| ofs | hex dump | ascii |
|---|---|---|
| 0000 | 21 3c 61 72 63 68 3e 0a 2f 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 31 35 31 36 31 36 30 38 | !<arch>./...............15161608 |
| 0020 | 36 36 20 20 30 20 20 20 20 20 30 20 20 20 20 20 30 20 20 20 20 20 20 20 32 35 36 38 20 20 20 20 | 66..0.....0.....0.......2568.... |
| 0040 | 20 20 60 0a 00 00 00 5a 00 00 0a 4c 00 00 0d 00 00 00 10 1e 00 00 10 1e 00 00 13 04 00 00 13 04 | ..`....Z...L.................... |
| 0060 | 00 00 15 dc 00 00 15 dc 00 00 18 e2 00 00 18 e2 00 00 1b a4 00 00 1b a4 00 00 1e 94 00 00 1e 94 | ................................ |
| 0080 | 00 00 21 62 00 00 21 62 00 00 24 24 00 00 24 24 00 00 27 04 00 00 27 04 00 00 2a 00 00 00 2a 00 | ..!b..!b..$$..$$..'...'...*...*. |
| 00a0 | 00 00 2c f0 00 00 2c f0 00 00 2f c4 00 00 2f c4 00 00 32 c0 00 00 32 c0 00 00 35 ac 00 00 35 ac | ..,...,.../.../...2...2...5...5. |
| 00c0 | 00 00 38 9c 00 00 38 9c 00 00 3b 88 00 00 3b 88 00 00 3e 78 00 00 3e 78 00 00 41 64 00 00 41 64 | ..8...8...;...;...>x..>x..Ad..Ad |
| 00e0 | 00 00 44 26 00 00 44 26 00 00 47 3c 00 00 47 3c 00 00 4a 2a 00 00 4a 2a 00 00 4d 3c 00 00 4d 3c | ..D&..D&..G<..G<..J*..J*..M<..M< |
| 0100 | 00 00 50 5c 00 00 50 5c 00 00 53 72 00 00 53 72 00 00 56 82 00 00 56 82 00 00 59 7e 00 00 59 7e | ..P\..P\..Sr..Sr..V...V...Y~..Y~ |
| 0120 | 00 00 5c 90 00 00 5c 90 00 00 5f 7c 00 00 5f 7c 00 00 62 5e 00 00 62 5e 00 00 65 70 00 00 65 70 | ..\...\..._|.._|..b^..b^..ep..ep |
| 0140 | 00 00 68 62 00 00 68 62 00 00 6b 60 00 00 6b 60 00 00 6e 3a 00 00 6e 3a 00 00 71 2a 00 00 71 2a | ..hb..hb..k`..k`..n:..n:..q*..q* |
| 0160 | 00 00 74 30 00 00 74 30 00 00 77 12 00 00 77 12 00 00 7a 18 00 00 7a 18 00 00 7c fc 00 00 7c fc | ..t0..t0..w...w...z...z...|...|. |
| 0180 | 00 00 7f d4 00 00 7f d4 00 00 82 cc 00 00 82 cc 00 00 85 b2 00 00 85 b2 00 00 88 74 00 00 88 74 | ...........................t...t |
| 01a0 | 00 00 8b 4a 00 00 8b 4a 00 00 8e 18 00 00 8e 18 5f 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 | ...J...J........__C__Users_Peter |
| 01c0 | 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 | _Code_winapi_rs_x86_64_lib_libwi |
| 01e0 | 6e 61 70 69 5f 77 65 76 74 61 70 69 5f 61 5f 69 6e 61 6d 65 00 5f 68 65 61 64 5f 43 5f 5f 55 73 | napi_wevtapi_a_iname._head_C__Us |
| 0200 | 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f | ers_Peter_Code_winapi_rs_x86_64_ |
| 0220 | 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 65 76 74 61 70 69 5f 61 00 45 76 74 55 70 64 61 74 | lib_libwinapi_wevtapi_a.EvtUpdat |
| 0240 | 65 42 6f 6f 6b 6d 61 72 6b 00 5f 5f 69 6d 70 5f 45 76 74 55 70 64 61 74 65 42 6f 6f 6b 6d 61 72 | eBookmark.__imp_EvtUpdateBookmar |
| 0260 | 6b 00 45 76 74 53 75 62 73 63 72 69 62 65 00 5f 5f 69 6d 70 5f 45 76 74 53 75 62 73 63 72 69 62 | k.EvtSubscribe.__imp_EvtSubscrib |
| 0280 | 65 00 45 76 74 53 65 74 43 68 61 6e 6e 65 6c 43 6f 6e 66 69 67 50 72 6f 70 65 72 74 79 00 5f 5f | e.EvtSetChannelConfigProperty.__ |
| 02a0 | 69 6d 70 5f 45 76 74 53 65 74 43 68 61 6e 6e 65 6c 43 6f 6e 66 69 67 50 72 6f 70 65 72 74 79 00 | imp_EvtSetChannelConfigProperty. |
| 02c0 | 45 76 74 53 65 65 6b 00 5f 5f 69 6d 70 5f 45 76 74 53 65 65 6b 00 45 76 74 53 61 76 65 43 68 61 | EvtSeek.__imp_EvtSeek.EvtSaveCha |
| 02e0 | 6e 6e 65 6c 43 6f 6e 66 69 67 00 5f 5f 69 6d 70 5f 45 76 74 53 61 76 65 43 68 61 6e 6e 65 6c 43 | nnelConfig.__imp_EvtSaveChannelC |
| 0300 | 6f 6e 66 69 67 00 45 76 74 52 65 6e 64 65 72 00 5f 5f 69 6d 70 5f 45 76 74 52 65 6e 64 65 72 00 | onfig.EvtRender.__imp_EvtRender. |
| 0320 | 45 76 74 51 75 65 72 79 00 5f 5f 69 6d 70 5f 45 76 74 51 75 65 72 79 00 45 76 74 4f 70 65 6e 53 | EvtQuery.__imp_EvtQuery.EvtOpenS |
| 0340 | 65 73 73 69 6f 6e 00 5f 5f 69 6d 70 5f 45 76 74 4f 70 65 6e 53 65 73 73 69 6f 6e 00 45 76 74 4f | ession.__imp_EvtOpenSession.EvtO |
| 0360 | 70 65 6e 50 75 62 6c 69 73 68 65 72 4d 65 74 61 64 61 74 61 00 5f 5f 69 6d 70 5f 45 76 74 4f 70 | penPublisherMetadata.__imp_EvtOp |
| 0380 | 65 6e 50 75 62 6c 69 73 68 65 72 4d 65 74 61 64 61 74 61 00 45 76 74 4f 70 65 6e 50 75 62 6c 69 | enPublisherMetadata.EvtOpenPubli |
| 03a0 | 73 68 65 72 45 6e 75 6d 00 5f 5f 69 6d 70 5f 45 76 74 4f 70 65 6e 50 75 62 6c 69 73 68 65 72 45 | sherEnum.__imp_EvtOpenPublisherE |
| 03c0 | 6e 75 6d 00 45 76 74 4f 70 65 6e 4c 6f 67 00 5f 5f 69 6d 70 5f 45 76 74 4f 70 65 6e 4c 6f 67 00 | num.EvtOpenLog.__imp_EvtOpenLog. |
| 03e0 | 45 76 74 4f 70 65 6e 45 76 65 6e 74 4d 65 74 61 64 61 74 61 45 6e 75 6d 00 5f 5f 69 6d 70 5f 45 | EvtOpenEventMetadataEnum.__imp_E |
| 0400 | 76 74 4f 70 65 6e 45 76 65 6e 74 4d 65 74 61 64 61 74 61 45 6e 75 6d 00 45 76 74 4f 70 65 6e 43 | vtOpenEventMetadataEnum.EvtOpenC |
| 0420 | 68 61 6e 6e 65 6c 45 6e 75 6d 00 5f 5f 69 6d 70 5f 45 76 74 4f 70 65 6e 43 68 61 6e 6e 65 6c 45 | hannelEnum.__imp_EvtOpenChannelE |
| 0440 | 6e 75 6d 00 45 76 74 4f 70 65 6e 43 68 61 6e 6e 65 6c 43 6f 6e 66 69 67 00 5f 5f 69 6d 70 5f 45 | num.EvtOpenChannelConfig.__imp_E |
| 0460 | 76 74 4f 70 65 6e 43 68 61 6e 6e 65 6c 43 6f 6e 66 69 67 00 45 76 74 4e 65 78 74 50 75 62 6c 69 | vtOpenChannelConfig.EvtNextPubli |
| 0480 | 73 68 65 72 49 64 00 5f 5f 69 6d 70 5f 45 76 74 4e 65 78 74 50 75 62 6c 69 73 68 65 72 49 64 00 | sherId.__imp_EvtNextPublisherId. |
| 04a0 | 45 76 74 4e 65 78 74 45 76 65 6e 74 4d 65 74 61 64 61 74 61 00 5f 5f 69 6d 70 5f 45 76 74 4e 65 | EvtNextEventMetadata.__imp_EvtNe |
| 04c0 | 78 74 45 76 65 6e 74 4d 65 74 61 64 61 74 61 00 45 76 74 4e 65 78 74 43 68 61 6e 6e 65 6c 50 61 | xtEventMetadata.EvtNextChannelPa |
| 04e0 | 74 68 00 5f 5f 69 6d 70 5f 45 76 74 4e 65 78 74 43 68 61 6e 6e 65 6c 50 61 74 68 00 45 76 74 4e | th.__imp_EvtNextChannelPath.EvtN |
| 0500 | 65 78 74 00 5f 5f 69 6d 70 5f 45 76 74 4e 65 78 74 00 45 76 74 49 6e 74 57 72 69 74 65 58 6d 6c | ext.__imp_EvtNext.EvtIntWriteXml |
| 0520 | 45 76 65 6e 74 54 6f 4c 6f 63 61 6c 4c 6f 67 66 69 6c 65 00 5f 5f 69 6d 70 5f 45 76 74 49 6e 74 | EventToLocalLogfile.__imp_EvtInt |
| 0540 | 57 72 69 74 65 58 6d 6c 45 76 65 6e 74 54 6f 4c 6f 63 61 6c 4c 6f 67 66 69 6c 65 00 45 76 74 49 | WriteXmlEventToLocalLogfile.EvtI |
| 0560 | 6e 74 52 65 74 72 61 63 74 43 6f 6e 66 69 67 00 5f 5f 69 6d 70 5f 45 76 74 49 6e 74 52 65 74 72 | ntRetractConfig.__imp_EvtIntRetr |
| 0580 | 61 63 74 43 6f 6e 66 69 67 00 45 76 74 49 6e 74 52 65 70 6f 72 74 45 76 65 6e 74 41 6e 64 53 6f | actConfig.EvtIntReportEventAndSo |
| 05a0 | 75 72 63 65 41 73 79 6e 63 00 5f 5f 69 6d 70 5f 45 76 74 49 6e 74 52 65 70 6f 72 74 45 76 65 6e | urceAsync.__imp_EvtIntReportEven |
| 05c0 | 74 41 6e 64 53 6f 75 72 63 65 41 73 79 6e 63 00 45 76 74 49 6e 74 52 65 70 6f 72 74 41 75 74 68 | tAndSourceAsync.EvtIntReportAuth |
| 05e0 | 7a 45 76 65 6e 74 41 6e 64 53 6f 75 72 63 65 41 73 79 6e 63 00 5f 5f 69 6d 70 5f 45 76 74 49 6e | zEventAndSourceAsync.__imp_EvtIn |
| 0600 | 74 52 65 70 6f 72 74 41 75 74 68 7a 45 76 65 6e 74 41 6e 64 53 6f 75 72 63 65 41 73 79 6e 63 00 | tReportAuthzEventAndSourceAsync. |
| 0620 | 45 76 74 49 6e 74 52 65 6e 64 65 72 52 65 73 6f 75 72 63 65 45 76 65 6e 74 54 65 6d 70 6c 61 74 | EvtIntRenderResourceEventTemplat |
| 0640 | 65 00 5f 5f 69 6d 70 5f 45 76 74 49 6e 74 52 65 6e 64 65 72 52 65 73 6f 75 72 63 65 45 76 65 6e | e.__imp_EvtIntRenderResourceEven |
| 0660 | 74 54 65 6d 70 6c 61 74 65 00 45 76 74 49 6e 74 47 65 74 43 6c 61 73 73 69 63 4c 6f 67 44 69 73 | tTemplate.EvtIntGetClassicLogDis |
| 0680 | 70 6c 61 79 4e 61 6d 65 00 5f 5f 69 6d 70 5f 45 76 74 49 6e 74 47 65 74 43 6c 61 73 73 69 63 4c | playName.__imp_EvtIntGetClassicL |
| 06a0 | 6f 67 44 69 73 70 6c 61 79 4e 61 6d 65 00 45 76 74 49 6e 74 43 72 65 61 74 65 4c 6f 63 61 6c 4c | ogDisplayName.EvtIntCreateLocalL |
| 06c0 | 6f 67 66 69 6c 65 00 5f 5f 69 6d 70 5f 45 76 74 49 6e 74 43 72 65 61 74 65 4c 6f 63 61 6c 4c 6f | ogfile.__imp_EvtIntCreateLocalLo |
| 06e0 | 67 66 69 6c 65 00 45 76 74 49 6e 74 43 72 65 61 74 65 42 69 6e 58 4d 4c 46 72 6f 6d 43 75 73 74 | gfile.EvtIntCreateBinXMLFromCust |
| 0700 | 6f 6d 58 4d 4c 00 5f 5f 69 6d 70 5f 45 76 74 49 6e 74 43 72 65 61 74 65 42 69 6e 58 4d 4c 46 72 | omXML.__imp_EvtIntCreateBinXMLFr |
| 0720 | 6f 6d 43 75 73 74 6f 6d 58 4d 4c 00 45 76 74 49 6e 74 41 73 73 65 72 74 43 6f 6e 66 69 67 00 5f | omCustomXML.EvtIntAssertConfig._ |
| 0740 | 5f 69 6d 70 5f 45 76 74 49 6e 74 41 73 73 65 72 74 43 6f 6e 66 69 67 00 45 76 74 47 65 74 51 75 | _imp_EvtIntAssertConfig.EvtGetQu |
| 0760 | 65 72 79 49 6e 66 6f 00 5f 5f 69 6d 70 5f 45 76 74 47 65 74 51 75 65 72 79 49 6e 66 6f 00 45 76 | eryInfo.__imp_EvtGetQueryInfo.Ev |
| 0780 | 74 47 65 74 50 75 62 6c 69 73 68 65 72 4d 65 74 61 64 61 74 61 50 72 6f 70 65 72 74 79 00 5f 5f | tGetPublisherMetadataProperty.__ |
| 07a0 | 69 6d 70 5f 45 76 74 47 65 74 50 75 62 6c 69 73 68 65 72 4d 65 74 61 64 61 74 61 50 72 6f 70 65 | imp_EvtGetPublisherMetadataPrope |
| 07c0 | 72 74 79 00 45 76 74 47 65 74 4f 62 6a 65 63 74 41 72 72 61 79 53 69 7a 65 00 5f 5f 69 6d 70 5f | rty.EvtGetObjectArraySize.__imp_ |
| 07e0 | 45 76 74 47 65 74 4f 62 6a 65 63 74 41 72 72 61 79 53 69 7a 65 00 45 76 74 47 65 74 4f 62 6a 65 | EvtGetObjectArraySize.EvtGetObje |
| 0800 | 63 74 41 72 72 61 79 50 72 6f 70 65 72 74 79 00 5f 5f 69 6d 70 5f 45 76 74 47 65 74 4f 62 6a 65 | ctArrayProperty.__imp_EvtGetObje |
| 0820 | 63 74 41 72 72 61 79 50 72 6f 70 65 72 74 79 00 45 76 74 47 65 74 4c 6f 67 49 6e 66 6f 00 5f 5f | ctArrayProperty.EvtGetLogInfo.__ |
| 0840 | 69 6d 70 5f 45 76 74 47 65 74 4c 6f 67 49 6e 66 6f 00 45 76 74 47 65 74 45 78 74 65 6e 64 65 64 | imp_EvtGetLogInfo.EvtGetExtended |
| 0860 | 53 74 61 74 75 73 00 5f 5f 69 6d 70 5f 45 76 74 47 65 74 45 78 74 65 6e 64 65 64 53 74 61 74 75 | Status.__imp_EvtGetExtendedStatu |
| 0880 | 73 00 45 76 74 47 65 74 45 76 65 6e 74 4d 65 74 61 64 61 74 61 50 72 6f 70 65 72 74 79 00 5f 5f | s.EvtGetEventMetadataProperty.__ |
| 08a0 | 69 6d 70 5f 45 76 74 47 65 74 45 76 65 6e 74 4d 65 74 61 64 61 74 61 50 72 6f 70 65 72 74 79 00 | imp_EvtGetEventMetadataProperty. |
| 08c0 | 45 76 74 47 65 74 45 76 65 6e 74 49 6e 66 6f 00 5f 5f 69 6d 70 5f 45 76 74 47 65 74 45 76 65 6e | EvtGetEventInfo.__imp_EvtGetEven |
| 08e0 | 74 49 6e 66 6f 00 45 76 74 47 65 74 43 68 61 6e 6e 65 6c 43 6f 6e 66 69 67 50 72 6f 70 65 72 74 | tInfo.EvtGetChannelConfigPropert |
| 0900 | 79 00 5f 5f 69 6d 70 5f 45 76 74 47 65 74 43 68 61 6e 6e 65 6c 43 6f 6e 66 69 67 50 72 6f 70 65 | y.__imp_EvtGetChannelConfigPrope |
| 0920 | 72 74 79 00 45 76 74 46 6f 72 6d 61 74 4d 65 73 73 61 67 65 00 5f 5f 69 6d 70 5f 45 76 74 46 6f | rty.EvtFormatMessage.__imp_EvtFo |
| 0940 | 72 6d 61 74 4d 65 73 73 61 67 65 00 45 76 74 45 78 70 6f 72 74 4c 6f 67 00 5f 5f 69 6d 70 5f 45 | rmatMessage.EvtExportLog.__imp_E |
| 0960 | 76 74 45 78 70 6f 72 74 4c 6f 67 00 45 76 74 43 72 65 61 74 65 52 65 6e 64 65 72 43 6f 6e 74 65 | vtExportLog.EvtCreateRenderConte |
| 0980 | 78 74 00 5f 5f 69 6d 70 5f 45 76 74 43 72 65 61 74 65 52 65 6e 64 65 72 43 6f 6e 74 65 78 74 00 | xt.__imp_EvtCreateRenderContext. |
| 09a0 | 45 76 74 43 72 65 61 74 65 42 6f 6f 6b 6d 61 72 6b 00 5f 5f 69 6d 70 5f 45 76 74 43 72 65 61 74 | EvtCreateBookmark.__imp_EvtCreat |
| 09c0 | 65 42 6f 6f 6b 6d 61 72 6b 00 45 76 74 43 6c 6f 73 65 00 5f 5f 69 6d 70 5f 45 76 74 43 6c 6f 73 | eBookmark.EvtClose.__imp_EvtClos |
| 09e0 | 65 00 45 76 74 43 6c 65 61 72 4c 6f 67 00 5f 5f 69 6d 70 5f 45 76 74 43 6c 65 61 72 4c 6f 67 00 | e.EvtClearLog.__imp_EvtClearLog. |
| 0a00 | 45 76 74 43 61 6e 63 65 6c 00 5f 5f 69 6d 70 5f 45 76 74 43 61 6e 63 65 6c 00 45 76 74 41 72 63 | EvtCancel.__imp_EvtCancel.EvtArc |
| 0a20 | 68 69 76 65 45 78 70 6f 72 74 65 64 4c 6f 67 00 5f 5f 69 6d 70 5f 45 76 74 41 72 63 68 69 76 65 | hiveExportedLog.__imp_EvtArchive |
| 0a40 | 45 78 70 6f 72 74 65 64 4c 6f 67 00 64 61 77 71 74 2e 6f 2f 20 20 20 20 20 20 20 20 31 35 31 36 | ExportedLog.dawqt.o/........1516 |
| 0a60 | 31 36 30 38 36 36 20 20 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 36 33 31 20 | 160866..0.....0.....100666..631. |
| 0a80 | 20 20 20 20 20 20 60 0a 64 86 06 00 00 00 00 00 20 01 00 00 0f 00 00 00 00 00 05 00 2e 74 65 78 | ......`.d....................tex |
| 0aa0 | 74 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | t............................... |
| 0ac0 | 20 00 50 60 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ..P`.data....................... |
| 0ae0 | 00 00 00 00 00 00 00 00 40 00 50 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ........@.P..bss................ |
| 0b00 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 50 c0 2e 69 64 61 74 61 24 34 00 00 00 00 | ..................P..idata$4.... |
| 0b20 | 00 00 00 00 08 00 00 00 04 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 69 64 61 | ........................@.0..ida |
| 0b40 | 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 0c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ta$5............................ |
| 0b60 | 40 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 0c 00 00 00 14 01 00 00 00 00 00 00 | @.0..idata$7.................... |
| 0b80 | 00 00 00 00 00 00 00 00 40 00 30 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 77 65 76 74 | ........@.0.................wevt |
| 0ba0 | 61 70 69 2e 64 6c 6c 00 2e 66 69 6c 65 00 00 00 00 00 00 00 fe ff 00 00 67 01 66 61 6b 65 00 00 | api.dll..file...........g.fake.. |
| 0bc0 | 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 01 00 00 | .............text............... |
| 0be0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 00 00 | .................data........... |
| 0c00 | 03 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 62 73 73 00 00 00 00 00 00 00 00 | .....................bss........ |
| 0c20 | 03 00 00 00 03 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 69 64 61 74 61 24 34 | .........................idata$4 |
| 0c40 | 00 00 00 00 04 00 00 00 03 01 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 69 64 61 | .............................ida |
| 0c60 | 74 61 24 35 00 00 00 00 05 00 00 00 03 01 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ta$5............................ |
| 0c80 | 2e 69 64 61 74 61 24 37 00 00 00 00 06 00 00 00 03 01 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 | .idata$7........................ |
| 0ca0 | 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 06 00 00 00 02 00 49 00 00 00 5f 5f 43 5f 5f 55 | ......................I...__C__U |
| 0cc0 | 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 | sers_Peter_Code_winapi_rs_x86_64 |
| 0ce0 | 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 65 76 74 61 70 69 5f 61 5f 69 6e 61 6d 65 00 0a | _lib_libwinapi_wevtapi_a_iname.. |
| 0d00 | 64 61 77 71 68 2e 6f 2f 20 20 20 20 20 20 20 20 31 35 31 36 31 36 30 38 36 36 20 20 30 20 20 20 | dawqh.o/........1516160866..0... |
| 0d20 | 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 37 33 38 20 20 20 20 20 20 20 60 0a 64 86 06 00 | ..0.....100666..738.......`.d... |
| 0d40 | 00 00 00 00 36 01 00 00 10 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 | ....6............text........... |
| 0d60 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 50 60 2e 64 61 74 61 00 00 00 | ......................P`.data... |
| 0d80 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 50 c0 | ............................@.P. |
| 0da0 | 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | .bss............................ |
| 0dc0 | 00 00 00 00 80 00 50 c0 2e 69 64 61 74 61 24 32 00 00 00 00 00 00 00 00 14 00 00 00 04 01 00 00 | ......P..idata$2................ |
| 0de0 | 18 01 00 00 00 00 00 00 03 00 00 00 40 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 | ............@.0..idata$5........ |
| 0e00 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 69 64 61 74 61 24 34 | ....................@.0..idata$4 |
| 0e20 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 | ............................@.0. |
| 0e40 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 00 00 00 03 00 0c 00 | ................................ |
| 0e60 | 00 00 0f 00 00 00 03 00 10 00 00 00 0d 00 00 00 03 00 2e 66 69 6c 65 00 00 00 00 00 00 00 fe ff | ...................file......... |
| 0e80 | 00 00 67 01 66 61 6b 65 00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 6e 61 6d 65 00 00 00 00 00 | ..g.fake..............hname..... |
| 0ea0 | 00 00 06 00 00 00 03 00 66 74 68 75 6e 6b 00 00 00 00 00 00 05 00 00 00 03 00 2e 74 65 78 74 00 | ........fthunk.............text. |
| 0ec0 | 00 00 00 00 00 00 01 00 00 00 03 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 64 | ...............................d |
| 0ee0 | 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ata............................. |
| 0f00 | 00 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 01 00 00 00 00 00 00 00 00 00 00 00 00 | ...bss.......................... |
| 0f20 | 00 00 00 00 00 00 2e 69 64 61 74 61 24 32 00 00 00 00 04 00 00 00 03 01 14 00 00 00 03 00 00 00 | .......idata$2.................. |
| 0f40 | 00 00 00 00 00 00 00 00 00 00 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 | ...........idata$4...........ida |
| 0f60 | 74 61 24 35 00 00 00 00 05 00 00 00 03 00 00 00 00 00 04 00 00 00 00 00 00 00 04 00 00 00 02 00 | ta$5............................ |
| 0f80 | 00 00 00 00 47 00 00 00 00 00 00 00 00 00 00 00 02 00 8c 00 00 00 5f 68 65 61 64 5f 43 5f 5f 55 | ....G................._head_C__U |
| 0fa0 | 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 | sers_Peter_Code_winapi_rs_x86_64 |
| 0fc0 | 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 65 76 74 61 70 69 5f 61 00 5f 5f 43 5f 5f 55 73 | _lib_libwinapi_wevtapi_a.__C__Us |
| 0fe0 | 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f | ers_Peter_Code_winapi_rs_x86_64_ |
| 1000 | 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 65 76 74 61 70 69 5f 61 5f 69 6e 61 6d 65 00 64 61 | lib_libwinapi_wevtapi_a_iname.da |
| 1020 | 77 71 73 30 30 30 34 33 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 38 36 36 20 20 30 20 20 20 20 20 | wqs00043.o/...1516160866..0..... |
