 00 5f 68 65 61 64 5f 43 5f | penLog.__imp_EvtOpenLog._head_C_ |
| 3000 | 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f | _Users_Peter_Code_winapi_rs_x86_ |
| 3020 | 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 6e 61 6e 6f 73 72 76 5f 77 65 76 74 61 70 69 | 64_lib_libwinapi_nanosrv_wevtapi |
| 3040 | 5f 61 00 0a 64 6f 6a 65 73 30 30 30 33 32 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 37 36 39 20 20 | _a..dojes00032.o/...1516160769.. |
| 3060 | 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 37 31 31 20 20 20 20 20 20 20 60 0a | 0.....0.....100666..711.......`. |
| 3080 | 64 86 07 00 00 00 00 00 8c 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 | d....................text....... |
| 30a0 | 00 00 00 00 08 00 00 00 2c 01 00 00 64 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 | ........,...d.............0`.dat |
| 30c0 | 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | a............................... |
| 30e0 | 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | @.0..bss........................ |
| 3100 | 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 | ..........0..idata$7............ |
| 3120 | 34 01 00 00 6e 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 | 4...n.............0..idata$5.... |
| 3140 | 00 00 00 00 08 00 00 00 38 01 00 00 78 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 | ........8...x.............0..ida |
| 3160 | 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 82 01 00 00 00 00 00 00 01 00 00 00 | ta$4............@............... |
| 3180 | 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 1c 00 00 00 48 01 00 00 00 00 00 00 | ..0..idata$6............H....... |
| 31a0 | 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 | .............%.................. |
| 31c0 | 00 00 00 00 00 00 00 00 20 00 45 76 74 4f 70 65 6e 45 76 65 6e 74 4d 65 74 61 64 61 74 61 45 6e | ..........EvtOpenEventMetadataEn |
| 31e0 | 75 6d 00 00 02 00 00 00 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 | um.............................. |
| 3200 | 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 | .............text..............d |
| 3220 | 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 | ata..............bss............ |
| 3240 | 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 | ...idata$7...........idata$5.... |
| 3260 | 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 | .......idata$4...........idata$6 |
| 3280 | 00 00 00 00 07 00 00 00 03 00 00 00 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 | ................................ |
| 32a0 | 1d 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 02 00 | ..................<............. |
| 32c0 | 87 00 00 00 45 76 74 4f 70 65 6e 45 76 65 6e 74 4d 65 74 61 64 61 74 61 45 6e 75 6d 00 5f 5f 69 | ....EvtOpenEventMetadataEnum.__i |
| 32e0 | 6d 70 5f 45 76 74 4f 70 65 6e 45 76 65 6e 74 4d 65 74 61 64 61 74 61 45 6e 75 6d 00 5f 68 65 61 | mp_EvtOpenEventMetadataEnum._hea |
| 3300 | 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f | d_C__Users_Peter_Code_winapi_rs_ |
| 3320 | 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 6e 61 6e 6f 73 72 76 5f 77 65 76 | x86_64_lib_libwinapi_nanosrv_wev |
| 3340 | 74 61 70 69 5f 61 00 0a 64 6f 6a 65 73 30 30 30 33 31 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 37 | tapi_a..dojes00031.o/...15161607 |
| 3360 | 36 39 20 20 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 36 39 35 20 20 20 20 20 | 69..0.....0.....100666..695..... |
| 3380 | 20 20 60 0a 64 86 07 00 00 00 00 00 88 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 | ..`.d....................text... |
| 33a0 | 00 00 00 00 00 00 00 00 08 00 00 00 2c 01 00 00 60 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 | ............,...`.............0` |
| 33c0 | 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | .data........................... |
| 33e0 | 00 00 00 00 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ....@.0..bss.................... |
| 3400 | 00 00 00 00 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 | ..............0..idata$7........ |
| 3420 | 04 00 00 00 34 01 00 00 6a 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 | ....4...j.............0..idata$5 |
| 3440 | 00 00 00 00 00 00 00 00 08 00 00 00 38 01 00 00 74 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 | ............8...t.............0. |
| 3460 | 2e 69 64 61 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 7e 01 00 00 00 00 00 00 | .idata$4............@...~....... |
| 3480 | 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 16 00 00 00 48 01 00 00 | ......0..idata$6............H... |
| 34a0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 | .................%.............. |
| 34c0 | 00 00 00 00 00 00 00 00 00 00 00 00 1f 00 45 76 74 4f 70 65 6e 43 68 61 6e 6e 65 6c 45 6e 75 6d | ..............EvtOpenChannelEnum |
| 34e0 | 00 00 00 00 02 00 00 00 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 | ................................ |
| 3500 | 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 | .............text..............d |
| 3520 | 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 | ata..............bss............ |
| 3540 | 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 | ...idata$7...........idata$5.... |
| 3560 | 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 | .......idata$4...........idata$6 |
| 3580 | 00 00 00 00 07 00 00 00 03 00 00 00 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 | ................................ |
| 35a0 | 17 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 00 00 30 00 00 00 00 00 00 00 00 00 00 00 02 00 | ..................0............. |
| 35c0 | 7b 00 00 00 45 76 74 4f 70 65 6e 43 68 61 6e 6e 65 6c 45 6e 75 6d 00 5f 5f 69 6d 70 5f 45 76 74 | {...EvtOpenChannelEnum.__imp_Evt |
| 35e0 | 4f 70 65 6e 43 68 61 6e 6e 65 6c 45 6e 75 6d 00 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 | OpenChannelEnum._head_C__Users_P |
| 3600 | 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c | eter_Code_winapi_rs_x86_64_lib_l |
| 3620 | 69 62 77 69 6e 61 70 69 5f 6e 61 6e 6f 73 72 76 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 6f 6a 65 | ibwinapi_nanosrv_wevtapi_a..doje |
| 3640 | 73 30 30 30 33 30 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 37 36 39 20 20 30 20 20 20 20 20 30 20 | s00030.o/...1516160769..0.....0. |
| 3660 | 20 20 20 20 31 30 30 36 36 36 20 20 36 39 39 20 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 | ....100666..699.......`.d....... |
| 3680 | 88 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 | .............text............... |
| 36a0 | 2c 01 00 00 60 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 | ,...`.............0`.data....... |
| 36c0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 | ........................@.0..bss |
| 36e0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................................ |
| 3700 | 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 6a 01 00 00 | ..0..idata$7............4...j... |
| 3720 | 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 | ..........0..idata$5............ |
| 3740 | 38 01 00 00 74 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 | 8...t.............0..idata$4.... |
| 3760 | 00 00 00 00 08 00 00 00 40 01 00 00 7e 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 | ........@...~.............0..ida |
| 3780 | 74 61 24 36 00 00 00 00 00 00 00 00 18 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ta$6............H............... |
| 37a0 | 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | .....%.......................... |
| 37c0 | 1e 00 45 76 74 4f 70 65 6e 43 68 61 6e 6e 65 6c 43 6f 6e 66 69 67 00 00 02 00 00 00 08 00 00 00 | ..EvtOpenChannelConfig.......... |
| 37e0 | 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 | ................................ |
| 3800 | 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 | .text..............data......... |
| 3820 | 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 | .....bss...............idata$7.. |
| 3840 | 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 | .........idata$5...........idata |
| 3860 | 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 00 00 | $4...........idata$6............ |
| 3880 | 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 19 00 00 00 00 00 00 00 05 00 00 00 | ................................ |
| 38a0 | 02 00 00 00 00 00 34 00 00 00 00 00 00 00 00 00 00 00 02 00 7f 00 00 00 45 76 74 4f 70 65 6e 43 | ......4.................EvtOpenC |
| 38c0 | 68 61 6e 6e 65 6c 43 6f 6e 66 69 67 00 5f 5f 69 6d 70 5f 45 76 74 4f 70 65 6e 43 68 61 6e 6e 65 | hannelConfig.__imp_EvtOpenChanne |
| 38e0 | 6c 43 6f 6e 66 69 67 00 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 | lConfig._head_C__Users_Peter_Cod |
| 3900 | 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 | e_winapi_rs_x86_64_lib_libwinapi |
| 3920 | 5f 6e 61 6e 6f 73 72 76 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 6f 6a 65 73 30 30 30 32 39 2e 6f | _nanosrv_wevtapi_a..dojes00029.o |
| 3940 | 2f 20 20 20 31 35 31 36 31 36 30 37 36 39 20 20 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 | /...1516160769..0.....0.....1006 |
| 3960 | 36 36 20 20 36 39 35 20 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 88 01 00 00 0a 00 00 00 | 66..695.......`.d............... |
| 3980 | 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 2c 01 00 00 60 01 00 00 | .....text...............,...`... |
| 39a0 | 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ..........0`.data............... |
| 39c0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 | ................@.0..bss........ |
| 39e0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 | ..........................0..ida |
| 3a00 | 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 6a 01 00 00 00 00 00 00 01 00 00 00 | ta$7............4...j........... |
| 3a20 | 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 38 01 00 00 74 01 00 00 | ..0..idata$5............8...t... |
| 3a40 | 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 | ..........0..idata$4............ |
| 3a60 | 40 01 00 00 7e 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 | @...~.............0..idata$6.... |
| 3a80 | 00 00 00 00 16 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 | ........H....................%.. |
| 3aa0 | 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1d 00 45 76 74 4e 65 78 | ..........................EvtNex |
| 3ac0 | 74 50 75 62 6c 69 73 68 65 72 49 64 00 00 00 00 02 00 00 00 08 00 00 00 04 00 00 00 00 00 09 00 | tPublisherId.................... |
| 3ae0 | 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 | .........................text... |
| 3b00 | 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 73 73 | ...........data..............bss |
| 3b20 | 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 00 00 03 00 | ...............idata$7.......... |
| 3b40 | 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 | .idata$5...........idata$4...... |
| 3b60 | 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 00 00 00 00 04 00 00 00 00 00 | .....idata$6.................... |
| 3b80 | 00 00 01 00 00 00 02 00 00 00 00 00 17 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 00 00 30 00 | ..............................0. |
| 3ba0 | 00 00 00 00 00 00 00 00 00 00 02 00 7b 00 00 00 45 76 74 4e 65 78 74 50 75 62 6c 69 73 68 65 72 | ............{...EvtNextPublisher |
| 3bc0 | 49 64 00 5f 5f 69 6d 70 5f 45 76 74 4e 65 78 74 50 75 62 6c 69 73 68 65 72 49 64 00 5f 68 65 61 | Id.__imp_EvtNextPublisherId._hea |
| 3be0 | 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f | d_C__Users_Peter_Code_winapi_rs_ |
| 3c00 | 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 6e 61 6e 6f 73 72 76 5f 77 65 76 | x86_64_lib_libwinapi_nanosrv_wev |
| 3c20 | 74 61 70 69 5f 61 00 0a 64 6f 6a 65 73 30 30 30 32 38 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 37 | tapi_a..dojes00028.o/...15161607 |
