aboutsummaryrefslogtreecommitdiff
path: root/vendor/winapi-x86_64-pc-windows-gnu/lib/libwinapi_wevtapi.a
blob: f6b9852b9b61a23b83baeee758009fd18afa035a (plain)
ofshex dumpascii
0000 21 3c 61 72 63 68 3e 0a 2f 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 31 35 31 36 31 36 30 38 !<arch>./...............15161608
0020 36 36 20 20 30 20 20 20 20 20 30 20 20 20 20 20 30 20 20 20 20 20 20 20 32 35 36 38 20 20 20 20 66..0.....0.....0.......2568....
0040 20 20 60 0a 00 00 00 5a 00 00 0a 4c 00 00 0d 00 00 00 10 1e 00 00 10 1e 00 00 13 04 00 00 13 04 ..`....Z...L....................
0060 00 00 15 dc 00 00 15 dc 00 00 18 e2 00 00 18 e2 00 00 1b a4 00 00 1b a4 00 00 1e 94 00 00 1e 94 ................................
0080 00 00 21 62 00 00 21 62 00 00 24 24 00 00 24 24 00 00 27 04 00 00 27 04 00 00 2a 00 00 00 2a 00 ..!b..!b..$$..$$..'...'...*...*.
00a0 00 00 2c f0 00 00 2c f0 00 00 2f c4 00 00 2f c4 00 00 32 c0 00 00 32 c0 00 00 35 ac 00 00 35 ac ..,...,.../.../...2...2...5...5.
00c0 00 00 38 9c 00 00 38 9c 00 00 3b 88 00 00 3b 88 00 00 3e 78 00 00 3e 78 00 00 41 64 00 00 41 64 ..8...8...;...;...>x..>x..Ad..Ad
00e0 00 00 44 26 00 00 44 26 00 00 47 3c 00 00 47 3c 00 00 4a 2a 00 00 4a 2a 00 00 4d 3c 00 00 4d 3c ..D&..D&..G<..G<..J*..J*..M<..M<
0100 00 00 50 5c 00 00 50 5c 00 00 53 72 00 00 53 72 00 00 56 82 00 00 56 82 00 00 59 7e 00 00 59 7e ..P\..P\..Sr..Sr..V...V...Y~..Y~
0120 00 00 5c 90 00 00 5c 90 00 00 5f 7c 00 00 5f 7c 00 00 62 5e 00 00 62 5e 00 00 65 70 00 00 65 70 ..\...\..._|.._|..b^..b^..ep..ep
0140 00 00 68 62 00 00 68 62 00 00 6b 60 00 00 6b 60 00 00 6e 3a 00 00 6e 3a 00 00 71 2a 00 00 71 2a ..hb..hb..k`..k`..n:..n:..q*..q*
0160 00 00 74 30 00 00 74 30 00 00 77 12 00 00 77 12 00 00 7a 18 00 00 7a 18 00 00 7c fc 00 00 7c fc ..t0..t0..w...w...z...z...|...|.
0180 00 00 7f d4 00 00 7f d4 00 00 82 cc 00 00 82 cc 00 00 85 b2 00 00 85 b2 00 00 88 74 00 00 88 74 ...........................t...t
01a0 00 00 8b 4a 00 00 8b 4a 00 00 8e 18 00 00 8e 18 5f 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 ...J...J........__C__Users_Peter
01c0 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 _Code_winapi_rs_x86_64_lib_libwi
01e0 6e 61 70 69 5f 77 65 76 74 61 70 69 5f 61 5f 69 6e 61 6d 65 00 5f 68 65 61 64 5f 43 5f 5f 55 73 napi_wevtapi_a_iname._head_C__Us
0200 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f ers_Peter_Code_winapi_rs_x86_64_
0220 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 65 76 74 61 70 69 5f 61 00 45 76 74 55 70 64 61 74 lib_libwinapi_wevtapi_a.EvtUpdat
0240 65 42 6f 6f 6b 6d 61 72 6b 00 5f 5f 69 6d 70 5f 45 76 74 55 70 64 61 74 65 42 6f 6f 6b 6d 61 72 eBookmark.__imp_EvtUpdateBookmar
0260 6b 00 45 76 74 53 75 62 73 63 72 69 62 65 00 5f 5f 69 6d 70 5f 45 76 74 53 75 62 73 63 72 69 62 k.EvtSubscribe.__imp_EvtSubscrib
0280 65 00 45 76 74 53 65 74 43 68 61 6e 6e 65 6c 43 6f 6e 66 69 67 50 72 6f 70 65 72 74 79 00 5f 5f e.EvtSetChannelConfigProperty.__
02a0 69 6d 70 5f 45 76 74 53 65 74 43 68 61 6e 6e 65 6c 43 6f 6e 66 69 67 50 72 6f 70 65 72 74 79 00 imp_EvtSetChannelConfigProperty.