| 1040 | 30 20 20 20 20 20 31 30 30 36 36 36 20 20 36 38 31 20 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 | 0.....100666..681.......`.d..... |
| 1060 | 00 00 84 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 08 00 | ...............text............. |
| 1080 | 00 00 2c 01 00 00 5c 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 | ..,...\.............0`.data..... |
| 10a0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 | ..........................@.0..b |
| 10c0 | 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ss.............................. |
| 10e0 | 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 66 01 | ....0..idata$7............4...f. |
| 1100 | 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 08 00 | ............0..idata$5.......... |
| 1120 | 00 00 38 01 00 00 70 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 | ..8...p.............0..idata$4.. |
| 1140 | 00 00 00 00 00 00 08 00 00 00 40 01 00 00 7a 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 | ..........@...z.............0..i |
| 1160 | 64 61 74 61 24 36 00 00 00 00 00 00 00 00 14 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 | data$6............H............. |
| 1180 | 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | .......%........................ |
| 11a0 | 00 00 2b 00 45 76 74 55 70 64 61 74 65 42 6f 6f 6b 6d 61 72 6b 00 02 00 00 00 08 00 00 00 04 00 | ..+.EvtUpdateBookmark........... |
| 11c0 | 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 | ...............................t |
| 11e0 | 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 00 00 | ext..............data........... |
| 1200 | 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 | ...bss...............idata$7.... |
| 1220 | 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 | .......idata$5...........idata$4 |
| 1240 | 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 00 00 00 00 | ...........idata$6.............. |
| 1260 | 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 16 00 00 00 00 00 00 00 05 00 00 00 02 00 | ................................ |
| 1280 | 00 00 00 00 2e 00 00 00 00 00 00 00 00 00 00 00 02 00 71 00 00 00 45 76 74 55 70 64 61 74 65 42 | ..................q...EvtUpdateB |
| 12a0 | 6f 6f 6b 6d 61 72 6b 00 5f 5f 69 6d 70 5f 45 76 74 55 70 64 61 74 65 42 6f 6f 6b 6d 61 72 6b 00 | ookmark.__imp_EvtUpdateBookmark. |
| 12c0 | 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 | _head_C__Users_Peter_Code_winapi |
| 12e0 | 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 65 76 74 61 70 69 | _rs_x86_64_lib_libwinapi_wevtapi |
| 1300 | 5f 61 00 0a 64 61 77 71 73 30 30 30 34 32 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 38 36 36 20 20 | _a..dawqs00042.o/...1516160866.. |
| 1320 | 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 36 36 37 20 20 20 20 20 20 20 60 0a | 0.....0.....100666..667.......`. |
| 1340 | 64 86 07 00 00 00 00 00 80 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 | d....................text....... |
| 1360 | 00 00 00 00 08 00 00 00 2c 01 00 00 58 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 | ........,...X.............0`.dat |
| 1380 | 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | a............................... |
| 13a0 | 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | @.0..bss........................ |
| 13c0 | 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 | ..........0..idata$7............ |
| 13e0 | 34 01 00 00 62 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 | 4...b.............0..idata$5.... |
| 1400 | 00 00 00 00 08 00 00 00 38 01 00 00 6c 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 | ........8...l.............0..ida |
| 1420 | 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 76 01 00 00 00 00 00 00 01 00 00 00 | ta$4............@...v........... |
| 1440 | 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 10 00 00 00 48 01 00 00 00 00 00 00 | ..0..idata$6............H....... |
| 1460 | 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 | .............%.................. |
| 1480 | 00 00 00 00 00 00 00 00 2a 00 45 76 74 53 75 62 73 63 72 69 62 65 00 00 02 00 00 00 08 00 00 00 | ........*.EvtSubscribe.......... |
| 14a0 | 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 | ................................ |
| 14c0 | 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 | .text..............data......... |
| 14e0 | 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 | .....bss...............idata$7.. |
| 1500 | 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 | .........idata$5...........idata |
| 1520 | 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 00 00 | $4...........idata$6............ |
| 1540 | 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 11 00 00 00 00 00 00 00 05 00 00 00 | ................................ |
| 1560 | 02 00 00 00 00 00 24 00 00 00 00 00 00 00 00 00 00 00 02 00 67 00 00 00 45 76 74 53 75 62 73 63 | ......$.............g...EvtSubsc |
| 1580 | 72 69 62 65 00 5f 5f 69 6d 70 5f 45 76 74 53 75 62 73 63 72 69 62 65 00 5f 68 65 61 64 5f 43 5f | ribe.__imp_EvtSubscribe._head_C_ |
| 15a0 | 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f | _Users_Peter_Code_winapi_rs_x86_ |
| 15c0 | 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 61 77 71 | 64_lib_libwinapi_wevtapi_a..dawq |
| 15e0 | 73 30 30 30 34 31 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 38 36 36 20 20 30 20 20 20 20 20 30 20 | s00041.o/...1516160866..0.....0. |
| 1600 | 20 20 20 20 31 30 30 36 36 36 20 20 37 31 33 20 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 | ....100666..713.......`.d....... |
| 1620 | 90 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 | .............text............... |
| 1640 | 2c 01 00 00 68 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 | ,...h.............0`.data....... |
| 1660 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 | ........................@.0..bss |
| 1680 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................................ |
| 16a0 | 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 72 01 00 00 | ..0..idata$7............4...r... |
| 16c0 | 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 | ..........0..idata$5............ |
| 16e0 | 38 01 00 00 7c 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 | 8...|.............0..idata$4.... |
| 1700 | 00 00 00 00 08 00 00 00 40 01 00 00 86 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 | ........@.................0..ida |
| 1720 | 74 61 24 36 00 00 00 00 00 00 00 00 1e 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ta$6............H............... |
| 1740 | 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | .....%.......................... |
| 1760 | 29 00 45 76 74 53 65 74 43 68 61 6e 6e 65 6c 43 6f 6e 66 69 67 50 72 6f 70 65 72 74 79 00 00 00 | ).EvtSetChannelConfigProperty... |
| 1780 | 02 00 00 00 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 | ................................ |
| 17a0 | 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 | .........text..............data. |
| 17c0 | 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 | .............bss...............i |
| 17e0 | 64 61 74 61 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 | data$7...........idata$5........ |
| 1800 | 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 | ...idata$4...........idata$6.... |
| 1820 | 07 00 00 00 03 00 00 00 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 20 00 00 00 | ................................ |
| 1840 | 00 00 00 00 05 00 00 00 02 00 00 00 00 00 42 00 00 00 00 00 00 00 00 00 00 00 02 00 85 00 00 00 | ..............B................. |
| 1860 | 45 76 74 53 65 74 43 68 61 6e 6e 65 6c 43 6f 6e 66 69 67 50 72 6f 70 65 72 74 79 00 5f 5f 69 6d | EvtSetChannelConfigProperty.__im |
| 1880 | 70 5f 45 76 74 53 65 74 43 68 61 6e 6e 65 6c 43 6f 6e 66 69 67 50 72 6f 70 65 72 74 79 00 5f 68 | p_EvtSetChannelConfigProperty._h |
| 18a0 | 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 | ead_C__Users_Peter_Code_winapi_r |
| 18c0 | 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 65 76 74 61 70 69 5f 61 | s_x86_64_lib_libwinapi_wevtapi_a |
| 18e0 | 00 0a 64 61 77 71 73 30 30 30 34 30 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 38 36 36 20 20 30 20 | ..dawqs00040.o/...1516160866..0. |
| 1900 | 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 36 34 35 20 20 20 20 20 20 20 60 0a 64 86 | ....0.....100666..645.......`.d. |
| 1920 | 07 00 00 00 00 00 7c 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 | ......|............text......... |
| 1940 | 00 00 08 00 00 00 2c 01 00 00 54 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 | ......,...T.............0`.data. |
| 1960 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 | ..............................@. |
| 1980 | 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | 0..bss.......................... |
| 19a0 | 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 | ........0..idata$7............4. |
| 19c0 | 00 00 5e 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 | ..^.............0..idata$5...... |
| 19e0 | 00 00 08 00 00 00 38 01 00 00 68 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 | ......8...h.............0..idata |
| 1a00 | 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 72 01 00 00 00 00 00 00 01 00 00 00 00 00 | $4............@...r............. |
| 1a20 | 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 0a 00 00 00 48 01 00 00 00 00 00 00 00 00 | 0..idata$6............H......... |
| 1a40 | 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ...........%.................... |
| 1a60 | 00 00 00 00 00 00 28 00 45 76 74 53 65 65 6b 00 00 00 02 00 00 00 08 00 00 00 04 00 00 00 00 00 | ......(.EvtSeek................. |
| 1a80 | 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 | ...........................text. |
| 1aa0 | 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 | .............data..............b |
| 1ac0 | 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 00 00 | ss...............idata$7........ |
| 1ae0 | 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 | ...idata$5...........idata$4.... |
| 1b00 | 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 45 76 74 53 65 65 6b 00 | .......idata$6..........EvtSeek. |
| 1b20 | 00 00 00 00 01 00 00 00 02 00 00 00 00 00 04 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 00 00 | ................................ |
| 1b40 | 12 00 00 00 00 00 00 00 00 00 00 00 02 00 55 00 00 00 5f 5f 69 6d 70 5f 45 76 74 53 65 65 6b 00 | ..............U...__imp_EvtSeek. |
| 1b60 | 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 | _head_C__Users_Peter_Code_winapi |
| 1b80 | 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 65 76 74 61 70 69 | _rs_x86_64_lib_libwinapi_wevtapi |
| 1ba0 | 5f 61 00 0a 64 61 77 71 73 30 30 30 33 39 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 38 36 36 20 20 | _a..dawqs00039.o/...1516160866.. |
| 1bc0 | 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 36 39 31 20 20 20 20 20 20 20 60 0a | 0.....0.....100666..691.......`. |
| 1be0 | 64 86 07 00 00 00 00 00 88 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 | d....................text....... |
| 1c00 | 00 00 00 00 08 00 00 00 2c 01 00 00 60 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 | ........,...`.............0`.dat |
| 1c20 | 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | a............................... |
| 1c40 | 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | @.0..bss........................ |
| 1c60 | 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 | ..........0..idata$7............ |
| 1c80 | 34 01 00 00 6a 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 | 4...j.............0..idata$5.... |
| 1ca0 | 00 00 00 00 08 00 00 00 38 01 00 00 74 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 | ........8...t.............0..ida |
| 1cc0 | 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 7e 01 00 00 00 00 00 00 01 00 00 00 | ta$4............@...~........... |
| 1ce0 | 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 18 00 00 00 48 01 00 00 00 00 00 00 | ..0..idata$6............H....... |
| 1d00 | 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 | .............%.................. |
| 1d20 | 00 00 00 00 00 00 00 00 27 00 45 76 74 53 61 76 65 43 68 61 6e 6e 65 6c 43 6f 6e 66 69 67 00 00 | ........'.EvtSaveChannelConfig.. |
| 1d40 | 02 00 00 00 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 | ................................ |
| 1d60 | 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 | .........text..............data. |
| 1d80 | 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 | .............bss...............i |
| 1da0 | 64 61 74 61 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 | data$7...........idata$5........ |
| 1dc0 | 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 | ...idata$4...........idata$6.... |
| 1de0 | 07 00 00 00 03 00 00 00 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 19 00 00 00 | ................................ |
| 1e00 | 00 00 00 00 05 00 00 00 02 00 00 00 00 00 34 00 00 00 00 00 00 00 00 00 00 00 02 00 77 00 00 00 | ..............4.............w... |
| 1e20 | 45 76 74 53 61 76 65 43 68 61 6e 6e 65 6c 43 6f 6e 66 69 67 00 5f 5f 69 6d 70 5f 45 76 74 53 61 | EvtSaveChannelConfig.__imp_EvtSa |
| 1e40 | 76 65 43 68 61 6e 6e 65 6c 43 6f 6e 66 69 67 00 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 | veChannelConfig._head_C__Users_P |
| 1e60 | 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c | eter_Code_winapi_rs_x86_64_lib_l |
| 1e80 | 69 62 77 69 6e 61 70 69 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 61 77 71 73 30 30 30 33 38 2e 6f | ibwinapi_wevtapi_a..dawqs00038.o |
| 1ea0 | 2f 20 20 20 31 35 31 36 31 36 30 38 36 36 20 20 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 | /...1516160866..0.....0.....1006 |
| 1ec0 | 36 36 20 20 36 35 37 20 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 7c 01 00 00 0a 00 00 00 | 66..657.......`.d.......|....... |
| 1ee0 | 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 2c 01 00 00 54 01 00 00 | .....text...............,...T... |
| 1f00 | 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ..........0`.data............... |
| 1f20 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 | ................@.0..bss........ |
| 1f40 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 | ..........................0..ida |
| 1f60 | 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 5e 01 00 00 00 00 00 00 01 00 00 00 | ta$7............4...^........... |
| 1f80 | 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 38 01 00 00 68 01 00 00 | ..0..idata$5............8...h... |
| 1fa0 | 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 | ..........0..idata$4............ |
| 1fc0 | 40 01 00 00 72 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 | @...r.............0..idata$6.... |
| 1fe0 | 00 00 00 00 0c 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 | ........H....................%.. |
| 2000 | 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 26 00 45 76 74 52 65 6e | ........................&.EvtRen |
| 2020 | 64 65 72 00 02 00 00 00 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 | der............................. |
| 2040 | 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 | .............text..............d |
| 2060 | 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 | ata..............bss............ |
| 2080 | 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 | ...idata$7...........idata$5.... |
| 20a0 | 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 | .......idata$4...........idata$6 |
| 20c0 | 00 00 00 00 07 00 00 00 03 00 00 00 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 | ................................ |
| 20e0 | 0e 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 02 00 | ................................ |
| 2100 | 61 00 00 00 45 76 74 52 65 6e 64 65 72 00 5f 5f 69 6d 70 5f 45 76 74 52 65 6e 64 65 72 00 5f 68 | a...EvtRender.__imp_EvtRender._h |
| 2120 | 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 | ead_C__Users_Peter_Code_winapi_r |
| 2140 | 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 65 76 74 61 70 69 5f 61 | s_x86_64_lib_libwinapi_wevtapi_a |
| 2160 | 00 0a 64 61 77 71 73 30 30 30 33 37 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 38 36 36 20 20 30 20 | ..dawqs00037.o/...1516160866..0. |
| 2180 | 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 36 34 36 20 20 20 20 20 20 20 60 0a 64 86 | ....0.....100666..646.......`.d. |
| 21a0 | 07 00 00 00 00 00 7c 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 | ......|............text......... |
| 21c0 | 00 00 08 00 00 00 2c 01 00 00 54 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 | ......,...T.............0`.data. |
| 21e0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 | ..............................@. |
| 2200 | 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | 0..bss.......................... |
| 2220 | 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 | ........0..idata$7............4. |
| 2240 | 00 00 5e 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 | ..^.............0..idata$5...... |
| 2260 | 00 00 08 00 00 00 38 01 00 00 68 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 | ......8...h.............0..idata |
| 2280 | 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 72 01 00 00 00 00 00 00 01 00 00 00 00 00 | $4............@...r............. |
| 22a0 | 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 0c 00 00 00 48 01 00 00 00 00 00 00 00 00 | 0..idata$6............H......... |