| 3c40 | 36 39 20 20 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 36 39 39 20 20 20 20 20 | 69..0.....0.....100666..699..... |
| 3c60 | 20 20 60 0a 64 86 07 00 00 00 00 00 88 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 | ..`.d....................text... |
| 3c80 | 00 00 00 00 00 00 00 00 08 00 00 00 2c 01 00 00 60 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 | ............,...`.............0` |
| 3ca0 | 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | .data........................... |
| 3cc0 | 00 00 00 00 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ....@.0..bss.................... |
| 3ce0 | 00 00 00 00 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 | ..............0..idata$7........ |
| 3d00 | 04 00 00 00 34 01 00 00 6a 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 | ....4...j.............0..idata$5 |
| 3d20 | 00 00 00 00 00 00 00 00 08 00 00 00 38 01 00 00 74 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 | ............8...t.............0. |
| 3d40 | 2e 69 64 61 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 7e 01 00 00 00 00 00 00 | .idata$4............@...~....... |
| 3d60 | 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 18 00 00 00 48 01 00 00 | ......0..idata$6............H... |
| 3d80 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 | .................%.............. |
| 3da0 | 00 00 00 00 00 00 00 00 00 00 00 00 1c 00 45 76 74 4e 65 78 74 45 76 65 6e 74 4d 65 74 61 64 61 | ..............EvtNextEventMetada |
| 3dc0 | 74 61 00 00 02 00 00 00 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 | ta.............................. |
| 3de0 | 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 | .............text..............d |
| 3e00 | 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 | ata..............bss............ |
| 3e20 | 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 | ...idata$7...........idata$5.... |
| 3e40 | 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 | .......idata$4...........idata$6 |
| 3e60 | 00 00 00 00 07 00 00 00 03 00 00 00 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 | ................................ |
| 3e80 | 19 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 00 00 34 00 00 00 00 00 00 00 00 00 00 00 02 00 | ..................4............. |
| 3ea0 | 7f 00 00 00 45 76 74 4e 65 78 74 45 76 65 6e 74 4d 65 74 61 64 61 74 61 00 5f 5f 69 6d 70 5f 45 | ....EvtNextEventMetadata.__imp_E |
| 3ec0 | 76 74 4e 65 78 74 45 76 65 6e 74 4d 65 74 61 64 61 74 61 00 5f 68 65 61 64 5f 43 5f 5f 55 73 65 | vtNextEventMetadata._head_C__Use |
| 3ee0 | 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c | rs_Peter_Code_winapi_rs_x86_64_l |
| 3f00 | 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 6e 61 6e 6f 73 72 76 5f 77 65 76 74 61 70 69 5f 61 00 0a | ib_libwinapi_nanosrv_wevtapi_a.. |
| 3f20 | 64 6f 6a 65 73 30 30 30 32 37 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 37 36 39 20 20 30 20 20 20 | dojes00027.o/...1516160769..0... |
| 3f40 | 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 36 39 35 20 20 20 20 20 20 20 60 0a 64 86 07 00 | ..0.....100666..695.......`.d... |
| 3f60 | 00 00 00 00 88 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 | .................text........... |
| 3f80 | 08 00 00 00 2c 01 00 00 60 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 | ....,...`.............0`.data... |
| 3fa0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 | ............................@.0. |
| 3fc0 | 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | .bss............................ |
| 3fe0 | 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 | ......0..idata$7............4... |
| 4000 | 6a 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 | j.............0..idata$5........ |
| 4020 | 08 00 00 00 38 01 00 00 74 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 | ....8...t.............0..idata$4 |
| 4040 | 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 7e 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 | ............@...~.............0. |
| 4060 | 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 16 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 | .idata$6............H........... |
| 4080 | 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | .........%...................... |
| 40a0 | 00 00 00 00 1b 00 45 76 74 4e 65 78 74 43 68 61 6e 6e 65 6c 50 61 74 68 00 00 00 00 02 00 00 00 | ......EvtNextChannelPath........ |
| 40c0 | 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 | ................................ |
| 40e0 | 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 | .....text..............data..... |
| 4100 | 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 | .........bss...............idata |
| 4120 | 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 | $7...........idata$5...........i |
| 4140 | 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 | data$4...........idata$6........ |
| 4160 | 03 00 00 00 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 17 00 00 00 00 00 00 00 | ................................ |
| 4180 | 05 00 00 00 02 00 00 00 00 00 30 00 00 00 00 00 00 00 00 00 00 00 02 00 7b 00 00 00 45 76 74 4e | ..........0.............{...EvtN |
| 41a0 | 65 78 74 43 68 61 6e 6e 65 6c 50 61 74 68 00 5f 5f 69 6d 70 5f 45 76 74 4e 65 78 74 43 68 61 6e | extChannelPath.__imp_EvtNextChan |
| 41c0 | 6e 65 6c 50 61 74 68 00 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 | nelPath._head_C__Users_Peter_Cod |
| 41e0 | 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 | e_winapi_rs_x86_64_lib_libwinapi |
| 4200 | 5f 6e 61 6e 6f 73 72 76 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 6f 6a 65 73 30 30 30 32 36 2e 6f | _nanosrv_wevtapi_a..dojes00026.o |
| 4220 | 2f 20 20 20 31 35 31 36 31 36 30 37 36 39 20 20 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 | /...1516160769..0.....0.....1006 |
| 4240 | 36 36 20 20 36 35 33 20 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 7c 01 00 00 0a 00 00 00 | 66..653.......`.d.......|....... |
| 4260 | 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 2c 01 00 00 54 01 00 00 | .....text...............,...T... |
| 4280 | 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ..........0`.data............... |
| 42a0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 | ................@.0..bss........ |
| 42c0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 | ..........................0..ida |
| 42e0 | 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 5e 01 00 00 00 00 00 00 01 00 00 00 | ta$7............4...^........... |
| 4300 | 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 38 01 00 00 68 01 00 00 | ..0..idata$5............8...h... |
| 4320 | 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 | ..........0..idata$4............ |
| 4340 | 40 01 00 00 72 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 | @...r.............0..idata$6.... |
| 4360 | 00 00 00 00 0a 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 | ........H....................%.. |
| 4380 | 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 00 45 76 74 4e 65 78 | ..........................EvtNex |
| 43a0 | 74 00 00 00 02 00 00 00 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 | t............................... |
| 43c0 | 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 | .............text..............d |
| 43e0 | 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 | ata..............bss............ |
| 4400 | 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 | ...idata$7...........idata$5.... |
| 4420 | 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 | .......idata$4...........idata$6 |
| 4440 | 00 00 00 00 07 00 00 00 03 00 45 76 74 4e 65 78 74 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 | ..........EvtNext............... |
| 4460 | 04 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 00 00 12 00 00 00 00 00 00 00 00 00 00 00 02 00 | ................................ |
| 4480 | 5d 00 00 00 5f 5f 69 6d 70 5f 45 76 74 4e 65 78 74 00 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 | ]...__imp_EvtNext._head_C__Users |
| 44a0 | 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 | _Peter_Code_winapi_rs_x86_64_lib |
| 44c0 | 5f 6c 69 62 77 69 6e 61 70 69 5f 6e 61 6e 6f 73 72 76 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 6f | _libwinapi_nanosrv_wevtapi_a..do |
| 44e0 | 6a 65 73 30 30 30 32 35 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 37 36 39 20 20 30 20 20 20 20 20 | jes00025.o/...1516160769..0..... |
| 4500 | 30 20 20 20 20 20 31 30 30 36 36 36 20 20 37 33 37 20 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 | 0.....100666..737.......`.d..... |
| 4520 | 00 00 94 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 08 00 | ...............text............. |
| 4540 | 00 00 2c 01 00 00 6c 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 | ..,...l.............0`.data..... |
| 4560 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 | ..........................@.0..b |
| 4580 | 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ss.............................. |
| 45a0 | 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 76 01 | ....0..idata$7............4...v. |
| 45c0 | 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 08 00 | ............0..idata$5.......... |
| 45e0 | 00 00 38 01 00 00 80 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 | ..8.................0..idata$4.. |
| 4600 | 00 00 00 00 00 00 08 00 00 00 40 01 00 00 8a 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 | ..........@.................0..i |
| 4620 | 64 61 74 61 24 36 00 00 00 00 00 00 00 00 24 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 | data$6........$...H............. |
| 4640 | 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | .......%........................ |
| 4660 | 00 00 19 00 45 76 74 49 6e 74 57 72 69 74 65 58 6d 6c 45 76 65 6e 74 54 6f 4c 6f 63 61 6c 4c 6f | ....EvtIntWriteXmlEventToLocalLo |
| 4680 | 67 66 69 6c 65 00 02 00 00 00 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 | gfile........................... |
| 46a0 | 00 00 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 | ...............text............. |
| 46c0 | 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 | .data..............bss.......... |
| 46e0 | 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 | .....idata$7...........idata$5.. |
| 4700 | 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 | .........idata$4...........idata |
| 4720 | 24 36 00 00 00 00 07 00 00 00 03 00 00 00 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 | $6.............................. |
| 4740 | 00 00 26 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 00 00 4e 00 00 00 00 00 00 00 00 00 00 00 | ..&.................N........... |
| 4760 | 02 00 99 00 00 00 45 76 74 49 6e 74 57 72 69 74 65 58 6d 6c 45 76 65 6e 74 54 6f 4c 6f 63 61 6c | ......EvtIntWriteXmlEventToLocal |
| 4780 | 4c 6f 67 66 69 6c 65 00 5f 5f 69 6d 70 5f 45 76 74 49 6e 74 57 72 69 74 65 58 6d 6c 45 76 65 6e | Logfile.__imp_EvtIntWriteXmlEven |
| 47a0 | 74 54 6f 4c 6f 63 61 6c 4c 6f 67 66 69 6c 65 00 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 | tToLocalLogfile._head_C__Users_P |
| 47c0 | 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c | eter_Code_winapi_rs_x86_64_lib_l |
| 47e0 | 69 62 77 69 6e 61 70 69 5f 6e 61 6e 6f 73 72 76 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 6f 6a 65 | ibwinapi_nanosrv_wevtapi_a..doje |
| 4800 | 73 30 30 30 32 34 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 37 36 39 20 20 30 20 20 20 20 20 30 20 | s00024.o/...1516160769..0.....0. |
| 4820 | 20 20 20 20 31 30 30 36 36 36 20 20 36 39 37 20 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 | ....100666..697.......`.d....... |
| 4840 | 88 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 | .............text............... |
| 4860 | 2c 01 00 00 60 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 | ,...`.............0`.data....... |