02c0 45 76 74 53 65 65 6b 00 5f 5f 69 6d 70 5f 45 76 74 53 65 65 6b 00 45 76 74 53 61 76 65 43 68 61 EvtSeek.__imp_EvtSeek.EvtSaveCha
02e0 6e 6e 65 6c 43 6f 6e 66 69 67 00 5f 5f 69 6d 70 5f 45 76 74 53 61 76 65 43 68 61 6e 6e 65 6c 43 nnelConfig.__imp_EvtSaveChannelC
0300 6f 6e 66 69 67 00 45 76 74 52 65 6e 64 65 72 00 5f 5f 69 6d 70 5f 45 76 74 52 65 6e 64 65 72 00 onfig.EvtRender.__imp_EvtRender.
0320 45 76 74 51 75 65 72 79 00 5f 5f 69 6d 70 5f 45 76 74 51 75 65 72 79 00 45 76 74 4f 70 65 6e 53 EvtQuery.__imp_EvtQuery.EvtOpenS
0340 65 73 73 69 6f 6e 00 5f 5f 69 6d 70 5f 45 76 74 4f 70 65 6e 53 65 73 73 69 6f 6e 00 45 76 74 4f ession.__imp_EvtOpenSession.EvtO
0360 70 65 6e 50 75 62 6c 69 73 68 65 72 4d 65 74 61 64 61 74 61 00 5f 5f 69 6d 70 5f 45 76 74 4f 70 penPublisherMetadata.__imp_EvtOp
0380 65 6e 50 75 62 6c 69 73 68 65 72 4d 65 74 61 64 61 74 61 00 45 76 74 4f 70 65 6e 50 75 62 6c 69 enPublisherMetadata.EvtOpenPubli
03a0 73 68 65 72 45 6e 75 6d 00 5f 5f 69 6d 70 5f 45 76 74 4f 70 65 6e 50 75 62 6c 69 73 68 65 72 45 sherEnum.__imp_EvtOpenPublisherE
03c0 6e 75 6d 00 45 76 74 4f 70 65 6e 4c 6f 67 00 5f 5f 69 6d 70 5f 45 76 74 4f 70 65 6e 4c 6f 67 00 num.EvtOpenLog.__imp_EvtOpenLog.
03e0 45 76 74 4f 70 65 6e 45 76 65 6e 74 4d 65 74 61 64 61 74 61 45 6e 75 6d 00 5f 5f 69 6d 70 5f 45 EvtOpenEventMetadataEnum.__imp_E
0400 76 74 4f 70 65 6e 45 76 65 6e 74 4d 65 74 61 64 61 74 61 45 6e 75 6d 00 45 76 74 4f 70 65 6e 43 vtOpenEventMetadataEnum.EvtOpenC
0420 68 61 6e 6e 65 6c 45 6e 75 6d 00 5f 5f 69 6d 70 5f 45 76 74 4f 70 65 6e 43 68 61 6e 6e 65 6c 45 hannelEnum.__imp_EvtOpenChannelE
0440 6e 75 6d 00 45 76 74 4f 70 65 6e 43 68 61 6e 6e 65 6c 43 6f 6e 66 69 67 00 5f 5f 69 6d 70 5f 45 num.EvtOpenChannelConfig.__imp_E
0460 76 74 4f 70 65 6e 43 68 61 6e 6e 65 6c 43 6f 6e 66 69 67 00 45 76 74 4e 65 78 74 50 75 62 6c 69 vtOpenChannelConfig.EvtNextPubli
0480 73 68 65 72 49 64 00 5f 5f 69 6d 70 5f 45 76 74 4e 65 78 74 50 75 62 6c 69 73 68 65 72 49 64 00 sherId.__imp_EvtNextPublisherId.