| 22c0 | 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ...........%.................... |
| 22e0 | 00 00 00 00 00 00 25 00 45 76 74 51 75 65 72 79 00 00 02 00 00 00 08 00 00 00 04 00 00 00 00 00 | ......%.EvtQuery................ |
| 2300 | 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 | ...........................text. |
| 2320 | 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 | .............data..............b |
| 2340 | 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 00 00 | ss...............idata$7........ |
| 2360 | 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 | ...idata$5...........idata$4.... |
| 2380 | 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 45 76 74 51 75 65 72 79 | .......idata$6..........EvtQuery |
| 23a0 | 00 00 00 00 01 00 00 00 02 00 00 00 00 00 04 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 00 00 | ................................ |
| 23c0 | 13 00 00 00 00 00 00 00 00 00 00 00 02 00 56 00 00 00 5f 5f 69 6d 70 5f 45 76 74 51 75 65 72 79 | ..............V...__imp_EvtQuery |
| 23e0 | 00 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 | ._head_C__Users_Peter_Code_winap |
| 2400 | 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 65 76 74 61 70 | i_rs_x86_64_lib_libwinapi_wevtap |
| 2420 | 69 5f 61 00 64 61 77 71 73 30 30 30 33 36 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 38 36 36 20 20 | i_a.dawqs00036.o/...1516160866.. |
| 2440 | 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 36 37 35 20 20 20 20 20 20 20 60 0a | 0.....0.....100666..675.......`. |
| 2460 | 64 86 07 00 00 00 00 00 84 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 | d....................text....... |
| 2480 | 00 00 00 00 08 00 00 00 2c 01 00 00 5c 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 | ........,...\.............0`.dat |
| 24a0 | 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | a............................... |
| 24c0 | 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | @.0..bss........................ |
| 24e0 | 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 | ..........0..idata$7............ |
| 2500 | 34 01 00 00 66 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 | 4...f.............0..idata$5.... |
| 2520 | 00 00 00 00 08 00 00 00 38 01 00 00 70 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 | ........8...p.............0..ida |
| 2540 | 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 7a 01 00 00 00 00 00 00 01 00 00 00 | ta$4............@...z........... |
| 2560 | 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 12 00 00 00 48 01 00 00 00 00 00 00 | ..0..idata$6............H....... |
| 2580 | 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 | .............%.................. |
| 25a0 | 00 00 00 00 00 00 00 00 24 00 45 76 74 4f 70 65 6e 53 65 73 73 69 6f 6e 00 00 00 00 02 00 00 00 | ........$.EvtOpenSession........ |
| 25c0 | 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 | ................................ |
| 25e0 | 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 | .....text..............data..... |
| 2600 | 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 | .........bss...............idata |
| 2620 | 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 | $7...........idata$5...........i |
| 2640 | 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 | data$4...........idata$6........ |
| 2660 | 03 00 00 00 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 13 00 00 00 00 00 00 00 | ................................ |
| 2680 | 05 00 00 00 02 00 00 00 00 00 28 00 00 00 00 00 00 00 00 00 00 00 02 00 6b 00 00 00 45 76 74 4f | ..........(.............k...EvtO |
| 26a0 | 70 65 6e 53 65 73 73 69 6f 6e 00 5f 5f 69 6d 70 5f 45 76 74 4f 70 65 6e 53 65 73 73 69 6f 6e 00 | penSession.__imp_EvtOpenSession. |
| 26c0 | 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 | _head_C__Users_Peter_Code_winapi |
| 26e0 | 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 65 76 74 61 70 69 | _rs_x86_64_lib_libwinapi_wevtapi |
| 2700 | 5f 61 00 0a 64 61 77 71 73 30 30 30 33 35 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 38 36 36 20 20 | _a..dawqs00035.o/...1516160866.. |
| 2720 | 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 37 30 33 20 20 20 20 20 20 20 60 0a | 0.....0.....100666..703.......`. |
| 2740 | 64 86 07 00 00 00 00 00 8c 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 | d....................text....... |
| 2760 | 00 00 00 00 08 00 00 00 2c 01 00 00 64 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 | ........,...d.............0`.dat |
| 2780 | 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | a............................... |
| 27a0 | 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | @.0..bss........................ |
| 27c0 | 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 | ..........0..idata$7............ |
| 27e0 | 34 01 00 00 6e 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 | 4...n.............0..idata$5.... |
| 2800 | 00 00 00 00 08 00 00 00 38 01 00 00 78 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 | ........8...x.............0..ida |
| 2820 | 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 82 01 00 00 00 00 00 00 01 00 00 00 | ta$4............@............... |
| 2840 | 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 1c 00 00 00 48 01 00 00 00 00 00 00 | ..0..idata$6............H....... |
| 2860 | 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 | .............%.................. |
| 2880 | 00 00 00 00 00 00 00 00 23 00 45 76 74 4f 70 65 6e 50 75 62 6c 69 73 68 65 72 4d 65 74 61 64 61 | ........#.EvtOpenPublisherMetada |
| 28a0 | 74 61 00 00 02 00 00 00 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 | ta.............................. |
| 28c0 | 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 | .............text..............d |
| 28e0 | 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 | ata..............bss............ |
| 2900 | 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 | ...idata$7...........idata$5.... |
| 2920 | 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 | .......idata$4...........idata$6 |
| 2940 | 00 00 00 00 07 00 00 00 03 00 00 00 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 | ................................ |
| 2960 | 1d 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 02 00 | ..................<............. |
| 2980 | 7f 00 00 00 45 76 74 4f 70 65 6e 50 75 62 6c 69 73 68 65 72 4d 65 74 61 64 61 74 61 00 5f 5f 69 | ....EvtOpenPublisherMetadata.__i |
| 29a0 | 6d 70 5f 45 76 74 4f 70 65 6e 50 75 62 6c 69 73 68 65 72 4d 65 74 61 64 61 74 61 00 5f 68 65 61 | mp_EvtOpenPublisherMetadata._hea |
| 29c0 | 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f | d_C__Users_Peter_Code_winapi_rs_ |
| 29e0 | 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 65 76 74 61 70 69 5f 61 00 0a | x86_64_lib_libwinapi_wevtapi_a.. |
| 2a00 | 64 61 77 71 73 30 30 30 33 34 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 38 36 36 20 20 30 20 20 20 | dawqs00034.o/...1516160866..0... |
| 2a20 | 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 36 39 31 20 20 20 20 20 20 20 60 0a 64 86 07 00 | ..0.....100666..691.......`.d... |
| 2a40 | 00 00 00 00 88 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 | .................text........... |
| 2a60 | 08 00 00 00 2c 01 00 00 60 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 | ....,...`.............0`.data... |
| 2a80 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 | ............................@.0. |
| 2aa0 | 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | .bss............................ |
| 2ac0 | 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 | ......0..idata$7............4... |
| 2ae0 | 6a 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 | j.............0..idata$5........ |
| 2b00 | 08 00 00 00 38 01 00 00 74 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 | ....8...t.............0..idata$4 |
| 2b20 | 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 7e 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 | ............@...~.............0. |
| 2b40 | 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 18 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 | .idata$6............H........... |
| 2b60 | 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | .........%...................... |
| 2b80 | 00 00 00 00 22 00 45 76 74 4f 70 65 6e 50 75 62 6c 69 73 68 65 72 45 6e 75 6d 00 00 02 00 00 00 | ....".EvtOpenPublisherEnum...... |
| 2ba0 | 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 | ................................ |
| 2bc0 | 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 | .....text..............data..... |
| 2be0 | 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 | .........bss...............idata |
| 2c00 | 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 | $7...........idata$5...........i |
| 2c20 | 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 | data$4...........idata$6........ |
| 2c40 | 03 00 00 00 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 19 00 00 00 00 00 00 00 | ................................ |
| 2c60 | 05 00 00 00 02 00 00 00 00 00 34 00 00 00 00 00 00 00 00 00 00 00 02 00 77 00 00 00 45 76 74 4f | ..........4.............w...EvtO |
| 2c80 | 70 65 6e 50 75 62 6c 69 73 68 65 72 45 6e 75 6d 00 5f 5f 69 6d 70 5f 45 76 74 4f 70 65 6e 50 75 | penPublisherEnum.__imp_EvtOpenPu |
| 2ca0 | 62 6c 69 73 68 65 72 45 6e 75 6d 00 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 | blisherEnum._head_C__Users_Peter |
| 2cc0 | 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 | _Code_winapi_rs_x86_64_lib_libwi |
| 2ce0 | 6e 61 70 69 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 61 77 71 73 30 30 30 33 33 2e 6f 2f 20 20 20 | napi_wevtapi_a..dawqs00033.o/... |
| 2d00 | 31 35 31 36 31 36 30 38 36 36 20 20 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 | 1516160866..0.....0.....100666.. |
| 2d20 | 36 36 33 20 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 80 01 00 00 0a 00 00 00 00 00 04 00 | 663.......`.d................... |
| 2d40 | 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 2c 01 00 00 58 01 00 00 00 00 00 00 | .text...............,...X....... |
| 2d60 | 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ......0`.data................... |
| 2d80 | 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 | ............@.0..bss............ |
| 2da0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 | ......................0..idata$7 |
| 2dc0 | 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 62 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 | ............4...b.............0. |
| 2de0 | 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 38 01 00 00 6c 01 00 00 00 00 00 00 | .idata$5............8...l....... |
| 2e00 | 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 | ......0..idata$4............@... |
| 2e20 | 76 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 | v.............0..idata$6........ |
| 2e40 | 0e 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 | ....H....................%...... |
| 2e60 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 00 45 76 74 4f 70 65 6e 4c 6f 67 | ....................!.EvtOpenLog |
| 2e80 | 00 00 00 00 02 00 00 00 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 | ................................ |
| 2ea0 | 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 | .............text..............d |
| 2ec0 | 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 | ata..............bss............ |
| 2ee0 | 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 | ...idata$7...........idata$5.... |
| 2f00 | 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 | .......idata$4...........idata$6 |
| 2f20 | 00 00 00 00 07 00 00 00 03 00 00 00 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 | ................................ |
| 2f40 | 0f 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 02 00 | ................................ |
| 2f60 | 63 00 00 00 45 76 74 4f 70 65 6e 4c 6f 67 00 5f 5f 69 6d 70 5f 45 76 74 4f 70 65 6e 4c 6f 67 00 | c...EvtOpenLog.__imp_EvtOpenLog. |
| 2f80 | 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 | _head_C__Users_Peter_Code_winapi |
| 2fa0 | 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 65 76 74 61 70 69 | _rs_x86_64_lib_libwinapi_wevtapi |
| 2fc0 | 5f 61 00 0a 64 61 77 71 73 30 30 30 33 32 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 38 36 36 20 20 | _a..dawqs00032.o/...1516160866.. |
| 2fe0 | 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 37 30 33 20 20 20 20 20 20 20 60 0a | 0.....0.....100666..703.......`. |
| 3000 | 64 86 07 00 00 00 00 00 8c 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 | d....................text....... |
| 3020 | 00 00 00 00 08 00 00 00 2c 01 00 00 64 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 | ........,...d.............0`.dat |
| 3040 | 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | a............................... |
| 3060 | 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | @.0..bss........................ |
| 3080 | 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 | ..........0..idata$7............ |
| 30a0 | 34 01 00 00 6e 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 | 4...n.............0..idata$5.... |
| 30c0 | 00 00 00 00 08 00 00 00 38 01 00 00 78 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 | ........8...x.............0..ida |
| 30e0 | 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 82 01 00 00 00 00 00 00 01 00 00 00 | ta$4............@............... |
| 3100 | 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 1c 00 00 00 48 01 00 00 00 00 00 00 | ..0..idata$6............H....... |
| 3120 | 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 | .............%.................. |
| 3140 | 00 00 00 00 00 00 00 00 20 00 45 76 74 4f 70 65 6e 45 76 65 6e 74 4d 65 74 61 64 61 74 61 45 6e | ..........EvtOpenEventMetadataEn |
| 3160 | 75 6d 00 00 02 00 00 00 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 | um.............................. |
| 3180 | 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 | .............text..............d |
| 31a0 | 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 | ata..............bss............ |
| 31c0 | 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 | ...idata$7...........idata$5.... |
| 31e0 | 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 | .......idata$4...........idata$6 |
| 3200 | 00 00 00 00 07 00 00 00 03 00 00 00 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 | ................................ |
| 3220 | 1d 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 02 00 | ..................<............. |
| 3240 | 7f 00 00 00 45 76 74 4f 70 65 6e 45 76 65 6e 74 4d 65 74 61 64 61 74 61 45 6e 75 6d 00 5f 5f 69 | ....EvtOpenEventMetadataEnum.__i |
| 3260 | 6d 70 5f 45 76 74 4f 70 65 6e 45 76 65 6e 74 4d 65 74 61 64 61 74 61 45 6e 75 6d 00 5f 68 65 61 | mp_EvtOpenEventMetadataEnum._hea |
| 3280 | 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f | d_C__Users_Peter_Code_winapi_rs_ |
| 32a0 | 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 65 76 74 61 70 69 5f 61 00 0a | x86_64_lib_libwinapi_wevtapi_a.. |
| 32c0 | 64 61 77 71 73 30 30 30 33 31 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 38 36 36 20 20 30 20 20 20 | dawqs00031.o/...1516160866..0... |
| 32e0 | 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 36 38 37 20 20 20 20 20 20 20 60 0a 64 86 07 00 | ..0.....100666..687.......`.d... |
| 3300 | 00 00 00 00 88 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 | .................text........... |
| 3320 | 08 00 00 00 2c 01 00 00 60 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 | ....,...`.............0`.data... |
| 3340 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 | ............................@.0. |
| 3360 | 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | .bss............................ |
| 3380 | 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 | ......0..idata$7............4... |
| 33a0 | 6a 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 | j.............0..idata$5........ |
| 33c0 | 08 00 00 00 38 01 00 00 74 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 | ....8...t.............0..idata$4 |
| 33e0 | 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 7e 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 | ............@...~.............0. |
| 3400 | 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 16 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 | .idata$6............H........... |
| 3420 | 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | .........%...................... |
| 3440 | 00 00 00 00 1f 00 45 76 74 4f 70 65 6e 43 68 61 6e 6e 65 6c 45 6e 75 6d 00 00 00 00 02 00 00 00 | ......EvtOpenChannelEnum........ |
| 3460 | 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 | ................................ |
| 3480 | 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 | .....text..............data..... |
| 34a0 | 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 | .........bss...............idata |
| 34c0 | 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 | $7...........idata$5...........i |
| 34e0 | 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 | data$4...........idata$6........ |
| 3500 | 03 00 00 00 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 17 00 00 00 00 00 00 00 | ................................ |
| 3520 | 05 00 00 00 02 00 00 00 00 00 30 00 00 00 00 00 00 00 00 00 00 00 02 00 73 00 00 00 45 76 74 4f | ..........0.............s...EvtO |
| 3540 | 70 65 6e 43 68 61 6e 6e 65 6c 45 6e 75 6d 00 5f 5f 69 6d 70 5f 45 76 74 4f 70 65 6e 43 68 61 6e | penChannelEnum.__imp_EvtOpenChan |