| 4880 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 | ........................@.0..bss |
| 48a0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................................ |
| 48c0 | 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 6a 01 00 00 | ..0..idata$7............4...j... |
| 48e0 | 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 | ..........0..idata$5............ |
| 4900 | 38 01 00 00 74 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 | 8...t.............0..idata$4.... |
| 4920 | 00 00 00 00 08 00 00 00 40 01 00 00 7e 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 | ........@...~.............0..ida |
| 4940 | 74 61 24 36 00 00 00 00 00 00 00 00 16 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ta$6............H............... |
| 4960 | 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | .....%.......................... |
| 4980 | 18 00 45 76 74 49 6e 74 52 65 74 72 61 63 74 43 6f 6e 66 69 67 00 00 00 02 00 00 00 08 00 00 00 | ..EvtIntRetractConfig........... |
| 49a0 | 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 | ................................ |
| 49c0 | 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 | .text..............data......... |
| 49e0 | 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 | .....bss...............idata$7.. |
| 4a00 | 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 | .........idata$5...........idata |
| 4a20 | 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 00 00 | $4...........idata$6............ |
| 4a40 | 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 18 00 00 00 00 00 00 00 05 00 00 00 | ................................ |
| 4a60 | 02 00 00 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 02 00 7d 00 00 00 45 76 74 49 6e 74 52 65 | ......2.............}...EvtIntRe |
| 4a80 | 74 72 61 63 74 43 6f 6e 66 69 67 00 5f 5f 69 6d 70 5f 45 76 74 49 6e 74 52 65 74 72 61 63 74 43 | tractConfig.__imp_EvtIntRetractC |
| 4aa0 | 6f 6e 66 69 67 00 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f | onfig._head_C__Users_Peter_Code_ |
| 4ac0 | 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 6e | winapi_rs_x86_64_lib_libwinapi_n |
| 4ae0 | 61 6e 6f 73 72 76 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 6f 6a 65 73 30 30 30 32 33 2e 6f 2f 20 | anosrv_wevtapi_a..dojes00023.o/. |
| 4b00 | 20 20 31 35 31 36 31 36 30 37 36 39 20 20 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 | ..1516160769..0.....0.....100666 |
| 4b20 | 20 20 37 33 33 20 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 94 01 00 00 0a 00 00 00 00 00 | ..733.......`.d................. |
| 4b40 | 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 2c 01 00 00 6c 01 00 00 00 00 | ...text...............,...l..... |
| 4b60 | 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ........0`.data................. |
| 4b80 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 | ..............@.0..bss.......... |
| 4ba0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 | ........................0..idata |
| 4bc0 | 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 76 01 00 00 00 00 00 00 01 00 00 00 00 00 | $7............4...v............. |
| 4be0 | 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 38 01 00 00 80 01 00 00 00 00 | 0..idata$5............8......... |
| 4c00 | 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 | ........0..idata$4............@. |
| 4c20 | 00 00 8a 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 | ................0..idata$6...... |
| 4c40 | 00 00 22 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 | .."...H....................%.... |
| 4c60 | 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 17 00 45 76 74 49 6e 74 52 65 | ........................EvtIntRe |
| 4c80 | 70 6f 72 74 45 76 65 6e 74 41 6e 64 53 6f 75 72 63 65 41 73 79 6e 63 00 00 00 02 00 00 00 08 00 | portEventAndSourceAsync......... |
| 4ca0 | 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 | ................................ |
| 4cc0 | 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 | ...text..............data....... |
| 4ce0 | 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 | .......bss...............idata$7 |
| 4d00 | 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 | ...........idata$5...........ida |
| 4d20 | 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 | ta$4...........idata$6.......... |
| 4d40 | 00 00 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 24 00 00 00 00 00 00 00 05 00 | ......................$......... |
| 4d60 | 00 00 02 00 00 00 00 00 4a 00 00 00 00 00 00 00 00 00 00 00 02 00 95 00 00 00 45 76 74 49 6e 74 | ........J.................EvtInt |
| 4d80 | 52 65 70 6f 72 74 45 76 65 6e 74 41 6e 64 53 6f 75 72 63 65 41 73 79 6e 63 00 5f 5f 69 6d 70 5f | ReportEventAndSourceAsync.__imp_ |
| 4da0 | 45 76 74 49 6e 74 52 65 70 6f 72 74 45 76 65 6e 74 41 6e 64 53 6f 75 72 63 65 41 73 79 6e 63 00 | EvtIntReportEventAndSourceAsync. |
| 4dc0 | 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 | _head_C__Users_Peter_Code_winapi |
| 4de0 | 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 6e 61 6e 6f 73 72 76 | _rs_x86_64_lib_libwinapi_nanosrv |
| 4e00 | 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 6f 6a 65 73 30 30 30 32 32 2e 6f 2f 20 20 20 31 35 31 36 | _wevtapi_a..dojes00022.o/...1516 |
| 4e20 | 31 36 30 37 36 39 20 20 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 37 34 37 20 | 160769..0.....0.....100666..747. |
| 4e40 | 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 98 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 | ......`.d....................tex |
| 4e60 | 74 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 2c 01 00 00 70 01 00 00 00 00 00 00 01 00 00 00 | t...............,...p........... |
| 4e80 | 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ..0`.data....................... |
| 4ea0 | 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ........@.0..bss................ |
| 4ec0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 | ..................0..idata$7.... |
| 4ee0 | 00 00 00 00 04 00 00 00 34 01 00 00 7a 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 | ........4...z.............0..ida |
| 4f00 | 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 38 01 00 00 84 01 00 00 00 00 00 00 01 00 00 00 | ta$5............8............... |
| 4f20 | 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 8e 01 00 00 | ..0..idata$4............@....... |
| 4f40 | 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 28 00 00 00 | ..........0..idata$6........(... |
| 4f60 | 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 | H....................%.......... |
| 4f80 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 16 00 45 76 74 49 6e 74 52 65 70 6f 72 74 41 75 | ..................EvtIntReportAu |
| 4fa0 | 74 68 7a 45 76 65 6e 74 41 6e 64 53 6f 75 72 63 65 41 73 79 6e 63 00 00 02 00 00 00 08 00 00 00 | thzEventAndSourceAsync.......... |
| 4fc0 | 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 | ................................ |
| 4fe0 | 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 | .text..............data......... |
| 5000 | 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 | .....bss...............idata$7.. |
| 5020 | 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 | .........idata$5...........idata |
| 5040 | 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 00 00 | $4...........idata$6............ |
| 5060 | 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 29 00 00 00 00 00 00 00 05 00 00 00 | ....................)........... |
| 5080 | 02 00 00 00 00 00 54 00 00 00 00 00 00 00 00 00 00 00 02 00 9f 00 00 00 45 76 74 49 6e 74 52 65 | ......T.................EvtIntRe |
| 50a0 | 70 6f 72 74 41 75 74 68 7a 45 76 65 6e 74 41 6e 64 53 6f 75 72 63 65 41 73 79 6e 63 00 5f 5f 69 | portAuthzEventAndSourceAsync.__i |
| 50c0 | 6d 70 5f 45 76 74 49 6e 74 52 65 70 6f 72 74 41 75 74 68 7a 45 76 65 6e 74 41 6e 64 53 6f 75 72 | mp_EvtIntReportAuthzEventAndSour |
| 50e0 | 63 65 41 73 79 6e 63 00 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 | ceAsync._head_C__Users_Peter_Cod |
| 5100 | 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 | e_winapi_rs_x86_64_lib_libwinapi |
| 5120 | 5f 6e 61 6e 6f 73 72 76 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 6f 6a 65 73 30 30 30 32 31 2e 6f | _nanosrv_wevtapi_a..dojes00021.o |
| 5140 | 2f 20 20 20 31 35 31 36 31 36 30 37 36 39 20 20 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 | /...1516160769..0.....0.....1006 |
| 5160 | 36 36 20 20 37 33 37 20 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 94 01 00 00 0a 00 00 00 | 66..737.......`.d............... |
| 5180 | 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 2c 01 00 00 6c 01 00 00 | .....text...............,...l... |
| 51a0 | 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ..........0`.data............... |
| 51c0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 | ................@.0..bss........ |
| 51e0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 | ..........................0..ida |
| 5200 | 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 76 01 00 00 00 00 00 00 01 00 00 00 | ta$7............4...v........... |
| 5220 | 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 38 01 00 00 80 01 00 00 | ..0..idata$5............8....... |
| 5240 | 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 | ..........0..idata$4............ |
| 5260 | 40 01 00 00 8a 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 | @.................0..idata$6.... |
| 5280 | 00 00 00 00 24 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 | ....$...H....................%.. |
| 52a0 | 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 15 00 45 76 74 49 6e 74 | ..........................EvtInt |
| 52c0 | 52 65 6e 64 65 72 52 65 73 6f 75 72 63 65 45 76 65 6e 74 54 65 6d 70 6c 61 74 65 00 02 00 00 00 | RenderResourceEventTemplate..... |
| 52e0 | 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 | ................................ |
| 5300 | 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 | .....text..............data..... |
| 5320 | 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 | .........bss...............idata |
| 5340 | 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 | $7...........idata$5...........i |
| 5360 | 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 | data$4...........idata$6........ |
| 5380 | 03 00 00 00 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 26 00 00 00 00 00 00 00 | ........................&....... |
| 53a0 | 05 00 00 00 02 00 00 00 00 00 4e 00 00 00 00 00 00 00 00 00 00 00 02 00 99 00 00 00 45 76 74 49 | ..........N.................EvtI |
| 53c0 | 6e 74 52 65 6e 64 65 72 52 65 73 6f 75 72 63 65 45 76 65 6e 74 54 65 6d 70 6c 61 74 65 00 5f 5f | ntRenderResourceEventTemplate.__ |
| 53e0 | 69 6d 70 5f 45 76 74 49 6e 74 52 65 6e 64 65 72 52 65 73 6f 75 72 63 65 45 76 65 6e 74 54 65 6d | imp_EvtIntRenderResourceEventTem |
| 5400 | 70 6c 61 74 65 00 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f | plate._head_C__Users_Peter_Code_ |
| 5420 | 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 6e | winapi_rs_x86_64_lib_libwinapi_n |
| 5440 | 61 6e 6f 73 72 76 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 6f 6a 65 73 30 30 30 32 30 2e 6f 2f 20 | anosrv_wevtapi_a..dojes00020.o/. |
| 5460 | 20 20 31 35 31 36 31 36 30 37 36 39 20 20 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 | ..1516160769..0.....0.....100666 |
| 5480 | 20 20 37 33 31 20 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 94 01 00 00 0a 00 00 00 00 00 | ..731.......`.d................. |
| 54a0 | 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 2c 01 00 00 6c 01 00 00 00 00 | ...text...............,...l..... |
| 54c0 | 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ........0`.data................. |
| 54e0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 | ..............@.0..bss.......... |
| 5500 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 | ........................0..idata |