04a0 45 76 74 4e 65 78 74 45 76 65 6e 74 4d 65 74 61 64 61 74 61 00 5f 5f 69 6d 70 5f 45 76 74 4e 65 EvtNextEventMetadata.__imp_EvtNe
04c0 78 74 45 76 65 6e 74 4d 65 74 61 64 61 74 61 00 45 76 74 4e 65 78 74 43 68 61 6e 6e 65 6c 50 61 xtEventMetadata.EvtNextChannelPa
04e0 74 68 00 5f 5f 69 6d 70 5f 45 76 74 4e 65 78 74 43 68 61 6e 6e 65 6c 50 61 74 68 00 45 76 74 4e th.__imp_EvtNextChannelPath.EvtN
0500 65 78 74 00 5f 5f 69 6d 70 5f 45 76 74 4e 65 78 74 00 45 76 74 49 6e 74 57 72 69 74 65 58 6d 6c ext.__imp_EvtNext.EvtIntWriteXml
0520 45 76 65 6e 74 54 6f 4c 6f 63 61 6c 4c 6f 67 66 69 6c 65 00 5f 5f 69 6d 70 5f 45 76 74 49 6e 74 EventToLocalLogfile.__imp_EvtInt
0540 57 72 69 74 65 58 6d 6c 45 76 65 6e 74 54 6f 4c 6f 63 61 6c 4c 6f 67 66 69 6c 65 00 45 76 74 49 WriteXmlEventToLocalLogfile.EvtI
0560 6e 74 52 65 74 72 61 63 74 43 6f 6e 66 69 67 00 5f 5f 69 6d 70 5f 45 76 74 49 6e 74 52 65 74 72 ntRetractConfig.__imp_EvtIntRetr
0580 61 63 74 43 6f 6e 66 69 67 00 45 76 74 49 6e 74 52 65 70 6f 72 74 45 76 65 6e 74 41 6e 64 53 6f actConfig.EvtIntReportEventAndSo
05a0 75 72 63 65 41 73 79 6e 63 00 5f 5f 69 6d 70 5f 45 76 74 49 6e 74 52 65 70 6f 72 74 45 76 65 6e urceAsync.__imp_EvtIntReportEven
05c0 74 41 6e 64 53 6f 75 72 63 65 41 73 79 6e 63 00 45 76 74 49 6e 74 52 65 70 6f 72 74 41 75 74 68 tAndSourceAsync.EvtIntReportAuth
05e0 7a 45 76 65 6e 74 41 6e 64 53 6f 75 72 63 65 41 73 79 6e 63 00 5f 5f 69 6d 70 5f 45 76 74 49 6e zEventAndSourceAsync.__imp_EvtIn
0600 74 52 65 70 6f 72 74 41 75 74 68 7a 45 76 65 6e 74 41 6e 64 53 6f 75 72 63 65 41 73 79 6e 63 00 tReportAuthzEventAndSourceAsync.
0620 45 76 74 49 6e 74 52 65 6e 64 65 72 52 65 73 6f 75 72 63 65 45 76 65 6e 74 54 65 6d 70 6c 61 74 EvtIntRenderResourceEventTemplat
0640 65 00 5f 5f 69 6d 70 5f 45 76 74 49 6e 74 52 65 6e 64 65 72 52 65 73 6f 75 72 63 65 45 76 65 6e e.__imp_EvtIntRenderResourceEven
0660 74 54 65 6d 70 6c 61 74 65 00 45 76 74 49 6e 74 47 65 74 43 6c 61 73 73 69 63 4c 6f 67 44 69 73 tTemplate.EvtIntGetClassicLogDis
0680 70 6c 61 79 4e 61 6d 65 00 5f 5f 69 6d 70 5f 45 76 74 49 6e 74 47 65 74 43 6c 61 73 73 69 63 4c playName.__imp_EvtIntGetClassicL
06a0 6f 67 44 69 73 70 6c 61 79 4e 61 6d 65 00 45 76 74 49 6e 74 43 72 65 61 74 65 4c 6f 63 61 6c 4c ogDisplayName.EvtIntCreateLocalL
06c0 6f 67 66 69 6c 65 00 5f 5f 69 6d 70 5f 45 76 74 49 6e 74 43 72 65 61 74 65 4c 6f 63 61 6c 4c 6f ogfile.__imp_EvtIntCreateLocalLo
06e0 67 66 69 6c 65 00 45 76 74 49 6e 74 43 72 65 61 74 65 42 69 6e 58 4d 4c 46 72 6f 6d 43 75 73 74 gfile.EvtIntCreateBinXMLFromCust