| 3560 | 6e 65 6c 45 6e 75 6d 00 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 | nelEnum._head_C__Users_Peter_Cod |
| 3580 | 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 | e_winapi_rs_x86_64_lib_libwinapi |
| 35a0 | 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 61 77 71 73 30 30 30 33 30 2e 6f 2f 20 20 20 31 35 31 36 | _wevtapi_a..dawqs00030.o/...1516 |
| 35c0 | 31 36 30 38 36 36 20 20 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 36 39 31 20 | 160866..0.....0.....100666..691. |
| 35e0 | 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 88 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 | ......`.d....................tex |
| 3600 | 74 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 2c 01 00 00 60 01 00 00 00 00 00 00 01 00 00 00 | t...............,...`........... |
| 3620 | 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ..0`.data....................... |
| 3640 | 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ........@.0..bss................ |
| 3660 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 | ..................0..idata$7.... |
| 3680 | 00 00 00 00 04 00 00 00 34 01 00 00 6a 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 | ........4...j.............0..ida |
| 36a0 | 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 38 01 00 00 74 01 00 00 00 00 00 00 01 00 00 00 | ta$5............8...t........... |
| 36c0 | 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 7e 01 00 00 | ..0..idata$4............@...~... |
| 36e0 | 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 18 00 00 00 | ..........0..idata$6............ |
| 3700 | 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 | H....................%.......... |
| 3720 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1e 00 45 76 74 4f 70 65 6e 43 68 61 6e 6e 65 6c | ..................EvtOpenChannel |
| 3740 | 43 6f 6e 66 69 67 00 00 02 00 00 00 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 | Config.......................... |
| 3760 | 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 | .................text........... |
| 3780 | 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 | ...data..............bss........ |
| 37a0 | 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 | .......idata$7...........idata$5 |
| 37c0 | 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 | ...........idata$4...........ida |
| 37e0 | 74 61 24 36 00 00 00 00 07 00 00 00 03 00 00 00 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 | ta$6............................ |
| 3800 | 00 00 00 00 19 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 00 00 34 00 00 00 00 00 00 00 00 00 | ......................4......... |
| 3820 | 00 00 02 00 77 00 00 00 45 76 74 4f 70 65 6e 43 68 61 6e 6e 65 6c 43 6f 6e 66 69 67 00 5f 5f 69 | ....w...EvtOpenChannelConfig.__i |
| 3840 | 6d 70 5f 45 76 74 4f 70 65 6e 43 68 61 6e 6e 65 6c 43 6f 6e 66 69 67 00 5f 68 65 61 64 5f 43 5f | mp_EvtOpenChannelConfig._head_C_ |
| 3860 | 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f | _Users_Peter_Code_winapi_rs_x86_ |
| 3880 | 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 61 77 71 | 64_lib_libwinapi_wevtapi_a..dawq |
| 38a0 | 73 30 30 30 32 39 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 38 36 36 20 20 30 20 20 20 20 20 30 20 | s00029.o/...1516160866..0.....0. |
| 38c0 | 20 20 20 20 31 30 30 36 36 36 20 20 36 38 37 20 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 | ....100666..687.......`.d....... |
| 38e0 | 88 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 | .............text............... |
| 3900 | 2c 01 00 00 60 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 | ,...`.............0`.data....... |
| 3920 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 | ........................@.0..bss |
| 3940 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................................ |
| 3960 | 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 6a 01 00 00 | ..0..idata$7............4...j... |
| 3980 | 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 | ..........0..idata$5............ |
| 39a0 | 38 01 00 00 74 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 | 8...t.............0..idata$4.... |
| 39c0 | 00 00 00 00 08 00 00 00 40 01 00 00 7e 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 | ........@...~.............0..ida |
| 39e0 | 74 61 24 36 00 00 00 00 00 00 00 00 16 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ta$6............H............... |
| 3a00 | 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | .....%.......................... |
| 3a20 | 1d 00 45 76 74 4e 65 78 74 50 75 62 6c 69 73 68 65 72 49 64 00 00 00 00 02 00 00 00 08 00 00 00 | ..EvtNextPublisherId............ |
| 3a40 | 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 | ................................ |
| 3a60 | 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 | .text..............data......... |
| 3a80 | 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 | .....bss...............idata$7.. |
| 3aa0 | 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 | .........idata$5...........idata |
| 3ac0 | 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 00 00 | $4...........idata$6............ |
| 3ae0 | 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 17 00 00 00 00 00 00 00 05 00 00 00 | ................................ |
| 3b00 | 02 00 00 00 00 00 30 00 00 00 00 00 00 00 00 00 00 00 02 00 73 00 00 00 45 76 74 4e 65 78 74 50 | ......0.............s...EvtNextP |
| 3b20 | 75 62 6c 69 73 68 65 72 49 64 00 5f 5f 69 6d 70 5f 45 76 74 4e 65 78 74 50 75 62 6c 69 73 68 65 | ublisherId.__imp_EvtNextPublishe |
| 3b40 | 72 49 64 00 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 | rId._head_C__Users_Peter_Code_wi |
| 3b60 | 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 65 76 | napi_rs_x86_64_lib_libwinapi_wev |
| 3b80 | 74 61 70 69 5f 61 00 0a 64 61 77 71 73 30 30 30 32 38 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 38 | tapi_a..dawqs00028.o/...15161608 |
| 3ba0 | 36 36 20 20 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 36 39 31 20 20 20 20 20 | 66..0.....0.....100666..691..... |
| 3bc0 | 20 20 60 0a 64 86 07 00 00 00 00 00 88 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 | ..`.d....................text... |
| 3be0 | 00 00 00 00 00 00 00 00 08 00 00 00 2c 01 00 00 60 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 | ............,...`.............0` |
| 3c00 | 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | .data........................... |
| 3c20 | 00 00 00 00 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ....@.0..bss.................... |
| 3c40 | 00 00 00 00 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 | ..............0..idata$7........ |
| 3c60 | 04 00 00 00 34 01 00 00 6a 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 | ....4...j.............0..idata$5 |
| 3c80 | 00 00 00 00 00 00 00 00 08 00 00 00 38 01 00 00 74 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 | ............8...t.............0. |
| 3ca0 | 2e 69 64 61 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 7e 01 00 00 00 00 00 00 | .idata$4............@...~....... |
| 3cc0 | 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 18 00 00 00 48 01 00 00 | ......0..idata$6............H... |
| 3ce0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 | .................%.............. |
| 3d00 | 00 00 00 00 00 00 00 00 00 00 00 00 1c 00 45 76 74 4e 65 78 74 45 76 65 6e 74 4d 65 74 61 64 61 | ..............EvtNextEventMetada |
| 3d20 | 74 61 00 00 02 00 00 00 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 | ta.............................. |
| 3d40 | 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 | .............text..............d |
| 3d60 | 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 | ata..............bss............ |
| 3d80 | 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 | ...idata$7...........idata$5.... |
| 3da0 | 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 | .......idata$4...........idata$6 |
| 3dc0 | 00 00 00 00 07 00 00 00 03 00 00 00 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 | ................................ |
| 3de0 | 19 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 00 00 34 00 00 00 00 00 00 00 00 00 00 00 02 00 | ..................4............. |
| 3e00 | 77 00 00 00 45 76 74 4e 65 78 74 45 76 65 6e 74 4d 65 74 61 64 61 74 61 00 5f 5f 69 6d 70 5f 45 | w...EvtNextEventMetadata.__imp_E |
| 3e20 | 76 74 4e 65 78 74 45 76 65 6e 74 4d 65 74 61 64 61 74 61 00 5f 68 65 61 64 5f 43 5f 5f 55 73 65 | vtNextEventMetadata._head_C__Use |
| 3e40 | 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c | rs_Peter_Code_winapi_rs_x86_64_l |
| 3e60 | 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 61 77 71 73 30 30 30 | ib_libwinapi_wevtapi_a..dawqs000 |
| 3e80 | 32 37 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 38 36 36 20 20 30 20 20 20 20 20 30 20 20 20 20 20 | 27.o/...1516160866..0.....0..... |
| 3ea0 | 31 30 30 36 36 36 20 20 36 38 37 20 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 88 01 00 00 | 100666..687.......`.d........... |
| 3ec0 | 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 2c 01 00 00 | .........text...............,... |
| 3ee0 | 60 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 00 00 | `.............0`.data........... |
| 3f00 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 00 00 00 00 | ....................@.0..bss.... |
| 3f20 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 30 c0 | ..............................0. |
| 3f40 | 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 6a 01 00 00 00 00 00 00 | .idata$7............4...j....... |
| 3f60 | 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 38 01 00 00 | ......0..idata$5............8... |
| 3f80 | 74 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 00 00 00 00 | t.............0..idata$4........ |
| 3fa0 | 08 00 00 00 40 01 00 00 7e 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 36 | ....@...~.............0..idata$6 |
| 3fc0 | 00 00 00 00 00 00 00 00 16 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 c0 | ............H................... |
| 3fe0 | ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1b 00 45 76 | .%............................Ev |
| 4000 | 74 4e 65 78 74 43 68 61 6e 6e 65 6c 50 61 74 68 00 00 00 00 02 00 00 00 08 00 00 00 04 00 00 00 | tNextChannelPath................ |
| 4020 | 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 | .............................tex |
| 4040 | 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 | t..............data............. |
| 4060 | 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 | .bss...............idata$7...... |
| 4080 | 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 | .....idata$5...........idata$4.. |
| 40a0 | 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 00 00 00 00 04 00 | .........idata$6................ |
| 40c0 | 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 17 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 | ................................ |
| 40e0 | 00 00 30 00 00 00 00 00 00 00 00 00 00 00 02 00 73 00 00 00 45 76 74 4e 65 78 74 43 68 61 6e 6e | ..0.............s...EvtNextChann |
| 4100 | 65 6c 50 61 74 68 00 5f 5f 69 6d 70 5f 45 76 74 4e 65 78 74 43 68 61 6e 6e 65 6c 50 61 74 68 00 | elPath.__imp_EvtNextChannelPath. |
| 4120 | 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 | _head_C__Users_Peter_Code_winapi |
| 4140 | 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 65 76 74 61 70 69 | _rs_x86_64_lib_libwinapi_wevtapi |
| 4160 | 5f 61 00 0a 64 61 77 71 73 30 30 30 32 36 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 38 36 36 20 20 | _a..dawqs00026.o/...1516160866.. |
| 4180 | 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 36 34 35 20 20 20 20 20 20 20 60 0a | 0.....0.....100666..645.......`. |
| 41a0 | 64 86 07 00 00 00 00 00 7c 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 | d.......|............text....... |
| 41c0 | 00 00 00 00 08 00 00 00 2c 01 00 00 54 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 | ........,...T.............0`.dat |
| 41e0 | 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | a............................... |
| 4200 | 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | @.0..bss........................ |
| 4220 | 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 | ..........0..idata$7............ |
| 4240 | 34 01 00 00 5e 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 | 4...^.............0..idata$5.... |
| 4260 | 00 00 00 00 08 00 00 00 38 01 00 00 68 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 | ........8...h.............0..ida |
| 4280 | 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 72 01 00 00 00 00 00 00 01 00 00 00 | ta$4............@...r........... |
| 42a0 | 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 0a 00 00 00 48 01 00 00 00 00 00 00 | ..0..idata$6............H....... |
| 42c0 | 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 | .............%.................. |
| 42e0 | 00 00 00 00 00 00 00 00 1a 00 45 76 74 4e 65 78 74 00 00 00 02 00 00 00 08 00 00 00 04 00 00 00 | ..........EvtNext............... |
| 4300 | 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 | .............................tex |
| 4320 | 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 | t..............data............. |
| 4340 | 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 | .bss...............idata$7...... |
| 4360 | 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 | .....idata$5...........idata$4.. |
| 4380 | 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 45 76 74 4e 65 78 | .........idata$6..........EvtNex |
| 43a0 | 74 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 04 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 | t............................... |
| 43c0 | 00 00 12 00 00 00 00 00 00 00 00 00 00 00 02 00 55 00 00 00 5f 5f 69 6d 70 5f 45 76 74 4e 65 78 | ................U...__imp_EvtNex |
| 43e0 | 74 00 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 | t._head_C__Users_Peter_Code_wina |
| 4400 | 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 65 76 74 61 | pi_rs_x86_64_lib_libwinapi_wevta |
| 4420 | 70 69 5f 61 00 0a 64 61 77 71 73 30 30 30 32 35 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 38 36 36 | pi_a..dawqs00025.o/...1516160866 |
| 4440 | 20 20 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 37 32 39 20 20 20 20 20 20 20 | ..0.....0.....100666..729....... |
| 4460 | 60 0a 64 86 07 00 00 00 00 00 94 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 | `.d....................text..... |
| 4480 | 00 00 00 00 00 00 08 00 00 00 2c 01 00 00 6c 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 | ..........,...l.............0`.d |
| 44a0 | 61 74 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ata............................. |
| 44c0 | 00 00 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ..@.0..bss...................... |
| 44e0 | 00 00 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 | ............0..idata$7.......... |
| 4500 | 00 00 34 01 00 00 76 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 | ..4...v.............0..idata$5.. |
| 4520 | 00 00 00 00 00 00 08 00 00 00 38 01 00 00 80 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 | ..........8.................0..i |
| 4540 | 64 61 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 8a 01 00 00 00 00 00 00 01 00 | data$4............@............. |
| 4560 | 00 00 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 24 00 00 00 48 01 00 00 00 00 | ....0..idata$6........$...H..... |
| 4580 | 00 00 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 | ...............%................ |
| 45a0 | 00 00 00 00 00 00 00 00 00 00 19 00 45 76 74 49 6e 74 57 72 69 74 65 58 6d 6c 45 76 65 6e 74 54 | ............EvtIntWriteXmlEventT |
| 45c0 | 6f 4c 6f 63 61 6c 4c 6f 67 66 69 6c 65 00 02 00 00 00 08 00 00 00 04 00 00 00 00 00 09 00 00 00 | oLocalLogfile................... |
| 45e0 | 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 | .......................text..... |
| 4600 | 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 | .........data..............bss.. |
| 4620 | 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 | .............idata$7...........i |
| 4640 | 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 00 00 | data$5...........idata$4........ |
| 4660 | 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 00 00 00 00 04 00 00 00 00 00 00 00 | ...idata$6...................... |
| 4680 | 01 00 00 00 02 00 00 00 00 00 26 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 00 00 4e 00 00 00 | ..........&.................N... |
| 46a0 | 00 00 00 00 00 00 00 00 02 00 91 00 00 00 45 76 74 49 6e 74 57 72 69 74 65 58 6d 6c 45 76 65 6e | ..............EvtIntWriteXmlEven |
| 46c0 | 74 54 6f 4c 6f 63 61 6c 4c 6f 67 66 69 6c 65 00 5f 5f 69 6d 70 5f 45 76 74 49 6e 74 57 72 69 74 | tToLocalLogfile.__imp_EvtIntWrit |
| 46e0 | 65 58 6d 6c 45 76 65 6e 74 54 6f 4c 6f 63 61 6c 4c 6f 67 66 69 6c 65 00 5f 68 65 61 64 5f 43 5f | eXmlEventToLocalLogfile._head_C_ |
| 4700 | 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f | _Users_Peter_Code_winapi_rs_x86_ |
| 4720 | 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 61 77 71 | 64_lib_libwinapi_wevtapi_a..dawq |
| 4740 | 73 30 30 30 32 34 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 38 36 36 20 20 30 20 20 20 20 20 30 20 | s00024.o/...1516160866..0.....0. |
| 4760 | 20 20 20 20 31 30 30 36 36 36 20 20 36 38 39 20 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 | ....100666..689.......`.d....... |