| 5520 | 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 76 01 00 00 00 00 00 00 01 00 00 00 00 00 | $7............4...v............. |
| 5540 | 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 38 01 00 00 80 01 00 00 00 00 | 0..idata$5............8......... |
| 5560 | 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 | ........0..idata$4............@. |
| 5580 | 00 00 8a 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 | ................0..idata$6...... |
| 55a0 | 00 00 22 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 | .."...H....................%.... |
| 55c0 | 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 14 00 45 76 74 49 6e 74 47 65 | ........................EvtIntGe |
| 55e0 | 74 43 6c 61 73 73 69 63 4c 6f 67 44 69 73 70 6c 61 79 4e 61 6d 65 00 00 00 00 02 00 00 00 08 00 | tClassicLogDisplayName.......... |
| 5600 | 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 | ................................ |
| 5620 | 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 | ...text..............data....... |
| 5640 | 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 | .......bss...............idata$7 |
| 5660 | 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 | ...........idata$5...........ida |
| 5680 | 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 | ta$4...........idata$6.......... |
| 56a0 | 00 00 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 23 00 00 00 00 00 00 00 05 00 | ......................#......... |
| 56c0 | 00 00 02 00 00 00 00 00 48 00 00 00 00 00 00 00 00 00 00 00 02 00 93 00 00 00 45 76 74 49 6e 74 | ........H.................EvtInt |
| 56e0 | 47 65 74 43 6c 61 73 73 69 63 4c 6f 67 44 69 73 70 6c 61 79 4e 61 6d 65 00 5f 5f 69 6d 70 5f 45 | GetClassicLogDisplayName.__imp_E |
| 5700 | 76 74 49 6e 74 47 65 74 43 6c 61 73 73 69 63 4c 6f 67 44 69 73 70 6c 61 79 4e 61 6d 65 00 5f 68 | vtIntGetClassicLogDisplayName._h |
| 5720 | 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 | ead_C__Users_Peter_Code_winapi_r |
| 5740 | 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 6e 61 6e 6f 73 72 76 5f 77 | s_x86_64_lib_libwinapi_nanosrv_w |
| 5760 | 65 76 74 61 70 69 5f 61 00 0a 64 6f 6a 65 73 30 30 30 31 39 2e 6f 2f 20 20 20 31 35 31 36 31 36 | evtapi_a..dojes00019.o/...151616 |
| 5780 | 30 37 36 39 20 20 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 37 31 31 20 20 20 | 0769..0.....0.....100666..711... |
| 57a0 | 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 8c 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 | ....`.d....................text. |
| 57c0 | 00 00 00 00 00 00 00 00 00 00 08 00 00 00 2c 01 00 00 64 01 00 00 00 00 00 00 01 00 00 00 20 00 | ..............,...d............. |
| 57e0 | 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | 0`.data......................... |
| 5800 | 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ......@.0..bss.................. |
| 5820 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 | ................0..idata$7...... |
| 5840 | 00 00 04 00 00 00 34 01 00 00 6e 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 | ......4...n.............0..idata |
| 5860 | 24 35 00 00 00 00 00 00 00 00 08 00 00 00 38 01 00 00 78 01 00 00 00 00 00 00 01 00 00 00 00 00 | $5............8...x............. |
| 5880 | 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 82 01 00 00 00 00 | 0..idata$4............@......... |
| 58a0 | 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 1c 00 00 00 48 01 | ........0..idata$6............H. |
| 58c0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 | ...................%............ |
| 58e0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 13 00 45 76 74 49 6e 74 43 72 65 61 74 65 4c 6f 63 61 | ................EvtIntCreateLoca |
| 5900 | 6c 4c 6f 67 66 69 6c 65 00 00 02 00 00 00 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 | lLogfile........................ |
| 5920 | 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 | ...................text......... |
| 5940 | 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 | .....data..............bss...... |
| 5960 | 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 | .........idata$7...........idata |
| 5980 | 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 | $5...........idata$4...........i |
| 59a0 | 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 00 00 00 00 04 00 00 00 00 00 00 00 01 00 00 00 | data$6.......................... |
| 59c0 | 02 00 00 00 00 00 1d 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 00 00 3c 00 00 00 00 00 00 00 | ........................<....... |
| 59e0 | 00 00 00 00 02 00 87 00 00 00 45 76 74 49 6e 74 43 72 65 61 74 65 4c 6f 63 61 6c 4c 6f 67 66 69 | ..........EvtIntCreateLocalLogfi |
| 5a00 | 6c 65 00 5f 5f 69 6d 70 5f 45 76 74 49 6e 74 43 72 65 61 74 65 4c 6f 63 61 6c 4c 6f 67 66 69 6c | le.__imp_EvtIntCreateLocalLogfil |
| 5a20 | 65 00 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 | e._head_C__Users_Peter_Code_wina |
| 5a40 | 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 6e 61 6e 6f 73 | pi_rs_x86_64_lib_libwinapi_nanos |
| 5a60 | 72 76 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 6f 6a 65 73 30 30 30 31 38 2e 6f 2f 20 20 20 31 35 | rv_wevtapi_a..dojes00018.o/...15 |
| 5a80 | 31 36 31 36 30 37 36 39 20 20 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 37 33 | 16160769..0.....0.....100666..73 |
| 5aa0 | 33 20 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 94 01 00 00 0a 00 00 00 00 00 04 00 2e 74 | 3.......`.d....................t |
| 5ac0 | 65 78 74 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 2c 01 00 00 6c 01 00 00 00 00 00 00 01 00 | ext...............,...l......... |
| 5ae0 | 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ....0`.data..................... |
| 5b00 | 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ..........@.0..bss.............. |
| 5b20 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 | ....................0..idata$7.. |
| 5b40 | 00 00 00 00 00 00 04 00 00 00 34 01 00 00 76 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 | ..........4...v.............0..i |
| 5b60 | 64 61 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 38 01 00 00 80 01 00 00 00 00 00 00 01 00 | data$5............8............. |
| 5b80 | 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 8a 01 | ....0..idata$4............@..... |
| 5ba0 | 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 22 00 | ............0..idata$6........". |
| 5bc0 | 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 | ..H....................%........ |
| 5be0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 12 00 45 76 74 49 6e 74 43 72 65 61 74 65 | ....................EvtIntCreate |
| 5c00 | 42 69 6e 58 4d 4c 46 72 6f 6d 43 75 73 74 6f 6d 58 4d 4c 00 00 00 02 00 00 00 08 00 00 00 04 00 | BinXMLFromCustomXML............. |
| 5c20 | 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 | ...............................t |
| 5c40 | 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 00 00 | ext..............data........... |
| 5c60 | 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 | ...bss...............idata$7.... |
| 5c80 | 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 | .......idata$5...........idata$4 |
| 5ca0 | 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 00 00 00 00 | ...........idata$6.............. |
| 5cc0 | 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 24 00 00 00 00 00 00 00 05 00 00 00 02 00 | ..................$............. |
| 5ce0 | 00 00 00 00 4a 00 00 00 00 00 00 00 00 00 00 00 02 00 95 00 00 00 45 76 74 49 6e 74 43 72 65 61 | ....J.................EvtIntCrea |
| 5d00 | 74 65 42 69 6e 58 4d 4c 46 72 6f 6d 43 75 73 74 6f 6d 58 4d 4c 00 5f 5f 69 6d 70 5f 45 76 74 49 | teBinXMLFromCustomXML.__imp_EvtI |
| 5d20 | 6e 74 43 72 65 61 74 65 42 69 6e 58 4d 4c 46 72 6f 6d 43 75 73 74 6f 6d 58 4d 4c 00 5f 68 65 61 | ntCreateBinXMLFromCustomXML._hea |
| 5d40 | 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f | d_C__Users_Peter_Code_winapi_rs_ |
| 5d60 | 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 6e 61 6e 6f 73 72 76 5f 77 65 76 | x86_64_lib_libwinapi_nanosrv_wev |
| 5d80 | 74 61 70 69 5f 61 00 0a 64 6f 6a 65 73 30 30 30 31 37 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 37 | tapi_a..dojes00017.o/...15161607 |
| 5da0 | 36 39 20 20 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 36 39 35 20 20 20 20 20 | 69..0.....0.....100666..695..... |
| 5dc0 | 20 20 60 0a 64 86 07 00 00 00 00 00 88 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 | ..`.d....................text... |
| 5de0 | 00 00 00 00 00 00 00 00 08 00 00 00 2c 01 00 00 60 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 | ............,...`.............0` |
| 5e00 | 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | .data........................... |
| 5e20 | 00 00 00 00 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ....@.0..bss.................... |
| 5e40 | 00 00 00 00 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 | ..............0..idata$7........ |
| 5e60 | 04 00 00 00 34 01 00 00 6a 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 | ....4...j.............0..idata$5 |
| 5e80 | 00 00 00 00 00 00 00 00 08 00 00 00 38 01 00 00 74 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 | ............8...t.............0. |
| 5ea0 | 2e 69 64 61 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 7e 01 00 00 00 00 00 00 | .idata$4............@...~....... |
| 5ec0 | 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 16 00 00 00 48 01 00 00 | ......0..idata$6............H... |
| 5ee0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 | .................%.............. |
| 5f00 | 00 00 00 00 00 00 00 00 00 00 00 00 11 00 45 76 74 49 6e 74 41 73 73 65 72 74 43 6f 6e 66 69 67 | ..............EvtIntAssertConfig |
| 5f20 | 00 00 00 00 02 00 00 00 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 | ................................ |
| 5f40 | 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 | .............text..............d |
| 5f60 | 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 | ata..............bss............ |
| 5f80 | 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 | ...idata$7...........idata$5.... |
| 5fa0 | 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 | .......idata$4...........idata$6 |
| 5fc0 | 00 00 00 00 07 00 00 00 03 00 00 00 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 | ................................ |
| 5fe0 | 17 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 00 00 30 00 00 00 00 00 00 00 00 00 00 00 02 00 | ..................0............. |
| 6000 | 7b 00 00 00 45 76 74 49 6e 74 41 73 73 65 72 74 43 6f 6e 66 69 67 00 5f 5f 69 6d 70 5f 45 76 74 | {...EvtIntAssertConfig.__imp_Evt |
| 6020 | 49 6e 74 41 73 73 65 72 74 43 6f 6e 66 69 67 00 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 | IntAssertConfig._head_C__Users_P |
| 6040 | 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c | eter_Code_winapi_rs_x86_64_lib_l |
| 6060 | 69 62 77 69 6e 61 70 69 5f 6e 61 6e 6f 73 72 76 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 6f 6a 65 | ibwinapi_nanosrv_wevtapi_a..doje |
| 6080 | 73 30 30 30 31 36 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 37 36 39 20 20 30 20 20 20 20 20 30 20 | s00016.o/...1516160769..0.....0. |
| 60a0 | 20 20 20 20 31 30 30 36 36 36 20 20 36 38 35 20 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 | ....100666..685.......`.d....... |
| 60c0 | 84 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 | .............text............... |
| 60e0 | 2c 01 00 00 5c 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 | ,...\.............0`.data....... |
| 6100 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 | ........................@.0..bss |
| 6120 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................................ |
| 6140 | 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 66 01 00 00 | ..0..idata$7............4...f... |