| 4780 | 88 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 | .............text............... |
| 47a0 | 2c 01 00 00 60 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 | ,...`.............0`.data....... |
| 47c0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 | ........................@.0..bss |
| 47e0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................................ |
| 4800 | 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 6a 01 00 00 | ..0..idata$7............4...j... |
| 4820 | 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 | ..........0..idata$5............ |
| 4840 | 38 01 00 00 74 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 | 8...t.............0..idata$4.... |
| 4860 | 00 00 00 00 08 00 00 00 40 01 00 00 7e 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 | ........@...~.............0..ida |
| 4880 | 74 61 24 36 00 00 00 00 00 00 00 00 16 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ta$6............H............... |
| 48a0 | 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | .....%.......................... |
| 48c0 | 18 00 45 76 74 49 6e 74 52 65 74 72 61 63 74 43 6f 6e 66 69 67 00 00 00 02 00 00 00 08 00 00 00 | ..EvtIntRetractConfig........... |
| 48e0 | 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 | ................................ |
| 4900 | 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 | .text..............data......... |
| 4920 | 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 | .....bss...............idata$7.. |
| 4940 | 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 | .........idata$5...........idata |
| 4960 | 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 00 00 | $4...........idata$6............ |
| 4980 | 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 18 00 00 00 00 00 00 00 05 00 00 00 | ................................ |
| 49a0 | 02 00 00 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 02 00 75 00 00 00 45 76 74 49 6e 74 52 65 | ......2.............u...EvtIntRe |
| 49c0 | 74 72 61 63 74 43 6f 6e 66 69 67 00 5f 5f 69 6d 70 5f 45 76 74 49 6e 74 52 65 74 72 61 63 74 43 | tractConfig.__imp_EvtIntRetractC |
| 49e0 | 6f 6e 66 69 67 00 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f | onfig._head_C__Users_Peter_Code_ |
| 4a00 | 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 | winapi_rs_x86_64_lib_libwinapi_w |
| 4a20 | 65 76 74 61 70 69 5f 61 00 0a 64 61 77 71 73 30 30 30 32 33 2e 6f 2f 20 20 20 31 35 31 36 31 36 | evtapi_a..dawqs00023.o/...151616 |
| 4a40 | 30 38 36 36 20 20 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 37 32 35 20 20 20 | 0866..0.....0.....100666..725... |
| 4a60 | 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 94 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 | ....`.d....................text. |
| 4a80 | 00 00 00 00 00 00 00 00 00 00 08 00 00 00 2c 01 00 00 6c 01 00 00 00 00 00 00 01 00 00 00 20 00 | ..............,...l............. |
| 4aa0 | 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | 0`.data......................... |
| 4ac0 | 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ......@.0..bss.................. |
| 4ae0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 | ................0..idata$7...... |
| 4b00 | 00 00 04 00 00 00 34 01 00 00 76 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 | ......4...v.............0..idata |
| 4b20 | 24 35 00 00 00 00 00 00 00 00 08 00 00 00 38 01 00 00 80 01 00 00 00 00 00 00 01 00 00 00 00 00 | $5............8................. |
| 4b40 | 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 8a 01 00 00 00 00 | 0..idata$4............@......... |
| 4b60 | 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 22 00 00 00 48 01 | ........0..idata$6........"...H. |
| 4b80 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 | ...................%............ |
| 4ba0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 17 00 45 76 74 49 6e 74 52 65 70 6f 72 74 45 76 65 6e | ................EvtIntReportEven |
| 4bc0 | 74 41 6e 64 53 6f 75 72 63 65 41 73 79 6e 63 00 00 00 02 00 00 00 08 00 00 00 04 00 00 00 00 00 | tAndSourceAsync................. |
| 4be0 | 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 | ...........................text. |
| 4c00 | 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 | .............data..............b |
| 4c20 | 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 00 00 | ss...............idata$7........ |
| 4c40 | 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 | ...idata$5...........idata$4.... |
| 4c60 | 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 00 00 00 00 04 00 00 00 | .......idata$6.................. |
| 4c80 | 00 00 00 00 01 00 00 00 02 00 00 00 00 00 24 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 00 00 | ..............$................. |
| 4ca0 | 4a 00 00 00 00 00 00 00 00 00 00 00 02 00 8d 00 00 00 45 76 74 49 6e 74 52 65 70 6f 72 74 45 76 | J.................EvtIntReportEv |
| 4cc0 | 65 6e 74 41 6e 64 53 6f 75 72 63 65 41 73 79 6e 63 00 5f 5f 69 6d 70 5f 45 76 74 49 6e 74 52 65 | entAndSourceAsync.__imp_EvtIntRe |
| 4ce0 | 70 6f 72 74 45 76 65 6e 74 41 6e 64 53 6f 75 72 63 65 41 73 79 6e 63 00 5f 68 65 61 64 5f 43 5f | portEventAndSourceAsync._head_C_ |
| 4d00 | 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f | _Users_Peter_Code_winapi_rs_x86_ |
| 4d20 | 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 61 77 71 | 64_lib_libwinapi_wevtapi_a..dawq |
| 4d40 | 73 30 30 30 32 32 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 38 36 36 20 20 30 20 20 20 20 20 30 20 | s00022.o/...1516160866..0.....0. |
| 4d60 | 20 20 20 20 31 30 30 36 36 36 20 20 37 33 39 20 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 | ....100666..739.......`.d....... |
| 4d80 | 98 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 | .............text............... |
| 4da0 | 2c 01 00 00 70 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 | ,...p.............0`.data....... |
| 4dc0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 | ........................@.0..bss |
| 4de0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................................ |
| 4e00 | 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 7a 01 00 00 | ..0..idata$7............4...z... |
| 4e20 | 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 | ..........0..idata$5............ |
| 4e40 | 38 01 00 00 84 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 | 8.................0..idata$4.... |
| 4e60 | 00 00 00 00 08 00 00 00 40 01 00 00 8e 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 | ........@.................0..ida |
| 4e80 | 74 61 24 36 00 00 00 00 00 00 00 00 28 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ta$6........(...H............... |
| 4ea0 | 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | .....%.......................... |
| 4ec0 | 16 00 45 76 74 49 6e 74 52 65 70 6f 72 74 41 75 74 68 7a 45 76 65 6e 74 41 6e 64 53 6f 75 72 63 | ..EvtIntReportAuthzEventAndSourc |
| 4ee0 | 65 41 73 79 6e 63 00 00 02 00 00 00 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 | eAsync.......................... |
| 4f00 | 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 | .................text........... |
| 4f20 | 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 | ...data..............bss........ |
| 4f40 | 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 | .......idata$7...........idata$5 |
| 4f60 | 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 | ...........idata$4...........ida |
| 4f80 | 74 61 24 36 00 00 00 00 07 00 00 00 03 00 00 00 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 | ta$6............................ |
| 4fa0 | 00 00 00 00 29 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 00 00 54 00 00 00 00 00 00 00 00 00 | ....).................T......... |
| 4fc0 | 00 00 02 00 97 00 00 00 45 76 74 49 6e 74 52 65 70 6f 72 74 41 75 74 68 7a 45 76 65 6e 74 41 6e | ........EvtIntReportAuthzEventAn |
| 4fe0 | 64 53 6f 75 72 63 65 41 73 79 6e 63 00 5f 5f 69 6d 70 5f 45 76 74 49 6e 74 52 65 70 6f 72 74 41 | dSourceAsync.__imp_EvtIntReportA |
| 5000 | 75 74 68 7a 45 76 65 6e 74 41 6e 64 53 6f 75 72 63 65 41 73 79 6e 63 00 5f 68 65 61 64 5f 43 5f | uthzEventAndSourceAsync._head_C_ |
| 5020 | 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f | _Users_Peter_Code_winapi_rs_x86_ |
| 5040 | 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 61 77 71 | 64_lib_libwinapi_wevtapi_a..dawq |
| 5060 | 73 30 30 30 32 31 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 38 36 36 20 20 30 20 20 20 20 20 30 20 | s00021.o/...1516160866..0.....0. |
| 5080 | 20 20 20 20 31 30 30 36 36 36 20 20 37 32 39 20 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 | ....100666..729.......`.d....... |
| 50a0 | 94 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 | .............text............... |
| 50c0 | 2c 01 00 00 6c 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 | ,...l.............0`.data....... |
| 50e0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 | ........................@.0..bss |
| 5100 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................................ |
| 5120 | 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 76 01 00 00 | ..0..idata$7............4...v... |
| 5140 | 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 | ..........0..idata$5............ |
| 5160 | 38 01 00 00 80 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 | 8.................0..idata$4.... |
| 5180 | 00 00 00 00 08 00 00 00 40 01 00 00 8a 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 | ........@.................0..ida |
| 51a0 | 74 61 24 36 00 00 00 00 00 00 00 00 24 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ta$6........$...H............... |
| 51c0 | 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | .....%.......................... |
| 51e0 | 15 00 45 76 74 49 6e 74 52 65 6e 64 65 72 52 65 73 6f 75 72 63 65 45 76 65 6e 74 54 65 6d 70 6c | ..EvtIntRenderResourceEventTempl |
| 5200 | 61 74 65 00 02 00 00 00 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 | ate............................. |
| 5220 | 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 | .............text..............d |
| 5240 | 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 | ata..............bss............ |
| 5260 | 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 | ...idata$7...........idata$5.... |
| 5280 | 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 | .......idata$4...........idata$6 |
| 52a0 | 00 00 00 00 07 00 00 00 03 00 00 00 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 | ................................ |
| 52c0 | 26 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 00 00 4e 00 00 00 00 00 00 00 00 00 00 00 02 00 | &.................N............. |
| 52e0 | 91 00 00 00 45 76 74 49 6e 74 52 65 6e 64 65 72 52 65 73 6f 75 72 63 65 45 76 65 6e 74 54 65 6d | ....EvtIntRenderResourceEventTem |
| 5300 | 70 6c 61 74 65 00 5f 5f 69 6d 70 5f 45 76 74 49 6e 74 52 65 6e 64 65 72 52 65 73 6f 75 72 63 65 | plate.__imp_EvtIntRenderResource |
| 5320 | 45 76 65 6e 74 54 65 6d 70 6c 61 74 65 00 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 | EventTemplate._head_C__Users_Pet |
| 5340 | 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 | er_Code_winapi_rs_x86_64_lib_lib |
| 5360 | 77 69 6e 61 70 69 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 61 77 71 73 30 30 30 32 30 2e 6f 2f 20 | winapi_wevtapi_a..dawqs00020.o/. |
| 5380 | 20 20 31 35 31 36 31 36 30 38 36 36 20 20 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 | ..1516160866..0.....0.....100666 |
| 53a0 | 20 20 37 32 33 20 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 94 01 00 00 0a 00 00 00 00 00 | ..723.......`.d................. |
| 53c0 | 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 2c 01 00 00 6c 01 00 00 00 00 | ...text...............,...l..... |
| 53e0 | 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ........0`.data................. |
| 5400 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 | ..............@.0..bss.......... |
| 5420 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 | ........................0..idata |
| 5440 | 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 76 01 00 00 00 00 00 00 01 00 00 00 00 00 | $7............4...v............. |
| 5460 | 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 38 01 00 00 80 01 00 00 00 00 | 0..idata$5............8......... |
| 5480 | 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 | ........0..idata$4............@. |
| 54a0 | 00 00 8a 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 | ................0..idata$6...... |
| 54c0 | 00 00 22 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 | .."...H....................%.... |
| 54e0 | 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 14 00 45 76 74 49 6e 74 47 65 | ........................EvtIntGe |
| 5500 | 74 43 6c 61 73 73 69 63 4c 6f 67 44 69 73 70 6c 61 79 4e 61 6d 65 00 00 00 00 02 00 00 00 08 00 | tClassicLogDisplayName.......... |
| 5520 | 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 | ................................ |
| 5540 | 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 | ...text..............data....... |
| 5560 | 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 | .......bss...............idata$7 |
| 5580 | 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 | ...........idata$5...........ida |
| 55a0 | 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 | ta$4...........idata$6.......... |
| 55c0 | 00 00 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 23 00 00 00 00 00 00 00 05 00 | ......................#......... |
| 55e0 | 00 00 02 00 00 00 00 00 48 00 00 00 00 00 00 00 00 00 00 00 02 00 8b 00 00 00 45 76 74 49 6e 74 | ........H.................EvtInt |
| 5600 | 47 65 74 43 6c 61 73 73 69 63 4c 6f 67 44 69 73 70 6c 61 79 4e 61 6d 65 00 5f 5f 69 6d 70 5f 45 | GetClassicLogDisplayName.__imp_E |
| 5620 | 76 74 49 6e 74 47 65 74 43 6c 61 73 73 69 63 4c 6f 67 44 69 73 70 6c 61 79 4e 61 6d 65 00 5f 68 | vtIntGetClassicLogDisplayName._h |
| 5640 | 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 | ead_C__Users_Peter_Code_winapi_r |
| 5660 | 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 65 76 74 61 70 69 5f 61 | s_x86_64_lib_libwinapi_wevtapi_a |
| 5680 | 00 0a 64 61 77 71 73 30 30 30 31 39 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 38 36 36 20 20 30 20 | ..dawqs00019.o/...1516160866..0. |
| 56a0 | 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 37 30 33 20 20 20 20 20 20 20 60 0a 64 86 | ....0.....100666..703.......`.d. |
| 56c0 | 07 00 00 00 00 00 8c 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 | ...................text......... |
| 56e0 | 00 00 08 00 00 00 2c 01 00 00 64 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 | ......,...d.............0`.data. |
| 5700 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 | ..............................@. |
| 5720 | 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | 0..bss.......................... |
| 5740 | 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 | ........0..idata$7............4. |
| 5760 | 00 00 6e 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 | ..n.............0..idata$5...... |
| 5780 | 00 00 08 00 00 00 38 01 00 00 78 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 | ......8...x.............0..idata |
| 57a0 | 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 82 01 00 00 00 00 00 00 01 00 00 00 00 00 | $4............@................. |
| 57c0 | 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 1c 00 00 00 48 01 00 00 00 00 00 00 00 00 | 0..idata$6............H......... |
| 57e0 | 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ...........%.................... |
| 5800 | 00 00 00 00 00 00 13 00 45 76 74 49 6e 74 43 72 65 61 74 65 4c 6f 63 61 6c 4c 6f 67 66 69 6c 65 | ........EvtIntCreateLocalLogfile |
| 5820 | 00 00 02 00 00 00 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 | ................................ |
| 5840 | 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 | ...........text..............dat |
| 5860 | 61 00 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 | a..............bss.............. |
| 5880 | 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 | .idata$7...........idata$5...... |
| 58a0 | 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 | .....idata$4...........idata$6.. |
| 58c0 | 00 00 07 00 00 00 03 00 00 00 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 1d 00 | ................................ |
| 58e0 | 00 00 00 00 00 00 05 00 00 00 02 00 00 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 02 00 7f 00 | ................<............... |
| 5900 | 00 00 45 76 74 49 6e 74 43 72 65 61 74 65 4c 6f 63 61 6c 4c 6f 67 66 69 6c 65 00 5f 5f 69 6d 70 | ..EvtIntCreateLocalLogfile.__imp |
| 5920 | 5f 45 76 74 49 6e 74 43 72 65 61 74 65 4c 6f 63 61 6c 4c 6f 67 66 69 6c 65 00 5f 68 65 61 64 5f | _EvtIntCreateLocalLogfile._head_ |
| 5940 | 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 | C__Users_Peter_Code_winapi_rs_x8 |
| 5960 | 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 61 | 6_64_lib_libwinapi_wevtapi_a..da |
| 5980 | 77 71 73 30 30 30 31 38 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 38 36 36 20 20 30 20 20 20 20 20 | wqs00018.o/...1516160866..0..... |
| 59a0 | 30 20 20 20 20 20 31 30 30 36 36 36 20 20 37 32 35 20 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 | 0.....100666..725.......`.d..... |
| 59c0 | 00 00 94 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 08 00 | ...............text............. |
| 59e0 | 00 00 2c 01 00 00 6c 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 | ..,...l.............0`.data..... |