| 6160 | 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 | ..........0..idata$5............ |
| 6180 | 38 01 00 00 70 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 | 8...p.............0..idata$4.... |
| 61a0 | 00 00 00 00 08 00 00 00 40 01 00 00 7a 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 | ........@...z.............0..ida |
| 61c0 | 74 61 24 36 00 00 00 00 00 00 00 00 12 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ta$6............H............... |
| 61e0 | 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | .....%.......................... |
| 6200 | 10 00 45 76 74 47 65 74 51 75 65 72 79 49 6e 66 6f 00 00 00 02 00 00 00 08 00 00 00 04 00 00 00 | ..EvtGetQueryInfo............... |
| 6220 | 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 | .............................tex |
| 6240 | 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 | t..............data............. |
| 6260 | 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 | .bss...............idata$7...... |
| 6280 | 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 | .....idata$5...........idata$4.. |
| 62a0 | 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 00 00 00 00 04 00 | .........idata$6................ |
| 62c0 | 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 14 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 | ................................ |
| 62e0 | 00 00 2a 00 00 00 00 00 00 00 00 00 00 00 02 00 75 00 00 00 45 76 74 47 65 74 51 75 65 72 79 49 | ..*.............u...EvtGetQueryI |
| 6300 | 6e 66 6f 00 5f 5f 69 6d 70 5f 45 76 74 47 65 74 51 75 65 72 79 49 6e 66 6f 00 5f 68 65 61 64 5f | nfo.__imp_EvtGetQueryInfo._head_ |
| 6320 | 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 | C__Users_Peter_Code_winapi_rs_x8 |
| 6340 | 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 6e 61 6e 6f 73 72 76 5f 77 65 76 74 61 | 6_64_lib_libwinapi_nanosrv_wevta |
| 6360 | 70 69 5f 61 00 0a 64 6f 6a 65 73 30 30 30 31 35 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 37 36 39 | pi_a..dojes00015.o/...1516160769 |
| 6380 | 20 20 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 37 33 33 20 20 20 20 20 20 20 | ..0.....0.....100666..733....... |
| 63a0 | 60 0a 64 86 07 00 00 00 00 00 94 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 | `.d....................text..... |
| 63c0 | 00 00 00 00 00 00 08 00 00 00 2c 01 00 00 6c 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 | ..........,...l.............0`.d |
| 63e0 | 61 74 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ata............................. |
| 6400 | 00 00 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ..@.0..bss...................... |
| 6420 | 00 00 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 | ............0..idata$7.......... |
| 6440 | 00 00 34 01 00 00 76 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 | ..4...v.............0..idata$5.. |
| 6460 | 00 00 00 00 00 00 08 00 00 00 38 01 00 00 80 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 | ..........8.................0..i |
| 6480 | 64 61 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 8a 01 00 00 00 00 00 00 01 00 | data$4............@............. |
| 64a0 | 00 00 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 22 00 00 00 48 01 00 00 00 00 | ....0..idata$6........"...H..... |
| 64c0 | 00 00 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 | ...............%................ |
| 64e0 | 00 00 00 00 00 00 00 00 00 00 0f 00 45 76 74 47 65 74 50 75 62 6c 69 73 68 65 72 4d 65 74 61 64 | ............EvtGetPublisherMetad |
| 6500 | 61 74 61 50 72 6f 70 65 72 74 79 00 00 00 02 00 00 00 08 00 00 00 04 00 00 00 00 00 09 00 00 00 | ataProperty..................... |
| 6520 | 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 | .......................text..... |
| 6540 | 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 | .........data..............bss.. |
| 6560 | 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 | .............idata$7...........i |
| 6580 | 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 00 00 | data$5...........idata$4........ |
| 65a0 | 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 00 00 00 00 04 00 00 00 00 00 00 00 | ...idata$6...................... |
| 65c0 | 01 00 00 00 02 00 00 00 00 00 24 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 00 00 4a 00 00 00 | ..........$.................J... |
| 65e0 | 00 00 00 00 00 00 00 00 02 00 95 00 00 00 45 76 74 47 65 74 50 75 62 6c 69 73 68 65 72 4d 65 74 | ..............EvtGetPublisherMet |
| 6600 | 61 64 61 74 61 50 72 6f 70 65 72 74 79 00 5f 5f 69 6d 70 5f 45 76 74 47 65 74 50 75 62 6c 69 73 | adataProperty.__imp_EvtGetPublis |
| 6620 | 68 65 72 4d 65 74 61 64 61 74 61 50 72 6f 70 65 72 74 79 00 5f 68 65 61 64 5f 43 5f 5f 55 73 65 | herMetadataProperty._head_C__Use |
| 6640 | 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c | rs_Peter_Code_winapi_rs_x86_64_l |
| 6660 | 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 6e 61 6e 6f 73 72 76 5f 77 65 76 74 61 70 69 5f 61 00 0a | ib_libwinapi_nanosrv_wevtapi_a.. |
| 6680 | 64 6f 6a 65 73 30 30 30 31 34 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 37 36 39 20 20 30 20 20 20 | dojes00014.o/...1516160769..0... |
| 66a0 | 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 37 30 31 20 20 20 20 20 20 20 60 0a 64 86 07 00 | ..0.....100666..701.......`.d... |
| 66c0 | 00 00 00 00 88 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 | .................text........... |
| 66e0 | 08 00 00 00 2c 01 00 00 60 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 | ....,...`.............0`.data... |
| 6700 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 | ............................@.0. |
| 6720 | 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | .bss............................ |
| 6740 | 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 | ......0..idata$7............4... |
| 6760 | 6a 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 | j.............0..idata$5........ |
| 6780 | 08 00 00 00 38 01 00 00 74 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 | ....8...t.............0..idata$4 |
| 67a0 | 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 7e 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 | ............@...~.............0. |
| 67c0 | 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 18 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 | .idata$6............H........... |
| 67e0 | 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | .........%...................... |
| 6800 | 00 00 00 00 0e 00 45 76 74 47 65 74 4f 62 6a 65 63 74 41 72 72 61 79 53 69 7a 65 00 02 00 00 00 | ......EvtGetObjectArraySize..... |
| 6820 | 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 | ................................ |
| 6840 | 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 | .....text..............data..... |
| 6860 | 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 | .........bss...............idata |
| 6880 | 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 | $7...........idata$5...........i |
| 68a0 | 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 | data$4...........idata$6........ |
| 68c0 | 03 00 00 00 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 1a 00 00 00 00 00 00 00 | ................................ |
| 68e0 | 05 00 00 00 02 00 00 00 00 00 36 00 00 00 00 00 00 00 00 00 00 00 02 00 81 00 00 00 45 76 74 47 | ..........6.................EvtG |
| 6900 | 65 74 4f 62 6a 65 63 74 41 72 72 61 79 53 69 7a 65 00 5f 5f 69 6d 70 5f 45 76 74 47 65 74 4f 62 | etObjectArraySize.__imp_EvtGetOb |
| 6920 | 6a 65 63 74 41 72 72 61 79 53 69 7a 65 00 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 | jectArraySize._head_C__Users_Pet |
| 6940 | 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 | er_Code_winapi_rs_x86_64_lib_lib |
| 6960 | 77 69 6e 61 70 69 5f 6e 61 6e 6f 73 72 76 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 6f 6a 65 73 30 | winapi_nanosrv_wevtapi_a..dojes0 |
| 6980 | 30 30 31 33 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 37 36 39 20 20 30 20 20 20 20 20 30 20 20 20 | 0013.o/...1516160769..0.....0... |
| 69a0 | 20 20 31 30 30 36 36 36 20 20 37 31 33 20 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 8c 01 | ..100666..713.......`.d......... |
| 69c0 | 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 2c 01 | ...........text...............,. |
| 69e0 | 00 00 64 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 | ..d.............0`.data......... |
| 6a00 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 00 00 | ......................@.0..bss.. |
| 6a20 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 | ................................ |
| 6a40 | 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 6e 01 00 00 00 00 | 0..idata$7............4...n..... |
| 6a60 | 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 38 01 | ........0..idata$5............8. |
| 6a80 | 00 00 78 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 00 00 | ..x.............0..idata$4...... |
| 6aa0 | 00 00 08 00 00 00 40 01 00 00 82 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 | ......@.................0..idata |
| 6ac0 | 24 36 00 00 00 00 00 00 00 00 1c 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | $6............H................. |
| 6ae0 | 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0d 00 | ...%............................ |
| 6b00 | 45 76 74 47 65 74 4f 62 6a 65 63 74 41 72 72 61 79 50 72 6f 70 65 72 74 79 00 02 00 00 00 08 00 | EvtGetObjectArrayProperty....... |
| 6b20 | 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 | ................................ |
| 6b40 | 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 | ...text..............data....... |
| 6b60 | 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 | .......bss...............idata$7 |
| 6b80 | 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 | ...........idata$5...........ida |
| 6ba0 | 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 | ta$4...........idata$6.......... |
| 6bc0 | 00 00 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 1e 00 00 00 00 00 00 00 05 00 | ................................ |
| 6be0 | 00 00 02 00 00 00 00 00 3e 00 00 00 00 00 00 00 00 00 00 00 02 00 89 00 00 00 45 76 74 47 65 74 | ........>.................EvtGet |
| 6c00 | 4f 62 6a 65 63 74 41 72 72 61 79 50 72 6f 70 65 72 74 79 00 5f 5f 69 6d 70 5f 45 76 74 47 65 74 | ObjectArrayProperty.__imp_EvtGet |
| 6c20 | 4f 62 6a 65 63 74 41 72 72 61 79 50 72 6f 70 65 72 74 79 00 5f 68 65 61 64 5f 43 5f 5f 55 73 65 | ObjectArrayProperty._head_C__Use |
| 6c40 | 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c | rs_Peter_Code_winapi_rs_x86_64_l |
| 6c60 | 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 6e 61 6e 6f 73 72 76 5f 77 65 76 74 61 70 69 5f 61 00 0a | ib_libwinapi_nanosrv_wevtapi_a.. |
| 6c80 | 64 6f 6a 65 73 30 30 30 31 32 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 37 36 39 20 20 30 20 20 20 | dojes00012.o/...1516160769..0... |
| 6ca0 | 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 36 37 37 20 20 20 20 20 20 20 60 0a 64 86 07 00 | ..0.....100666..677.......`.d... |
| 6cc0 | 00 00 00 00 80 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 | .................text........... |
| 6ce0 | 08 00 00 00 2c 01 00 00 58 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 | ....,...X.............0`.data... |
| 6d00 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 | ............................@.0. |
| 6d20 | 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | .bss............................ |
| 6d40 | 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 | ......0..idata$7............4... |
| 6d60 | 62 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 | b.............0..idata$5........ |
| 6d80 | 08 00 00 00 38 01 00 00 6c 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 | ....8...l.............0..idata$4 |
| 6da0 | 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 76 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 | ............@...v.............0. |