| 5a00 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 | ..........................@.0..b |
| 5a20 | 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ss.............................. |
| 5a40 | 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 76 01 | ....0..idata$7............4...v. |
| 5a60 | 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 08 00 | ............0..idata$5.......... |
| 5a80 | 00 00 38 01 00 00 80 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 | ..8.................0..idata$4.. |
| 5aa0 | 00 00 00 00 00 00 08 00 00 00 40 01 00 00 8a 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 | ..........@.................0..i |
| 5ac0 | 64 61 74 61 24 36 00 00 00 00 00 00 00 00 22 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 | data$6........"...H............. |
| 5ae0 | 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | .......%........................ |
| 5b00 | 00 00 12 00 45 76 74 49 6e 74 43 72 65 61 74 65 42 69 6e 58 4d 4c 46 72 6f 6d 43 75 73 74 6f 6d | ....EvtIntCreateBinXMLFromCustom |
| 5b20 | 58 4d 4c 00 00 00 02 00 00 00 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 | XML............................. |
| 5b40 | 00 00 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 | ...............text............. |
| 5b60 | 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 | .data..............bss.......... |
| 5b80 | 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 | .....idata$7...........idata$5.. |
| 5ba0 | 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 | .........idata$4...........idata |
| 5bc0 | 24 36 00 00 00 00 07 00 00 00 03 00 00 00 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 | $6.............................. |
| 5be0 | 00 00 24 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 00 00 4a 00 00 00 00 00 00 00 00 00 00 00 | ..$.................J........... |
| 5c00 | 02 00 8d 00 00 00 45 76 74 49 6e 74 43 72 65 61 74 65 42 69 6e 58 4d 4c 46 72 6f 6d 43 75 73 74 | ......EvtIntCreateBinXMLFromCust |
| 5c20 | 6f 6d 58 4d 4c 00 5f 5f 69 6d 70 5f 45 76 74 49 6e 74 43 72 65 61 74 65 42 69 6e 58 4d 4c 46 72 | omXML.__imp_EvtIntCreateBinXMLFr |
| 5c40 | 6f 6d 43 75 73 74 6f 6d 58 4d 4c 00 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 | omCustomXML._head_C__Users_Peter |
| 5c60 | 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 | _Code_winapi_rs_x86_64_lib_libwi |
| 5c80 | 6e 61 70 69 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 61 77 71 73 30 30 30 31 37 2e 6f 2f 20 20 20 | napi_wevtapi_a..dawqs00017.o/... |
| 5ca0 | 31 35 31 36 31 36 30 38 36 36 20 20 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 | 1516160866..0.....0.....100666.. |
| 5cc0 | 36 38 37 20 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 88 01 00 00 0a 00 00 00 00 00 04 00 | 687.......`.d................... |
| 5ce0 | 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 2c 01 00 00 60 01 00 00 00 00 00 00 | .text...............,...`....... |
| 5d00 | 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ......0`.data................... |
| 5d20 | 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 | ............@.0..bss............ |
| 5d40 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 | ......................0..idata$7 |
| 5d60 | 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 6a 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 | ............4...j.............0. |
| 5d80 | 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 38 01 00 00 74 01 00 00 00 00 00 00 | .idata$5............8...t....... |
| 5da0 | 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 | ......0..idata$4............@... |
| 5dc0 | 7e 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 | ~.............0..idata$6........ |
| 5de0 | 16 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 | ....H....................%...... |
| 5e00 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 00 45 76 74 49 6e 74 41 73 73 65 | ......................EvtIntAsse |
| 5e20 | 72 74 43 6f 6e 66 69 67 00 00 00 00 02 00 00 00 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 | rtConfig........................ |
| 5e40 | 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 | .....................text....... |
| 5e60 | 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 | .......data..............bss.... |
| 5e80 | 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 | ...........idata$7...........ida |
| 5ea0 | 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 | ta$5...........idata$4.......... |
| 5ec0 | 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 00 00 00 00 04 00 00 00 00 00 00 00 01 00 | .idata$6........................ |
| 5ee0 | 00 00 02 00 00 00 00 00 17 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 00 00 30 00 00 00 00 00 | ..........................0..... |
| 5f00 | 00 00 00 00 00 00 02 00 73 00 00 00 45 76 74 49 6e 74 41 73 73 65 72 74 43 6f 6e 66 69 67 00 5f | ........s...EvtIntAssertConfig._ |
| 5f20 | 5f 69 6d 70 5f 45 76 74 49 6e 74 41 73 73 65 72 74 43 6f 6e 66 69 67 00 5f 68 65 61 64 5f 43 5f | _imp_EvtIntAssertConfig._head_C_ |
| 5f40 | 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f | _Users_Peter_Code_winapi_rs_x86_ |
| 5f60 | 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 61 77 71 | 64_lib_libwinapi_wevtapi_a..dawq |
| 5f80 | 73 30 30 30 31 36 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 38 36 36 20 20 30 20 20 20 20 20 30 20 | s00016.o/...1516160866..0.....0. |
| 5fa0 | 20 20 20 20 31 30 30 36 36 36 20 20 36 37 37 20 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 | ....100666..677.......`.d....... |
| 5fc0 | 84 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 | .............text............... |
| 5fe0 | 2c 01 00 00 5c 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 | ,...\.............0`.data....... |
| 6000 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 | ........................@.0..bss |
| 6020 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................................ |
| 6040 | 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 66 01 00 00 | ..0..idata$7............4...f... |
| 6060 | 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 | ..........0..idata$5............ |
| 6080 | 38 01 00 00 70 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 | 8...p.............0..idata$4.... |
| 60a0 | 00 00 00 00 08 00 00 00 40 01 00 00 7a 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 | ........@...z.............0..ida |
| 60c0 | 74 61 24 36 00 00 00 00 00 00 00 00 12 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ta$6............H............... |
| 60e0 | 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | .....%.......................... |
| 6100 | 10 00 45 76 74 47 65 74 51 75 65 72 79 49 6e 66 6f 00 00 00 02 00 00 00 08 00 00 00 04 00 00 00 | ..EvtGetQueryInfo............... |
| 6120 | 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 | .............................tex |
| 6140 | 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 | t..............data............. |
| 6160 | 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 | .bss...............idata$7...... |
| 6180 | 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 | .....idata$5...........idata$4.. |
| 61a0 | 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 00 00 00 00 04 00 | .........idata$6................ |
| 61c0 | 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 14 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 | ................................ |
| 61e0 | 00 00 2a 00 00 00 00 00 00 00 00 00 00 00 02 00 6d 00 00 00 45 76 74 47 65 74 51 75 65 72 79 49 | ..*.............m...EvtGetQueryI |
| 6200 | 6e 66 6f 00 5f 5f 69 6d 70 5f 45 76 74 47 65 74 51 75 65 72 79 49 6e 66 6f 00 5f 68 65 61 64 5f | nfo.__imp_EvtGetQueryInfo._head_ |
| 6220 | 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 | C__Users_Peter_Code_winapi_rs_x8 |
| 6240 | 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 61 | 6_64_lib_libwinapi_wevtapi_a..da |
| 6260 | 77 71 73 30 30 30 31 35 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 38 36 36 20 20 30 20 20 20 20 20 | wqs00015.o/...1516160866..0..... |
| 6280 | 30 20 20 20 20 20 31 30 30 36 36 36 20 20 37 32 35 20 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 | 0.....100666..725.......`.d..... |
| 62a0 | 00 00 94 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 08 00 | ...............text............. |
| 62c0 | 00 00 2c 01 00 00 6c 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 | ..,...l.............0`.data..... |
| 62e0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 | ..........................@.0..b |
| 6300 | 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ss.............................. |
| 6320 | 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 76 01 | ....0..idata$7............4...v. |
| 6340 | 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 08 00 | ............0..idata$5.......... |
| 6360 | 00 00 38 01 00 00 80 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 | ..8.................0..idata$4.. |
| 6380 | 00 00 00 00 00 00 08 00 00 00 40 01 00 00 8a 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 | ..........@.................0..i |
| 63a0 | 64 61 74 61 24 36 00 00 00 00 00 00 00 00 22 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 | data$6........"...H............. |
| 63c0 | 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | .......%........................ |
| 63e0 | 00 00 0f 00 45 76 74 47 65 74 50 75 62 6c 69 73 68 65 72 4d 65 74 61 64 61 74 61 50 72 6f 70 65 | ....EvtGetPublisherMetadataPrope |
| 6400 | 72 74 79 00 00 00 02 00 00 00 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 | rty............................. |
| 6420 | 00 00 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 | ...............text............. |
| 6440 | 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 | .data..............bss.......... |
| 6460 | 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 | .....idata$7...........idata$5.. |
| 6480 | 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 | .........idata$4...........idata |
| 64a0 | 24 36 00 00 00 00 07 00 00 00 03 00 00 00 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 | $6.............................. |
| 64c0 | 00 00 24 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 00 00 4a 00 00 00 00 00 00 00 00 00 00 00 | ..$.................J........... |
| 64e0 | 02 00 8d 00 00 00 45 76 74 47 65 74 50 75 62 6c 69 73 68 65 72 4d 65 74 61 64 61 74 61 50 72 6f | ......EvtGetPublisherMetadataPro |
| 6500 | 70 65 72 74 79 00 5f 5f 69 6d 70 5f 45 76 74 47 65 74 50 75 62 6c 69 73 68 65 72 4d 65 74 61 64 | perty.__imp_EvtGetPublisherMetad |
| 6520 | 61 74 61 50 72 6f 70 65 72 74 79 00 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 | ataProperty._head_C__Users_Peter |
| 6540 | 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 | _Code_winapi_rs_x86_64_lib_libwi |
| 6560 | 6e 61 70 69 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 61 77 71 73 30 30 30 31 34 2e 6f 2f 20 20 20 | napi_wevtapi_a..dawqs00014.o/... |
| 6580 | 31 35 31 36 31 36 30 38 36 36 20 20 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 | 1516160866..0.....0.....100666.. |
| 65a0 | 36 39 33 20 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 88 01 00 00 0a 00 00 00 00 00 04 00 | 693.......`.d................... |
| 65c0 | 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 2c 01 00 00 60 01 00 00 00 00 00 00 | .text...............,...`....... |
| 65e0 | 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ......0`.data................... |
| 6600 | 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 | ............@.0..bss............ |
| 6620 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 | ......................0..idata$7 |
| 6640 | 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 6a 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 | ............4...j.............0. |
| 6660 | 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 38 01 00 00 74 01 00 00 00 00 00 00 | .idata$5............8...t....... |
| 6680 | 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 | ......0..idata$4............@... |
| 66a0 | 7e 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 | ~.............0..idata$6........ |
| 66c0 | 18 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 | ....H....................%...... |
| 66e0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0e 00 45 76 74 47 65 74 4f 62 6a 65 | ......................EvtGetObje |
| 6700 | 63 74 41 72 72 61 79 53 69 7a 65 00 02 00 00 00 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 | ctArraySize..................... |
| 6720 | 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 | .....................text....... |
| 6740 | 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 | .......data..............bss.... |
| 6760 | 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 | ...........idata$7...........ida |
| 6780 | 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 | ta$5...........idata$4.......... |
| 67a0 | 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 00 00 00 00 04 00 00 00 00 00 00 00 01 00 | .idata$6........................ |
| 67c0 | 00 00 02 00 00 00 00 00 1a 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 00 00 36 00 00 00 00 00 | ..........................6..... |
| 67e0 | 00 00 00 00 00 00 02 00 79 00 00 00 45 76 74 47 65 74 4f 62 6a 65 63 74 41 72 72 61 79 53 69 7a | ........y...EvtGetObjectArraySiz |
| 6800 | 65 00 5f 5f 69 6d 70 5f 45 76 74 47 65 74 4f 62 6a 65 63 74 41 72 72 61 79 53 69 7a 65 00 5f 68 | e.__imp_EvtGetObjectArraySize._h |
| 6820 | 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 | ead_C__Users_Peter_Code_winapi_r |
| 6840 | 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 65 76 74 61 70 69 5f 61 | s_x86_64_lib_libwinapi_wevtapi_a |
| 6860 | 00 0a 64 61 77 71 73 30 30 30 31 33 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 38 36 36 20 20 30 20 | ..dawqs00013.o/...1516160866..0. |
| 6880 | 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 37 30 35 20 20 20 20 20 20 20 60 0a 64 86 | ....0.....100666..705.......`.d. |
| 68a0 | 07 00 00 00 00 00 8c 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 | ...................text......... |
| 68c0 | 00 00 08 00 00 00 2c 01 00 00 64 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 | ......,...d.............0`.data. |
| 68e0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 | ..............................@. |
| 6900 | 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | 0..bss.......................... |
| 6920 | 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 | ........0..idata$7............4. |
| 6940 | 00 00 6e 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 | ..n.............0..idata$5...... |
| 6960 | 00 00 08 00 00 00 38 01 00 00 78 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 | ......8...x.............0..idata |
| 6980 | 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 82 01 00 00 00 00 00 00 01 00 00 00 00 00 | $4............@................. |
| 69a0 | 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 1c 00 00 00 48 01 00 00 00 00 00 00 00 00 | 0..idata$6............H......... |
| 69c0 | 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ...........%.................... |
| 69e0 | 00 00 00 00 00 00 0d 00 45 76 74 47 65 74 4f 62 6a 65 63 74 41 72 72 61 79 50 72 6f 70 65 72 74 | ........EvtGetObjectArrayPropert |
| 6a00 | 79 00 02 00 00 00 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 | y............................... |
| 6a20 | 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 | ...........text..............dat |
| 6a40 | 61 00 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 | a..............bss.............. |
| 6a60 | 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 | .idata$7...........idata$5...... |
| 6a80 | 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 | .....idata$4...........idata$6.. |
| 6aa0 | 00 00 07 00 00 00 03 00 00 00 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 1e 00 | ................................ |
| 6ac0 | 00 00 00 00 00 00 05 00 00 00 02 00 00 00 00 00 3e 00 00 00 00 00 00 00 00 00 00 00 02 00 81 00 | ................>............... |
| 6ae0 | 00 00 45 76 74 47 65 74 4f 62 6a 65 63 74 41 72 72 61 79 50 72 6f 70 65 72 74 79 00 5f 5f 69 6d | ..EvtGetObjectArrayProperty.__im |
| 6b00 | 70 5f 45 76 74 47 65 74 4f 62 6a 65 63 74 41 72 72 61 79 50 72 6f 70 65 72 74 79 00 5f 68 65 61 | p_EvtGetObjectArrayProperty._hea |
| 6b20 | 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f | d_C__Users_Peter_Code_winapi_rs_ |
| 6b40 | 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 65 76 74 61 70 69 5f 61 00 0a | x86_64_lib_libwinapi_wevtapi_a.. |
| 6b60 | 64 61 77 71 73 30 30 30 31 32 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 38 36 36 20 20 30 20 20 20 | dawqs00012.o/...1516160866..0... |
| 6b80 | 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 36 36 39 20 20 20 20 20 20 20 60 0a 64 86 07 00 | ..0.....100666..669.......`.d... |
| 6ba0 | 00 00 00 00 80 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 | .................text........... |
| 6bc0 | 08 00 00 00 2c 01 00 00 58 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 | ....,...X.............0`.data... |
| 6be0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 | ............................@.0. |
| 6c00 | 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | .bss............................ |
| 6c20 | 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 | ......0..idata$7............4... |
| 6c40 | 62 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 | b.............0..idata$5........ |
| 6c60 | 08 00 00 00 38 01 00 00 6c 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 | ....8...l.............0..idata$4 |