| 6dc0 | 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 10 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 | .idata$6............H........... |
| 6de0 | 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | .........%...................... |
| 6e00 | 00 00 00 00 0c 00 45 76 74 47 65 74 4c 6f 67 49 6e 66 6f 00 02 00 00 00 08 00 00 00 04 00 00 00 | ......EvtGetLogInfo............. |
| 6e20 | 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 | .............................tex |
| 6e40 | 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 | t..............data............. |
| 6e60 | 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 | .bss...............idata$7...... |
| 6e80 | 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 | .....idata$5...........idata$4.. |
| 6ea0 | 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 00 00 00 00 04 00 | .........idata$6................ |
| 6ec0 | 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 12 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 | ................................ |
| 6ee0 | 00 00 26 00 00 00 00 00 00 00 00 00 00 00 02 00 71 00 00 00 45 76 74 47 65 74 4c 6f 67 49 6e 66 | ..&.............q...EvtGetLogInf |
| 6f00 | 6f 00 5f 5f 69 6d 70 5f 45 76 74 47 65 74 4c 6f 67 49 6e 66 6f 00 5f 68 65 61 64 5f 43 5f 5f 55 | o.__imp_EvtGetLogInfo._head_C__U |
| 6f20 | 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 | sers_Peter_Code_winapi_rs_x86_64 |
| 6f40 | 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 6e 61 6e 6f 73 72 76 5f 77 65 76 74 61 70 69 5f 61 | _lib_libwinapi_nanosrv_wevtapi_a |
| 6f60 | 00 0a 64 6f 6a 65 73 30 30 30 31 31 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 37 36 39 20 20 30 20 | ..dojes00011.o/...1516160769..0. |
| 6f80 | 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 36 39 39 20 20 20 20 20 20 20 60 0a 64 86 | ....0.....100666..699.......`.d. |
| 6fa0 | 07 00 00 00 00 00 88 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 | ...................text......... |
| 6fc0 | 00 00 08 00 00 00 2c 01 00 00 60 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 | ......,...`.............0`.data. |
| 6fe0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 | ..............................@. |
| 7000 | 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | 0..bss.......................... |
| 7020 | 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 | ........0..idata$7............4. |
| 7040 | 00 00 6a 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 | ..j.............0..idata$5...... |
| 7060 | 00 00 08 00 00 00 38 01 00 00 74 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 | ......8...t.............0..idata |
| 7080 | 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 7e 01 00 00 00 00 00 00 01 00 00 00 00 00 | $4............@...~............. |
| 70a0 | 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 18 00 00 00 48 01 00 00 00 00 00 00 00 00 | 0..idata$6............H......... |
| 70c0 | 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ...........%.................... |
| 70e0 | 00 00 00 00 00 00 0b 00 45 76 74 47 65 74 45 78 74 65 6e 64 65 64 53 74 61 74 75 73 00 00 02 00 | ........EvtGetExtendedStatus.... |
| 7100 | 00 00 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 | ................................ |
| 7120 | 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 | .......text..............data... |
| 7140 | 00 00 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 | ...........bss...............ida |
| 7160 | 74 61 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 | ta$7...........idata$5.......... |
| 7180 | 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 | .idata$4...........idata$6...... |
| 71a0 | 00 00 03 00 00 00 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 19 00 00 00 00 00 | ................................ |
| 71c0 | 00 00 05 00 00 00 02 00 00 00 00 00 34 00 00 00 00 00 00 00 00 00 00 00 02 00 7f 00 00 00 45 76 | ............4.................Ev |
| 71e0 | 74 47 65 74 45 78 74 65 6e 64 65 64 53 74 61 74 75 73 00 5f 5f 69 6d 70 5f 45 76 74 47 65 74 45 | tGetExtendedStatus.__imp_EvtGetE |
| 7200 | 78 74 65 6e 64 65 64 53 74 61 74 75 73 00 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 | xtendedStatus._head_C__Users_Pet |
| 7220 | 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 | er_Code_winapi_rs_x86_64_lib_lib |
| 7240 | 77 69 6e 61 70 69 5f 6e 61 6e 6f 73 72 76 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 6f 6a 65 73 30 | winapi_nanosrv_wevtapi_a..dojes0 |
| 7260 | 30 30 31 30 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 37 36 39 20 20 30 20 20 20 20 20 30 20 20 20 | 0010.o/...1516160769..0.....0... |
| 7280 | 20 20 31 30 30 36 36 36 20 20 37 32 31 20 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 90 01 | ..100666..721.......`.d......... |
| 72a0 | 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 2c 01 | ...........text...............,. |
| 72c0 | 00 00 68 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 | ..h.............0`.data......... |
| 72e0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 00 00 | ......................@.0..bss.. |
| 7300 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 | ................................ |
| 7320 | 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 72 01 00 00 00 00 | 0..idata$7............4...r..... |
| 7340 | 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 38 01 | ........0..idata$5............8. |
| 7360 | 00 00 7c 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 00 00 | ..|.............0..idata$4...... |
| 7380 | 00 00 08 00 00 00 40 01 00 00 86 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 | ......@.................0..idata |
| 73a0 | 24 36 00 00 00 00 00 00 00 00 1e 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | $6............H................. |
| 73c0 | 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0a 00 | ...%............................ |
| 73e0 | 45 76 74 47 65 74 45 76 65 6e 74 4d 65 74 61 64 61 74 61 50 72 6f 70 65 72 74 79 00 00 00 02 00 | EvtGetEventMetadataProperty..... |
| 7400 | 00 00 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 | ................................ |
| 7420 | 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 | .......text..............data... |
| 7440 | 00 00 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 | ...........bss...............ida |
| 7460 | 74 61 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 | ta$7...........idata$5.......... |
| 7480 | 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 | .idata$4...........idata$6...... |
| 74a0 | 00 00 03 00 00 00 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 20 00 00 00 00 00 | ................................ |
| 74c0 | 00 00 05 00 00 00 02 00 00 00 00 00 42 00 00 00 00 00 00 00 00 00 00 00 02 00 8d 00 00 00 45 76 | ............B.................Ev |
| 74e0 | 74 47 65 74 45 76 65 6e 74 4d 65 74 61 64 61 74 61 50 72 6f 70 65 72 74 79 00 5f 5f 69 6d 70 5f | tGetEventMetadataProperty.__imp_ |
| 7500 | 45 76 74 47 65 74 45 76 65 6e 74 4d 65 74 61 64 61 74 61 50 72 6f 70 65 72 74 79 00 5f 68 65 61 | EvtGetEventMetadataProperty._hea |
| 7520 | 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f | d_C__Users_Peter_Code_winapi_rs_ |
| 7540 | 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 6e 61 6e 6f 73 72 76 5f 77 65 76 | x86_64_lib_libwinapi_nanosrv_wev |
| 7560 | 74 61 70 69 5f 61 00 0a 64 6f 6a 65 73 30 30 30 30 39 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 37 | tapi_a..dojes00009.o/...15161607 |
| 7580 | 36 39 20 20 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 36 38 35 20 20 20 20 20 | 69..0.....0.....100666..685..... |
| 75a0 | 20 20 60 0a 64 86 07 00 00 00 00 00 84 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 | ..`.d....................text... |
| 75c0 | 00 00 00 00 00 00 00 00 08 00 00 00 2c 01 00 00 5c 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 | ............,...\.............0` |
| 75e0 | 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | .data........................... |
| 7600 | 00 00 00 00 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ....@.0..bss.................... |
| 7620 | 00 00 00 00 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 | ..............0..idata$7........ |
| 7640 | 04 00 00 00 34 01 00 00 66 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 | ....4...f.............0..idata$5 |
| 7660 | 00 00 00 00 00 00 00 00 08 00 00 00 38 01 00 00 70 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 | ............8...p.............0. |
| 7680 | 2e 69 64 61 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 7a 01 00 00 00 00 00 00 | .idata$4............@...z....... |
| 76a0 | 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 12 00 00 00 48 01 00 00 | ......0..idata$6............H... |
| 76c0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 | .................%.............. |
| 76e0 | 00 00 00 00 00 00 00 00 00 00 00 00 09 00 45 76 74 47 65 74 45 76 65 6e 74 49 6e 66 6f 00 00 00 | ..............EvtGetEventInfo... |
| 7700 | 02 00 00 00 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 | ................................ |
| 7720 | 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 | .........text..............data. |
| 7740 | 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 | .............bss...............i |
| 7760 | 64 61 74 61 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 | data$7...........idata$5........ |
| 7780 | 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 | ...idata$4...........idata$6.... |
| 77a0 | 07 00 00 00 03 00 00 00 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 14 00 00 00 | ................................ |
| 77c0 | 00 00 00 00 05 00 00 00 02 00 00 00 00 00 2a 00 00 00 00 00 00 00 00 00 00 00 02 00 75 00 00 00 | ..............*.............u... |
| 77e0 | 45 76 74 47 65 74 45 76 65 6e 74 49 6e 66 6f 00 5f 5f 69 6d 70 5f 45 76 74 47 65 74 45 76 65 6e | EvtGetEventInfo.__imp_EvtGetEven |
| 7800 | 74 49 6e 66 6f 00 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f | tInfo._head_C__Users_Peter_Code_ |
| 7820 | 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 6e | winapi_rs_x86_64_lib_libwinapi_n |
| 7840 | 61 6e 6f 73 72 76 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 6f 6a 65 73 30 30 30 30 38 2e 6f 2f 20 | anosrv_wevtapi_a..dojes00008.o/. |
| 7860 | 20 20 31 35 31 36 31 36 30 37 36 39 20 20 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 | ..1516160769..0.....0.....100666 |
| 7880 | 20 20 37 32 31 20 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 90 01 00 00 0a 00 00 00 00 00 | ..721.......`.d................. |
| 78a0 | 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 2c 01 00 00 68 01 00 00 00 00 | ...text...............,...h..... |
| 78c0 | 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ........0`.data................. |
| 78e0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 | ..............@.0..bss.......... |
| 7900 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 | ........................0..idata |
| 7920 | 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 72 01 00 00 00 00 00 00 01 00 00 00 00 00 | $7............4...r............. |
| 7940 | 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 38 01 00 00 7c 01 00 00 00 00 | 0..idata$5............8...|..... |
| 7960 | 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 | ........0..idata$4............@. |
| 7980 | 00 00 86 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 | ................0..idata$6...... |
| 79a0 | 00 00 1e 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 | ......H....................%.... |
| 79c0 | 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 45 76 74 47 65 74 43 68 | ........................EvtGetCh |
| 79e0 | 61 6e 6e 65 6c 43 6f 6e 66 69 67 50 72 6f 70 65 72 74 79 00 00 00 02 00 00 00 08 00 00 00 04 00 | annelConfigProperty............. |
| 7a00 | 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 | ...............................t |
| 7a20 | 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 00 00 | ext..............data........... |
| 7a40 | 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 | ...bss...............idata$7.... |
| 7a60 | 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 | .......idata$5...........idata$4 |
| 7a80 | 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 00 00 00 00 | ...........idata$6.............. |
| 7aa0 | 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 20 00 00 00 00 00 00 00 05 00 00 00 02 00 | ................................ |
| 7ac0 | 00 00 00 00 42 00 00 00 00 00 00 00 00 00 00 00 02 00 8d 00 00 00 45 76 74 47 65 74 43 68 61 6e | ....B.................EvtGetChan |
| 7ae0 | 6e 65 6c 43 6f 6e 66 69 67 50 72 6f 70 65 72 74 79 00 5f 5f 69 6d 70 5f 45 76 74 47 65 74 43 68 | nelConfigProperty.__imp_EvtGetCh |
| 7b00 | 61 6e 6e 65 6c 43 6f 6e 66 69 67 50 72 6f 70 65 72 74 79 00 5f 68 65 61 64 5f 43 5f 5f 55 73 65 | annelConfigProperty._head_C__Use |
| 7b20 | 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c | rs_Peter_Code_winapi_rs_x86_64_l |
| 7b40 | 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 6e 61 6e 6f 73 72 76 5f 77 65 76 74 61 70 69 5f 61 00 0a | ib_libwinapi_nanosrv_wevtapi_a.. |
| 7b60 | 64 6f 6a 65 73 30 30 30 30 37 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 37 36 39 20 20 30 20 20 20 | dojes00007.o/...1516160769..0... |
| 7b80 | 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 36 38 37 20 20 20 20 20 20 20 60 0a 64 86 07 00 | ..0.....100666..687.......`.d... |
| 7ba0 | 00 00 00 00 84 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 | .................text........... |
| 7bc0 | 08 00 00 00 2c 01 00 00 5c 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 | ....,...\.............0`.data... |
| 7be0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 | ............................@.0. |
| 7c00 | 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | .bss............................ |
| 7c20 | 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 | ......0..idata$7............4... |
| 7c40 | 66 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 | f.............0..idata$5........ |
| 7c60 | 08 00 00 00 38 01 00 00 70 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 | ....8...p.............0..idata$4 |
| 7c80 | 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 7a 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 | ............@...z.............0. |
| 7ca0 | 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 14 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 | .idata$6............H........... |
| 7cc0 | 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | .........%...................... |
| 7ce0 | 00 00 00 00 07 00 45 76 74 46 6f 72 6d 61 74 4d 65 73 73 61 67 65 00 00 02 00 00 00 08 00 00 00 | ......EvtFormatMessage.......... |
| 7d00 | 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 | ................................ |
| 7d20 | 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 | .text..............data......... |
| 7d40 | 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 | .....bss...............idata$7.. |
| 7d60 | 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 | .........idata$5...........idata |
| 7d80 | 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 00 00 | $4...........idata$6............ |
| 7da0 | 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 15 00 00 00 00 00 00 00 05 00 00 00 | ................................ |
| 7dc0 | 02 00 00 00 00 00 2c 00 00 00 00 00 00 00 00 00 00 00 02 00 77 00 00 00 45 76 74 46 6f 72 6d 61 | ......,.............w...EvtForma |
| 7de0 | 74 4d 65 73 73 61 67 65 00 5f 5f 69 6d 70 5f 45 76 74 46 6f 72 6d 61 74 4d 65 73 73 61 67 65 00 | tMessage.__imp_EvtFormatMessage. |
| 7e00 | 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 | _head_C__Users_Peter_Code_winapi |
| 7e20 | 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 6e 61 6e 6f 73 72 76 | _rs_x86_64_lib_libwinapi_nanosrv |
| 7e40 | 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 6f 6a 65 73 30 30 30 30 36 2e 6f 2f 20 20 20 31 35 31 36 | _wevtapi_a..dojes00006.o/...1516 |
| 7e60 | 31 36 30 37 36 39 20 20 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 36 37 35 20 | 160769..0.....0.....100666..675. |
| 7e80 | 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 80 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 | ......`.d....................tex |
| 7ea0 | 74 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 2c 01 00 00 58 01 00 00 00 00 00 00 01 00 00 00 | t...............,...X........... |
| 7ec0 | 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ..0`.data....................... |
| 7ee0 | 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ........@.0..bss................ |
| 7f00 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 | ..................0..idata$7.... |
| 7f20 | 00 00 00 00 04 00 00 00 34 01 00 00 62 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 | ........4...b.............0..ida |
| 7f40 | 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 38 01 00 00 6c 01 00 00 00 00 00 00 01 00 00 00 | ta$5............8...l........... |
| 7f60 | 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 76 01 00 00 | ..0..idata$4............@...v... |
| 7f80 | 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 10 00 00 00 | ..........0..idata$6............ |
| 7fa0 | 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 | H....................%.......... |
| 7fc0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 06 00 45 76 74 45 78 70 6f 72 74 4c 6f 67 00 00 | ..................EvtExportLog.. |
| 7fe0 | 02 00 00 00 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 | ................................ |
| 8000 | 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 | .........text..............data. |
| 8020 | 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 | .............bss...............i |
| 8040 | 64 61 74 61 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 | data$7...........idata$5........ |
| 8060 | 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 | ...idata$4...........idata$6.... |
| 8080 | 07 00 00 00 03 00 00 00 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 11 00 00 00 | ................................ |
| 80a0 | 00 00 00 00 05 00 00 00 02 00 00 00 00 00 24 00 00 00 00 00 00 00 00 00 00 00 02 00 6f 00 00 00 | ..............$.............o... |
| 80c0 | 45 76 74 45 78 70 6f 72 74 4c 6f 67 00 5f 5f 69 6d 70 5f 45 76 74 45 78 70 6f 72 74 4c 6f 67 00 | EvtExportLog.__imp_EvtExportLog. |
| 80e0 | 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 | _head_C__Users_Peter_Code_winapi |
| 8100 | 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 6e 61 6e 6f 73 72 76 | _rs_x86_64_lib_libwinapi_nanosrv |
| 8120 | 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 6f 6a 65 73 30 30 30 30 35 2e 6f 2f 20 20 20 31 35 31 36 | _wevtapi_a..dojes00005.o/...1516 |
| 8140 | 31 36 30 37 36 39 20 20 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 37 30 37 20 | 160769..0.....0.....100666..707. |
| 8160 | 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 8c 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 | ......`.d....................tex |
| 8180 | 74 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 2c 01 00 00 64 01 00 00 00 00 00 00 01 00 00 00 | t...............,...d........... |
| 81a0 | 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ..0`.data....................... |
| 81c0 | 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ........@.0..bss................ |
| 81e0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 | ..................0..idata$7.... |
| 8200 | 00 00 00 00 04 00 00 00 34 01 00 00 6e 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 | ........4...n.............0..ida |
| 8220 | 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 38 01 00 00 78 01 00 00 00 00 00 00 01 00 00 00 | ta$5............8...x........... |
| 8240 | 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 82 01 00 00 | ..0..idata$4............@....... |
| 8260 | 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 1a 00 00 00 | ..........0..idata$6............ |
| 8280 | 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 | H....................%.......... |
| 82a0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 05 00 45 76 74 43 72 65 61 74 65 52 65 6e 64 65 | ..................EvtCreateRende |
| 82c0 | 72 43 6f 6e 74 65 78 74 00 00 00 00 02 00 00 00 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 | rContext........................ |
| 82e0 | 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 | .....................text....... |
| 8300 | 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 | .......data..............bss.... |
| 8320 | 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 | ...........idata$7...........ida |
| 8340 | 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 | ta$5...........idata$4.......... |
| 8360 | 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 00 00 00 00 04 00 00 00 00 00 00 00 01 00 | .idata$6........................ |
| 8380 | 00 00 02 00 00 00 00 00 1b 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 00 00 38 00 00 00 00 00 | ..........................8..... |
| 83a0 | 00 00 00 00 00 00 02 00 83 00 00 00 45 76 74 43 72 65 61 74 65 52 65 6e 64 65 72 43 6f 6e 74 65 | ............EvtCreateRenderConte |
| 83c0 | 78 74 00 5f 5f 69 6d 70 5f 45 76 74 43 72 65 61 74 65 52 65 6e 64 65 72 43 6f 6e 74 65 78 74 00 | xt.__imp_EvtCreateRenderContext. |
| 83e0 | 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 | _head_C__Users_Peter_Code_winapi |
| 8400 | 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 6e 61 6e 6f 73 72 76 | _rs_x86_64_lib_libwinapi_nanosrv |
| 8420 | 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 6f 6a 65 73 30 30 30 30 34 2e 6f 2f 20 20 20 31 35 31 36 | _wevtapi_a..dojes00004.o/...1516 |
| 8440 | 31 36 30 37 36 39 20 20 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 36 38 39 20 | 160769..0.....0.....100666..689. |
| 8460 | 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 84 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 | ......`.d....................tex |
| 8480 | 74 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 2c 01 00 00 5c 01 00 00 00 00 00 00 01 00 00 00 | t...............,...\........... |
| 84a0 | 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ..0`.data....................... |
| 84c0 | 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ........@.0..bss................ |
| 84e0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 | ..................0..idata$7.... |
| 8500 | 00 00 00 00 04 00 00 00 34 01 00 00 66 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 | ........4...f.............0..ida |
| 8520 | 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 38 01 00 00 70 01 00 00 00 00 00 00 01 00 00 00 | ta$5............8...p........... |
| 8540 | 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 7a 01 00 00 | ..0..idata$4............@...z... |
| 8560 | 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 14 00 00 00 | ..........0..idata$6............ |
| 8580 | 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 | H....................%.......... |
| 85a0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 45 76 74 43 72 65 61 74 65 42 6f 6f 6b 6d | ..................EvtCreateBookm |
| 85c0 | 61 72 6b 00 02 00 00 00 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 | ark............................. |
| 85e0 | 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 | .............text..............d |
| 8600 | 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 | ata..............bss............ |
| 8620 | 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 | ...idata$7...........idata$5.... |
| 8640 | 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 | .......idata$4...........idata$6 |