| 6c80 | 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 76 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 | ............@...v.............0. |
| 6ca0 | 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 10 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 | .idata$6............H........... |
| 6cc0 | 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | .........%...................... |
| 6ce0 | 00 00 00 00 0c 00 45 76 74 47 65 74 4c 6f 67 49 6e 66 6f 00 02 00 00 00 08 00 00 00 04 00 00 00 | ......EvtGetLogInfo............. |
| 6d00 | 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 | .............................tex |
| 6d20 | 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 | t..............data............. |
| 6d40 | 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 | .bss...............idata$7...... |
| 6d60 | 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 | .....idata$5...........idata$4.. |
| 6d80 | 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 00 00 00 00 04 00 | .........idata$6................ |
| 6da0 | 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 12 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 | ................................ |
| 6dc0 | 00 00 26 00 00 00 00 00 00 00 00 00 00 00 02 00 69 00 00 00 45 76 74 47 65 74 4c 6f 67 49 6e 66 | ..&.............i...EvtGetLogInf |
| 6de0 | 6f 00 5f 5f 69 6d 70 5f 45 76 74 47 65 74 4c 6f 67 49 6e 66 6f 00 5f 68 65 61 64 5f 43 5f 5f 55 | o.__imp_EvtGetLogInfo._head_C__U |
| 6e00 | 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 | sers_Peter_Code_winapi_rs_x86_64 |
| 6e20 | 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 61 77 71 73 30 | _lib_libwinapi_wevtapi_a..dawqs0 |
| 6e40 | 30 30 31 31 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 38 36 36 20 20 30 20 20 20 20 20 30 20 20 20 | 0011.o/...1516160866..0.....0... |
| 6e60 | 20 20 31 30 30 36 36 36 20 20 36 39 31 20 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 88 01 | ..100666..691.......`.d......... |
| 6e80 | 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 2c 01 | ...........text...............,. |
| 6ea0 | 00 00 60 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 | ..`.............0`.data......... |
| 6ec0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 00 00 | ......................@.0..bss.. |
| 6ee0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 | ................................ |
| 6f00 | 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 6a 01 00 00 00 00 | 0..idata$7............4...j..... |
| 6f20 | 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 38 01 | ........0..idata$5............8. |
| 6f40 | 00 00 74 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 00 00 | ..t.............0..idata$4...... |
| 6f60 | 00 00 08 00 00 00 40 01 00 00 7e 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 | ......@...~.............0..idata |
| 6f80 | 24 36 00 00 00 00 00 00 00 00 18 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | $6............H................. |
| 6fa0 | 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0b 00 | ...%............................ |
| 6fc0 | 45 76 74 47 65 74 45 78 74 65 6e 64 65 64 53 74 61 74 75 73 00 00 02 00 00 00 08 00 00 00 04 00 | EvtGetExtendedStatus............ |
| 6fe0 | 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 | ...............................t |
| 7000 | 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 00 00 | ext..............data........... |
| 7020 | 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 | ...bss...............idata$7.... |
| 7040 | 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 | .......idata$5...........idata$4 |
| 7060 | 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 00 00 00 00 | ...........idata$6.............. |
| 7080 | 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 19 00 00 00 00 00 00 00 05 00 00 00 02 00 | ................................ |
| 70a0 | 00 00 00 00 34 00 00 00 00 00 00 00 00 00 00 00 02 00 77 00 00 00 45 76 74 47 65 74 45 78 74 65 | ....4.............w...EvtGetExte |
| 70c0 | 6e 64 65 64 53 74 61 74 75 73 00 5f 5f 69 6d 70 5f 45 76 74 47 65 74 45 78 74 65 6e 64 65 64 53 | ndedStatus.__imp_EvtGetExtendedS |
| 70e0 | 74 61 74 75 73 00 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f | tatus._head_C__Users_Peter_Code_ |
| 7100 | 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 | winapi_rs_x86_64_lib_libwinapi_w |
| 7120 | 65 76 74 61 70 69 5f 61 00 0a 64 61 77 71 73 30 30 30 31 30 2e 6f 2f 20 20 20 31 35 31 36 31 36 | evtapi_a..dawqs00010.o/...151616 |
| 7140 | 30 38 36 36 20 20 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 37 31 33 20 20 20 | 0866..0.....0.....100666..713... |
| 7160 | 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 90 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 | ....`.d....................text. |
| 7180 | 00 00 00 00 00 00 00 00 00 00 08 00 00 00 2c 01 00 00 68 01 00 00 00 00 00 00 01 00 00 00 20 00 | ..............,...h............. |
| 71a0 | 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | 0`.data......................... |
| 71c0 | 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ......@.0..bss.................. |
| 71e0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 | ................0..idata$7...... |
| 7200 | 00 00 04 00 00 00 34 01 00 00 72 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 | ......4...r.............0..idata |
| 7220 | 24 35 00 00 00 00 00 00 00 00 08 00 00 00 38 01 00 00 7c 01 00 00 00 00 00 00 01 00 00 00 00 00 | $5............8...|............. |
| 7240 | 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 86 01 00 00 00 00 | 0..idata$4............@......... |
| 7260 | 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 1e 00 00 00 48 01 | ........0..idata$6............H. |
| 7280 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 | ...................%............ |
| 72a0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0a 00 45 76 74 47 65 74 45 76 65 6e 74 4d 65 74 61 64 | ................EvtGetEventMetad |
| 72c0 | 61 74 61 50 72 6f 70 65 72 74 79 00 00 00 02 00 00 00 08 00 00 00 04 00 00 00 00 00 09 00 00 00 | ataProperty..................... |
| 72e0 | 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 | .......................text..... |
| 7300 | 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 | .........data..............bss.. |
| 7320 | 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 | .............idata$7...........i |
| 7340 | 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 00 00 | data$5...........idata$4........ |
| 7360 | 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 00 00 00 00 04 00 00 00 00 00 00 00 | ...idata$6...................... |
| 7380 | 01 00 00 00 02 00 00 00 00 00 20 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 00 00 42 00 00 00 | ............................B... |
| 73a0 | 00 00 00 00 00 00 00 00 02 00 85 00 00 00 45 76 74 47 65 74 45 76 65 6e 74 4d 65 74 61 64 61 74 | ..............EvtGetEventMetadat |
| 73c0 | 61 50 72 6f 70 65 72 74 79 00 5f 5f 69 6d 70 5f 45 76 74 47 65 74 45 76 65 6e 74 4d 65 74 61 64 | aProperty.__imp_EvtGetEventMetad |
| 73e0 | 61 74 61 50 72 6f 70 65 72 74 79 00 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 | ataProperty._head_C__Users_Peter |
| 7400 | 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 | _Code_winapi_rs_x86_64_lib_libwi |
| 7420 | 6e 61 70 69 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 61 77 71 73 30 30 30 30 39 2e 6f 2f 20 20 20 | napi_wevtapi_a..dawqs00009.o/... |
| 7440 | 31 35 31 36 31 36 30 38 36 36 20 20 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 | 1516160866..0.....0.....100666.. |
| 7460 | 36 37 37 20 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 84 01 00 00 0a 00 00 00 00 00 04 00 | 677.......`.d................... |
| 7480 | 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 2c 01 00 00 5c 01 00 00 00 00 00 00 | .text...............,...\....... |
| 74a0 | 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ......0`.data................... |
| 74c0 | 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 | ............@.0..bss............ |
| 74e0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 | ......................0..idata$7 |
| 7500 | 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 66 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 | ............4...f.............0. |
| 7520 | 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 38 01 00 00 70 01 00 00 00 00 00 00 | .idata$5............8...p....... |
| 7540 | 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 | ......0..idata$4............@... |
| 7560 | 7a 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 | z.............0..idata$6........ |
| 7580 | 12 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 | ....H....................%...... |
| 75a0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 09 00 45 76 74 47 65 74 45 76 65 6e | ......................EvtGetEven |
| 75c0 | 74 49 6e 66 6f 00 00 00 02 00 00 00 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 | tInfo........................... |
| 75e0 | 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 | .................text........... |
| 7600 | 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 | ...data..............bss........ |
| 7620 | 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 | .......idata$7...........idata$5 |
| 7640 | 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 | ...........idata$4...........ida |
| 7660 | 74 61 24 36 00 00 00 00 07 00 00 00 03 00 00 00 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 | ta$6............................ |
| 7680 | 00 00 00 00 14 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 00 00 2a 00 00 00 00 00 00 00 00 00 | ......................*......... |
| 76a0 | 00 00 02 00 6d 00 00 00 45 76 74 47 65 74 45 76 65 6e 74 49 6e 66 6f 00 5f 5f 69 6d 70 5f 45 76 | ....m...EvtGetEventInfo.__imp_Ev |
| 76c0 | 74 47 65 74 45 76 65 6e 74 49 6e 66 6f 00 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 | tGetEventInfo._head_C__Users_Pet |
| 76e0 | 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 | er_Code_winapi_rs_x86_64_lib_lib |
| 7700 | 77 69 6e 61 70 69 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 61 77 71 73 30 30 30 30 38 2e 6f 2f 20 | winapi_wevtapi_a..dawqs00008.o/. |
| 7720 | 20 20 31 35 31 36 31 36 30 38 36 36 20 20 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 | ..1516160866..0.....0.....100666 |
| 7740 | 20 20 37 31 33 20 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 90 01 00 00 0a 00 00 00 00 00 | ..713.......`.d................. |
| 7760 | 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 2c 01 00 00 68 01 00 00 00 00 | ...text...............,...h..... |
| 7780 | 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ........0`.data................. |
| 77a0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 | ..............@.0..bss.......... |
| 77c0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 | ........................0..idata |
| 77e0 | 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 72 01 00 00 00 00 00 00 01 00 00 00 00 00 | $7............4...r............. |
| 7800 | 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 38 01 00 00 7c 01 00 00 00 00 | 0..idata$5............8...|..... |
| 7820 | 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 | ........0..idata$4............@. |
| 7840 | 00 00 86 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 | ................0..idata$6...... |
| 7860 | 00 00 1e 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 | ......H....................%.... |
| 7880 | 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 45 76 74 47 65 74 43 68 | ........................EvtGetCh |
| 78a0 | 61 6e 6e 65 6c 43 6f 6e 66 69 67 50 72 6f 70 65 72 74 79 00 00 00 02 00 00 00 08 00 00 00 04 00 | annelConfigProperty............. |
| 78c0 | 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 | ...............................t |
| 78e0 | 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 00 00 | ext..............data........... |
| 7900 | 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 | ...bss...............idata$7.... |
| 7920 | 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 | .......idata$5...........idata$4 |
| 7940 | 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 00 00 00 00 | ...........idata$6.............. |
| 7960 | 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 20 00 00 00 00 00 00 00 05 00 00 00 02 00 | ................................ |
| 7980 | 00 00 00 00 42 00 00 00 00 00 00 00 00 00 00 00 02 00 85 00 00 00 45 76 74 47 65 74 43 68 61 6e | ....B.................EvtGetChan |
| 79a0 | 6e 65 6c 43 6f 6e 66 69 67 50 72 6f 70 65 72 74 79 00 5f 5f 69 6d 70 5f 45 76 74 47 65 74 43 68 | nelConfigProperty.__imp_EvtGetCh |
| 79c0 | 61 6e 6e 65 6c 43 6f 6e 66 69 67 50 72 6f 70 65 72 74 79 00 5f 68 65 61 64 5f 43 5f 5f 55 73 65 | annelConfigProperty._head_C__Use |
| 79e0 | 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c | rs_Peter_Code_winapi_rs_x86_64_l |
| 7a00 | 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 61 77 71 73 30 30 30 | ib_libwinapi_wevtapi_a..dawqs000 |
| 7a20 | 30 37 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 38 36 36 20 20 30 20 20 20 20 20 30 20 20 20 20 20 | 07.o/...1516160866..0.....0..... |
| 7a40 | 31 30 30 36 36 36 20 20 36 37 39 20 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 84 01 00 00 | 100666..679.......`.d........... |
| 7a60 | 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 2c 01 00 00 | .........text...............,... |
| 7a80 | 5c 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 00 00 | \.............0`.data........... |
| 7aa0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 00 00 00 00 | ....................@.0..bss.... |
| 7ac0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 30 c0 | ..............................0. |
| 7ae0 | 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 66 01 00 00 00 00 00 00 | .idata$7............4...f....... |
| 7b00 | 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 38 01 00 00 | ......0..idata$5............8... |
| 7b20 | 70 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 00 00 00 00 | p.............0..idata$4........ |
| 7b40 | 08 00 00 00 40 01 00 00 7a 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 36 | ....@...z.............0..idata$6 |
| 7b60 | 00 00 00 00 00 00 00 00 14 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 c0 | ............H................... |
| 7b80 | ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 00 45 76 | .%............................Ev |
| 7ba0 | 74 46 6f 72 6d 61 74 4d 65 73 73 61 67 65 00 00 02 00 00 00 08 00 00 00 04 00 00 00 00 00 09 00 | tFormatMessage.................. |
| 7bc0 | 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 | .........................text... |
| 7be0 | 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 73 73 | ...........data..............bss |
| 7c00 | 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 00 00 03 00 | ...............idata$7.......... |
| 7c20 | 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 | .idata$5...........idata$4...... |
| 7c40 | 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 00 00 00 00 04 00 00 00 00 00 | .....idata$6.................... |
| 7c60 | 00 00 01 00 00 00 02 00 00 00 00 00 15 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 00 00 2c 00 | ..............................,. |
| 7c80 | 00 00 00 00 00 00 00 00 00 00 02 00 6f 00 00 00 45 76 74 46 6f 72 6d 61 74 4d 65 73 73 61 67 65 | ............o...EvtFormatMessage |
| 7ca0 | 00 5f 5f 69 6d 70 5f 45 76 74 46 6f 72 6d 61 74 4d 65 73 73 61 67 65 00 5f 68 65 61 64 5f 43 5f | .__imp_EvtFormatMessage._head_C_ |
| 7cc0 | 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f | _Users_Peter_Code_winapi_rs_x86_ |
| 7ce0 | 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 61 77 71 | 64_lib_libwinapi_wevtapi_a..dawq |
| 7d00 | 73 30 30 30 30 36 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 38 36 36 20 20 30 20 20 20 20 20 30 20 | s00006.o/...1516160866..0.....0. |
| 7d20 | 20 20 20 20 31 30 30 36 36 36 20 20 36 36 37 20 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 | ....100666..667.......`.d....... |
| 7d40 | 80 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 | .............text............... |
| 7d60 | 2c 01 00 00 58 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 | ,...X.............0`.data....... |
| 7d80 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 | ........................@.0..bss |
| 7da0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................................ |
| 7dc0 | 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 62 01 00 00 | ..0..idata$7............4...b... |
| 7de0 | 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 | ..........0..idata$5............ |
| 7e00 | 38 01 00 00 6c 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 | 8...l.............0..idata$4.... |
| 7e20 | 00 00 00 00 08 00 00 00 40 01 00 00 76 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 | ........@...v.............0..ida |
| 7e40 | 74 61 24 36 00 00 00 00 00 00 00 00 10 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ta$6............H............... |
| 7e60 | 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | .....%.......................... |
| 7e80 | 06 00 45 76 74 45 78 70 6f 72 74 4c 6f 67 00 00 02 00 00 00 08 00 00 00 04 00 00 00 00 00 09 00 | ..EvtExportLog.................. |
| 7ea0 | 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 | .........................text... |
| 7ec0 | 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 73 73 | ...........data..............bss |
| 7ee0 | 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 00 00 03 00 | ...............idata$7.......... |
| 7f00 | 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 | .idata$5...........idata$4...... |
| 7f20 | 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 00 00 00 00 04 00 00 00 00 00 | .....idata$6.................... |
| 7f40 | 00 00 01 00 00 00 02 00 00 00 00 00 11 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 00 00 24 00 | ..............................$. |
| 7f60 | 00 00 00 00 00 00 00 00 00 00 02 00 67 00 00 00 45 76 74 45 78 70 6f 72 74 4c 6f 67 00 5f 5f 69 | ............g...EvtExportLog.__i |
| 7f80 | 6d 70 5f 45 76 74 45 78 70 6f 72 74 4c 6f 67 00 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 | mp_EvtExportLog._head_C__Users_P |
| 7fa0 | 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c | eter_Code_winapi_rs_x86_64_lib_l |
| 7fc0 | 69 62 77 69 6e 61 70 69 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 61 77 71 73 30 30 30 30 35 2e 6f | ibwinapi_wevtapi_a..dawqs00005.o |
| 7fe0 | 2f 20 20 20 31 35 31 36 31 36 30 38 36 36 20 20 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 | /...1516160866..0.....0.....1006 |
| 8000 | 36 36 20 20 36 39 39 20 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 8c 01 00 00 0a 00 00 00 | 66..699.......`.d............... |
| 8020 | 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 2c 01 00 00 64 01 00 00 | .....text...............,...d... |
| 8040 | 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ..........0`.data............... |
| 8060 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 | ................@.0..bss........ |
| 8080 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 | ..........................0..ida |
| 80a0 | 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 6e 01 00 00 00 00 00 00 01 00 00 00 | ta$7............4...n........... |
| 80c0 | 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 38 01 00 00 78 01 00 00 | ..0..idata$5............8...x... |
| 80e0 | 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 | ..........0..idata$4............ |
| 8100 | 40 01 00 00 82 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 | @.................0..idata$6.... |
| 8120 | 00 00 00 00 1a 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 | ........H....................%.. |
| 8140 | 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 05 00 45 76 74 43 72 65 | ..........................EvtCre |
| 8160 | 61 74 65 52 65 6e 64 65 72 43 6f 6e 74 65 78 74 00 00 00 00 02 00 00 00 08 00 00 00 04 00 00 00 | ateRenderContext................ |
| 8180 | 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 | .............................tex |
| 81a0 | 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 | t..............data............. |
| 81c0 | 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 | .bss...............idata$7...... |
| 81e0 | 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 | .....idata$5...........idata$4.. |
| 8200 | 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 00 00 00 00 04 00 | .........idata$6................ |
| 8220 | 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 1b 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 | ................................ |
| 8240 | 00 00 38 00 00 00 00 00 00 00 00 00 00 00 02 00 7b 00 00 00 45 76 74 43 72 65 61 74 65 52 65 6e | ..8.............{...EvtCreateRen |
| 8260 | 64 65 72 43 6f 6e 74 65 78 74 00 5f 5f 69 6d 70 5f 45 76 74 43 72 65 61 74 65 52 65 6e 64 65 72 | derContext.__imp_EvtCreateRender |
| 8280 | 43 6f 6e 74 65 78 74 00 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 | Context._head_C__Users_Peter_Cod |
| 82a0 | 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 | e_winapi_rs_x86_64_lib_libwinapi |
| 82c0 | 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 61 77 71 73 30 30 30 30 34 2e 6f 2f 20 20 20 31 35 31 36 | _wevtapi_a..dawqs00004.o/...1516 |
| 82e0 | 31 36 30 38 36 36 20 20 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 36 38 31 20 | 160866..0.....0.....100666..681. |
| 8300 | 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 84 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 | ......`.d....................tex |
| 8320 | 74 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 2c 01 00 00 5c 01 00 00 00 00 00 00 01 00 00 00 | t...............,...\........... |
| 8340 | 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ..0`.data....................... |
| 8360 | 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ........@.0..bss................ |
| 8380 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 | ..................0..idata$7.... |
| 83a0 | 00 00 00 00 04 00 00 00 34 01 00 00 66 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 | ........4...f.............0..ida |
| 83c0 | 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 38 01 00 00 70 01 00 00 00 00 00 00 01 00 00 00 | ta$5............8...p........... |
| 83e0 | 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 7a 01 00 00 | ..0..idata$4............@...z... |
| 8400 | 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 14 00 00 00 | ..........0..idata$6............ |
| 8420 | 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 | H....................%.......... |
| 8440 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 45 76 74 43 72 65 61 74 65 42 6f 6f 6b 6d | ..................EvtCreateBookm |
| 8460 | 61 72 6b 00 02 00 00 00 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 | ark............................. |
| 8480 | 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 | .............text..............d |
| 84a0 | 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 | ata..............bss............ |
| 84c0 | 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 | ...idata$7...........idata$5.... |
| 84e0 | 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 | .......idata$4...........idata$6 |
| 8500 | 00 00 00 00 07 00 00 00 03 00 00 00 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 | ................................ |
| 8520 | 16 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 00 00 2e 00 00 00 00 00 00 00 00 00 00 00 02 00 | ................................ |
| 8540 | 71 00 00 00 45 76 74 43 72 65 61 74 65 42 6f 6f 6b 6d 61 72 6b 00 5f 5f 69 6d 70 5f 45 76 74 43 | q...EvtCreateBookmark.__imp_EvtC |
| 8560 | 72 65 61 74 65 42 6f 6f 6b 6d 61 72 6b 00 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 | reateBookmark._head_C__Users_Pet |
| 8580 | 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 | er_Code_winapi_rs_x86_64_lib_lib |
| 85a0 | 77 69 6e 61 70 69 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 61 77 71 73 30 30 30 30 33 2e 6f 2f 20 | winapi_wevtapi_a..dawqs00003.o/. |
| 85c0 | 20 20 31 35 31 36 31 36 30 38 36 36 20 20 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 | ..1516160866..0.....0.....100666 |
| 85e0 | 20 20 36 34 36 20 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 7c 01 00 00 0a 00 00 00 00 00 | ..646.......`.d.......|......... |
| 8600 | 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 2c 01 00 00 54 01 00 00 00 00 | ...text...............,...T..... |
| 8620 | 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ........0`.data................. |
| 8640 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 | ..............@.0..bss.......... |
| 8660 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 | ........................0..idata |
| 8680 | 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 5e 01 00 00 00 00 00 00 01 00 00 00 00 00 | $7............4...^............. |
| 86a0 | 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 38 01 00 00 68 01 00 00 00 00 | 0..idata$5............8...h..... |
| 86c0 | 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 | ........0..idata$4............@. |
| 86e0 | 00 00 72 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 | ..r.............0..idata$6...... |
| 8700 | 00 00 0c 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 | ......H....................%.... |
| 8720 | 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 00 45 76 74 43 6c 6f 73 65 | ........................EvtClose |
| 8740 | 00 00 02 00 00 00 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 | ................................ |
| 8760 | 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 | ...........text..............dat |
| 8780 | 61 00 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 | a..............bss.............. |
| 87a0 | 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 | .idata$7...........idata$5...... |
| 87c0 | 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 | .....idata$4...........idata$6.. |
| 87e0 | 00 00 07 00 00 00 03 00 45 76 74 43 6c 6f 73 65 00 00 00 00 01 00 00 00 02 00 00 00 00 00 04 00 | ........EvtClose................ |
| 8800 | 00 00 00 00 00 00 05 00 00 00 02 00 00 00 00 00 13 00 00 00 00 00 00 00 00 00 00 00 02 00 56 00 | ..............................V. |
| 8820 | 00 00 5f 5f 69 6d 70 5f 45 76 74 43 6c 6f 73 65 00 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f | ..__imp_EvtClose._head_C__Users_ |
| 8840 | 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f | Peter_Code_winapi_rs_x86_64_lib_ |
| 8860 | 6c 69 62 77 69 6e 61 70 69 5f 77 65 76 74 61 70 69 5f 61 00 64 61 77 71 73 30 30 30 30 32 2e 6f | libwinapi_wevtapi_a.dawqs00002.o |
| 8880 | 2f 20 20 20 31 35 31 36 31 36 30 38 36 36 20 20 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 | /...1516160866..0.....0.....1006 |
| 88a0 | 36 36 20 20 36 36 35 20 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 80 01 00 00 0a 00 00 00 | 66..665.......`.d............... |
| 88c0 | 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 2c 01 00 00 58 01 00 00 | .....text...............,...X... |
| 88e0 | 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ..........0`.data............... |
| 8900 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 | ................@.0..bss........ |
| 8920 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 | ..........................0..ida |
| 8940 | 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 62 01 00 00 00 00 00 00 01 00 00 00 | ta$7............4...b........... |
| 8960 | 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 38 01 00 00 6c 01 00 00 | ..0..idata$5............8...l... |
| 8980 | 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 | ..........0..idata$4............ |
| 89a0 | 40 01 00 00 76 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 | @...v.............0..idata$6.... |
| 89c0 | 00 00 00 00 0e 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 | ........H....................%.. |
| 89e0 | 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 45 76 74 43 6c 65 | ..........................EvtCle |
| 8a00 | 61 72 4c 6f 67 00 00 00 02 00 00 00 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 | arLog........................... |
| 8a20 | 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 | .................text........... |
| 8a40 | 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 | ...data..............bss........ |
| 8a60 | 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 | .......idata$7...........idata$5 |
| 8a80 | 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 | ...........idata$4...........ida |
| 8aa0 | 74 61 24 36 00 00 00 00 07 00 00 00 03 00 00 00 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 | ta$6............................ |
| 8ac0 | 00 00 00 00 10 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 00 00 22 00 00 00 00 00 00 00 00 00 | ......................"......... |
| 8ae0 | 00 00 02 00 65 00 00 00 45 76 74 43 6c 65 61 72 4c 6f 67 00 5f 5f 69 6d 70 5f 45 76 74 43 6c 65 | ....e...EvtClearLog.__imp_EvtCle |
| 8b00 | 61 72 4c 6f 67 00 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f | arLog._head_C__Users_Peter_Code_ |
| 8b20 | 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 | winapi_rs_x86_64_lib_libwinapi_w |
| 8b40 | 65 76 74 61 70 69 5f 61 00 0a 64 61 77 71 73 30 30 30 30 31 2e 6f 2f 20 20 20 31 35 31 36 31 36 | evtapi_a..dawqs00001.o/...151616 |
| 8b60 | 30 38 36 36 20 20 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 36 35 37 20 20 20 | 0866..0.....0.....100666..657... |
| 8b80 | 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 7c 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 | ....`.d.......|............text. |
| 8ba0 | 00 00 00 00 00 00 00 00 00 00 08 00 00 00 2c 01 00 00 54 01 00 00 00 00 00 00 01 00 00 00 20 00 | ..............,...T............. |
| 8bc0 | 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | 0`.data......................... |
| 8be0 | 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ......@.0..bss.................. |
| 8c00 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 | ................0..idata$7...... |
| 8c20 | 00 00 04 00 00 00 34 01 00 00 5e 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 | ......4...^.............0..idata |
| 8c40 | 24 35 00 00 00 00 00 00 00 00 08 00 00 00 38 01 00 00 68 01 00 00 00 00 00 00 01 00 00 00 00 00 | $5............8...h............. |
| 8c60 | 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 72 01 00 00 00 00 | 0..idata$4............@...r..... |
| 8c80 | 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 0c 00 00 00 48 01 | ........0..idata$6............H. |
| 8ca0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 | ...................%............ |
| 8cc0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 45 76 74 43 61 6e 63 65 6c 00 02 00 00 00 08 00 | ................EvtCancel....... |
| 8ce0 | 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 | ................................ |
| 8d00 | 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 | ...text..............data....... |
| 8d20 | 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 | .......bss...............idata$7 |
| 8d40 | 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 | ...........idata$5...........ida |
| 8d60 | 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 | ta$4...........idata$6.......... |
| 8d80 | 00 00 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 0e 00 00 00 00 00 00 00 05 00 | ................................ |
| 8da0 | 00 00 02 00 00 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 02 00 61 00 00 00 45 76 74 43 61 6e | ......................a...EvtCan |
| 8dc0 | 63 65 6c 00 5f 5f 69 6d 70 5f 45 76 74 43 61 6e 63 65 6c 00 5f 68 65 61 64 5f 43 5f 5f 55 73 65 | cel.__imp_EvtCancel._head_C__Use |
| 8de0 | 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c | rs_Peter_Code_winapi_rs_x86_64_l |
| 8e00 | 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 61 77 71 73 30 30 30 | ib_libwinapi_wevtapi_a..dawqs000 |
| 8e20 | 30 30 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 38 36 36 20 20 30 20 20 20 20 20 30 20 20 20 20 20 | 00.o/...1516160866..0.....0..... |
| 8e40 | 31 30 30 36 36 36 20 20 36 39 33 20 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 88 01 00 00 | 100666..693.......`.d........... |
| 8e60 | 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 2c 01 00 00 | .........text...............,... |
| 8e80 | 60 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 00 00 | `.............0`.data........... |
| 8ea0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 00 00 00 00 | ....................@.0..bss.... |
| 8ec0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 30 c0 | ..............................0. |
| 8ee0 | 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 6a 01 00 00 00 00 00 00 | .idata$7............4...j....... |
| 8f00 | 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 38 01 00 00 | ......0..idata$5............8... |
| 8f20 | 74 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 00 00 00 00 | t.............0..idata$4........ |
| 8f40 | 08 00 00 00 40 01 00 00 7e 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 36 | ....@...~.............0..idata$6 |
| 8f60 | 00 00 00 00 00 00 00 00 18 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 c0 | ............H................... |
| 8f80 | ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 45 76 | .%............................Ev |
| 8fa0 | 74 41 72 63 68 69 76 65 45 78 70 6f 72 74 65 64 4c 6f 67 00 02 00 00 00 08 00 00 00 04 00 00 00 | tArchiveExportedLog............. |
| 8fc0 | 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 | .............................tex |
| 8fe0 | 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 | t..............data............. |
| 9000 | 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 | .bss...............idata$7...... |
| 9020 | 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 | .....idata$5...........idata$4.. |
| 9040 | 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 00 00 00 00 04 00 | .........idata$6................ |
| 9060 | 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 1a 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 | ................................ |
| 9080 | 00 00 36 00 00 00 00 00 00 00 00 00 00 00 02 00 79 00 00 00 45 76 74 41 72 63 68 69 76 65 45 78 | ..6.............y...EvtArchiveEx |
| 90a0 | 70 6f 72 74 65 64 4c 6f 67 00 5f 5f 69 6d 70 5f 45 76 74 41 72 63 68 69 76 65 45 78 70 6f 72 74 | portedLog.__imp_EvtArchiveExport |
| 90c0 | 65 64 4c 6f 67 00 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f | edLog._head_C__Users_Peter_Code_ |
| 90e0 | 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 | winapi_rs_x86_64_lib_libwinapi_w |
| 9100 | 65 76 74 61 70 69 5f 61 00 0a | evtapi_a.. |
 |
index : fparkan.git | |
| Utilities and tools for the game “Parkan: Iron Strategy”. | Valentin Popov |
| aboutsummaryrefslogtreecommitdiff |
blob: f6b9852b9b61a23b83baeee758009fd18afa035a (plain)