| 8660 | 00 00 00 00 07 00 00 00 03 00 00 00 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 | ................................ |
| 8680 | 16 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 00 00 2e 00 00 00 00 00 00 00 00 00 00 00 02 00 | ................................ |
| 86a0 | 79 00 00 00 45 76 74 43 72 65 61 74 65 42 6f 6f 6b 6d 61 72 6b 00 5f 5f 69 6d 70 5f 45 76 74 43 | y...EvtCreateBookmark.__imp_EvtC |
| 86c0 | 72 65 61 74 65 42 6f 6f 6b 6d 61 72 6b 00 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 | reateBookmark._head_C__Users_Pet |
| 86e0 | 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 | er_Code_winapi_rs_x86_64_lib_lib |
| 8700 | 77 69 6e 61 70 69 5f 6e 61 6e 6f 73 72 76 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 6f 6a 65 73 30 | winapi_nanosrv_wevtapi_a..dojes0 |
| 8720 | 30 30 30 33 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 37 36 39 20 20 30 20 20 20 20 20 30 20 20 20 | 0003.o/...1516160769..0.....0... |
| 8740 | 20 20 31 30 30 36 36 36 20 20 36 35 34 20 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 7c 01 | ..100666..654.......`.d.......|. |
| 8760 | 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 2c 01 | ...........text...............,. |
| 8780 | 00 00 54 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 | ..T.............0`.data......... |
| 87a0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 00 00 | ......................@.0..bss.. |
| 87c0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 | ................................ |
| 87e0 | 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 5e 01 00 00 00 00 | 0..idata$7............4...^..... |
| 8800 | 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 38 01 | ........0..idata$5............8. |
| 8820 | 00 00 68 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 00 00 | ..h.............0..idata$4...... |
| 8840 | 00 00 08 00 00 00 40 01 00 00 72 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 | ......@...r.............0..idata |
| 8860 | 24 36 00 00 00 00 00 00 00 00 0c 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | $6............H................. |
| 8880 | 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 00 | ...%............................ |
| 88a0 | 45 76 74 43 6c 6f 73 65 00 00 02 00 00 00 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 | EvtClose........................ |
| 88c0 | 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 | ...................text......... |
| 88e0 | 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 | .....data..............bss...... |
| 8900 | 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 | .........idata$7...........idata |
| 8920 | 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 | $5...........idata$4...........i |
| 8940 | 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 45 76 74 43 6c 6f 73 65 00 00 00 00 01 00 00 00 | data$6..........EvtClose........ |
| 8960 | 02 00 00 00 00 00 04 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 00 00 13 00 00 00 00 00 00 00 | ................................ |
| 8980 | 00 00 00 00 02 00 5e 00 00 00 5f 5f 69 6d 70 5f 45 76 74 43 6c 6f 73 65 00 5f 68 65 61 64 5f 43 | ......^...__imp_EvtClose._head_C |
| 89a0 | 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 | __Users_Peter_Code_winapi_rs_x86 |
| 89c0 | 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 6e 61 6e 6f 73 72 76 5f 77 65 76 74 61 70 | _64_lib_libwinapi_nanosrv_wevtap |
| 89e0 | 69 5f 61 00 64 6f 6a 65 73 30 30 30 30 32 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 37 36 39 20 20 | i_a.dojes00002.o/...1516160769.. |
| 8a00 | 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 36 37 33 20 20 20 20 20 20 20 60 0a | 0.....0.....100666..673.......`. |
| 8a20 | 64 86 07 00 00 00 00 00 80 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 | d....................text....... |
| 8a40 | 00 00 00 00 08 00 00 00 2c 01 00 00 58 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 | ........,...X.............0`.dat |
| 8a60 | 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | a............................... |
| 8a80 | 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | @.0..bss........................ |
| 8aa0 | 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 | ..........0..idata$7............ |
| 8ac0 | 34 01 00 00 62 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 | 4...b.............0..idata$5.... |
| 8ae0 | 00 00 00 00 08 00 00 00 38 01 00 00 6c 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 | ........8...l.............0..ida |
| 8b00 | 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 76 01 00 00 00 00 00 00 01 00 00 00 | ta$4............@...v........... |
| 8b20 | 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 0e 00 00 00 48 01 00 00 00 00 00 00 | ..0..idata$6............H....... |
| 8b40 | 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 | .............%.................. |
| 8b60 | 00 00 00 00 00 00 00 00 02 00 45 76 74 43 6c 65 61 72 4c 6f 67 00 00 00 02 00 00 00 08 00 00 00 | ..........EvtClearLog........... |
| 8b80 | 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 | ................................ |
| 8ba0 | 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 | .text..............data......... |
| 8bc0 | 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 | .....bss...............idata$7.. |
| 8be0 | 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 | .........idata$5...........idata |
| 8c00 | 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 00 00 | $4...........idata$6............ |
| 8c20 | 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 10 00 00 00 00 00 00 00 05 00 00 00 | ................................ |
| 8c40 | 02 00 00 00 00 00 22 00 00 00 00 00 00 00 00 00 00 00 02 00 6d 00 00 00 45 76 74 43 6c 65 61 72 | ......".............m...EvtClear |
| 8c60 | 4c 6f 67 00 5f 5f 69 6d 70 5f 45 76 74 43 6c 65 61 72 4c 6f 67 00 5f 68 65 61 64 5f 43 5f 5f 55 | Log.__imp_EvtClearLog._head_C__U |
| 8c80 | 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 | sers_Peter_Code_winapi_rs_x86_64 |
| 8ca0 | 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 6e 61 6e 6f 73 72 76 5f 77 65 76 74 61 70 69 5f 61 | _lib_libwinapi_nanosrv_wevtapi_a |
| 8cc0 | 00 0a 64 6f 6a 65 73 30 30 30 30 31 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 37 36 39 20 20 30 20 | ..dojes00001.o/...1516160769..0. |
| 8ce0 | 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 36 36 35 20 20 20 20 20 20 20 60 0a 64 86 | ....0.....100666..665.......`.d. |
| 8d00 | 07 00 00 00 00 00 7c 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 | ......|............text......... |
| 8d20 | 00 00 08 00 00 00 2c 01 00 00 54 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 | ......,...T.............0`.data. |
| 8d40 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 | ..............................@. |
| 8d60 | 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | 0..bss.......................... |
| 8d80 | 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 | ........0..idata$7............4. |
| 8da0 | 00 00 5e 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 | ..^.............0..idata$5...... |
| 8dc0 | 00 00 08 00 00 00 38 01 00 00 68 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 | ......8...h.............0..idata |
| 8de0 | 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 72 01 00 00 00 00 00 00 01 00 00 00 00 00 | $4............@...r............. |
| 8e00 | 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 0c 00 00 00 48 01 00 00 00 00 00 00 00 00 | 0..idata$6............H......... |
| 8e20 | 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ...........%.................... |
| 8e40 | 00 00 00 00 00 00 01 00 45 76 74 43 61 6e 63 65 6c 00 02 00 00 00 08 00 00 00 04 00 00 00 00 00 | ........EvtCancel............... |
| 8e60 | 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 | ...........................text. |
| 8e80 | 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 | .............data..............b |
| 8ea0 | 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 00 00 | ss...............idata$7........ |
| 8ec0 | 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 | ...idata$5...........idata$4.... |
| 8ee0 | 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 00 00 00 00 04 00 00 00 | .......idata$6.................. |
| 8f00 | 00 00 00 00 01 00 00 00 02 00 00 00 00 00 0e 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 00 00 | ................................ |
| 8f20 | 1e 00 00 00 00 00 00 00 00 00 00 00 02 00 69 00 00 00 45 76 74 43 61 6e 63 65 6c 00 5f 5f 69 6d | ..............i...EvtCancel.__im |
| 8f40 | 70 5f 45 76 74 43 61 6e 63 65 6c 00 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 | p_EvtCancel._head_C__Users_Peter |
| 8f60 | 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 | _Code_winapi_rs_x86_64_lib_libwi |
| 8f80 | 6e 61 70 69 5f 6e 61 6e 6f 73 72 76 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 6f 6a 65 73 30 30 30 | napi_nanosrv_wevtapi_a..dojes000 |
| 8fa0 | 30 30 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 37 36 39 20 20 30 20 20 20 20 20 30 20 20 20 20 20 | 00.o/...1516160769..0.....0..... |
| 8fc0 | 31 30 30 36 36 36 20 20 37 30 31 20 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 88 01 00 00 | 100666..701.......`.d........... |
| 8fe0 | 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 2c 01 00 00 | .........text...............,... |
| 9000 | 60 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 00 00 | `.............0`.data........... |
| 9020 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 00 00 00 00 | ....................@.0..bss.... |
| 9040 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 30 c0 | ..............................0. |
| 9060 | 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 6a 01 00 00 00 00 00 00 | .idata$7............4...j....... |
| 9080 | 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 38 01 00 00 | ......0..idata$5............8... |
| 90a0 | 74 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 00 00 00 00 | t.............0..idata$4........ |
| 90c0 | 08 00 00 00 40 01 00 00 7e 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 36 | ....@...~.............0..idata$6 |
| 90e0 | 00 00 00 00 00 00 00 00 18 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 c0 | ............H................... |
| 9100 | ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 45 76 | .%............................Ev |
| 9120 | 74 41 72 63 68 69 76 65 45 78 70 6f 72 74 65 64 4c 6f 67 00 02 00 00 00 08 00 00 00 04 00 00 00 | tArchiveExportedLog............. |
| 9140 | 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 | .............................tex |
| 9160 | 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 | t..............data............. |
| 9180 | 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 | .bss...............idata$7...... |
| 91a0 | 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 | .....idata$5...........idata$4.. |
| 91c0 | 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 00 00 00 00 04 00 | .........idata$6................ |
| 91e0 | 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 1a 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 | ................................ |
| 9200 | 00 00 36 00 00 00 00 00 00 00 00 00 00 00 02 00 81 00 00 00 45 76 74 41 72 63 68 69 76 65 45 78 | ..6.................EvtArchiveEx |
| 9220 | 70 6f 72 74 65 64 4c 6f 67 00 5f 5f 69 6d 70 5f 45 76 74 41 72 63 68 69 76 65 45 78 70 6f 72 74 | portedLog.__imp_EvtArchiveExport |
| 9240 | 65 64 4c 6f 67 00 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f | edLog._head_C__Users_Peter_Code_ |
| 9260 | 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 6e | winapi_rs_x86_64_lib_libwinapi_n |
| 9280 | 61 6e 6f 73 72 76 5f 77 65 76 74 61 70 69 5f 61 00 0a | anosrv_wevtapi_a.. |
 |
index : fparkan.git | |
| Utilities and tools for the game “Parkan: Iron Strategy”. | Valentin Popov |
| summaryrefslogtreecommitdiff |
blob: 04f8e436ea095df05d1666b060e83f1ab66ee136 (plain)