0700 6f 6d 58 4d 4c 00 5f 5f 69 6d 70 5f 45 76 74 49 6e 74 43 72 65 61 74 65 42 69 6e 58 4d 4c 46 72 omXML.__imp_EvtIntCreateBinXMLFr
0720 6f 6d 43 75 73 74 6f 6d 58 4d 4c 00 45 76 74 49 6e 74 41 73 73 65 72 74 43 6f 6e 66 69 67 00 5f omCustomXML.EvtIntAssertConfig._
0740 5f 69 6d 70 5f 45 76 74 49 6e 74 41 73 73 65 72 74 43 6f 6e 66 69 67 00 45 76 74 47 65 74 51 75 _imp_EvtIntAssertConfig.EvtGetQu
0760 65 72 79 49 6e 66 6f 00 5f 5f 69 6d 70 5f 45 76 74 47 65 74 51 75 65 72 79 49 6e 66 6f 00 45 76 eryInfo.__imp_EvtGetQueryInfo.Ev
0780 74 47 65 74 50 75 62 6c 69 73 68 65 72 4d 65 74 61 64 61 74 61 50 72 6f 70 65 72 74 79 00 5f 5f tGetPublisherMetadataProperty.__
07a0 69 6d 70 5f 45 76 74 47 65 74 50 75 62 6c 69 73 68 65 72 4d 65 74 61 64 61 74 61 50 72 6f 70 65 imp_EvtGetPublisherMetadataPrope
07c0 72 74 79 00 45 76 74 47 65 74 4f 62 6a 65 63 74 41 72 72 61 79 53 69 7a 65 00 5f 5f 69 6d 70 5f rty.EvtGetObjectArraySize.__imp_
07e0 45 76 74 47 65 74 4f 62 6a 65 63 74 41 72 72 61 79 53 69 7a 65 00 45 76 74 47 65 74 4f 62 6a 65 EvtGetObjectArraySize.EvtGetObje
0800 63 74 41 72 72 61 79 50 72 6f 70 65 72 74 79 00 5f 5f 69 6d 70 5f 45 76 74 47 65 74 4f 62 6a 65 ctArrayProperty.__imp_EvtGetObje
0820 63 74 41 72 72 61 79 50 72 6f 70 65 72 74 79 00 45 76 74 47 65 74 4c 6f 67 49 6e 66 6f 00 5f 5f ctArrayProperty.EvtGetLogInfo.__
0840 69 6d 70 5f 45 76 74 47 65 74 4c 6f 67 49 6e 66 6f 00 45 76 74 47 65 74 45 78 74 65 6e 64 65 64 imp_EvtGetLogInfo.EvtGetExtended
0860 53 74 61 74 75 73 00 5f 5f 69 6d 70 5f 45 76 74 47 65 74 45 78 74 65 6e 64 65 64 53 74 61 74 75 Status.__imp_EvtGetExtendedStatu
0880 73 00 45 76 74 47 65 74 45 76 65 6e 74 4d 65 74 61 64 61 74 61 50 72 6f 70 65 72 74 79 00 5f 5f s.EvtGetEventMetadataProperty.__
08a0 69 6d 70 5f 45 76 74 47 65 74 45 76 65 6e 74 4d 65 74 61 64 61 74 61 50 72 6f 70 65 72 74 79 00 imp_EvtGetEventMetadataProperty.
08c0 45 76 74 47 65 74 45 76 65 6e 74 49 6e 66 6f 00 5f 5f 69 6d 70 5f 45 76 74 47 65 74 45 76 65 6e EvtGetEventInfo.__imp_EvtGetEven
08e0 74 49 6e 66 6f 00 45 76 74 47 65 74 43 68 61 6e 6e 65 6c 43 6f 6e 66 69 67 50 72 6f 70 65 72 74 tInfo.EvtGetChannelConfigPropert
0900 79 00 5f 5f 69 6d 70 5f 45 76 74 47 65 74 43 68 61 6e 6e 65 6c 43 6f 6e 66 69 67 50 72 6f 70 65 y.__imp_EvtGetChannelConfigPrope
0920 72 74 79 00 45 76 74 46 6f 72 6d 61 74 4d 65 73 73 61 67 65 00 5f 5f 69 6d 70 5f 45 76 74 46 6f rty.EvtFormatMessage.__imp_EvtFo
0940 72 6d 61 74 4d 65 73 73 61 67 65 00 45 76 74 45 78 70 6f 72 74 4c 6f 67 00 5f 5f 69 6d 70 5f 45 rmatMessage.EvtExportLog.__imp_E
0960 76 74 45 78 70 6f 72 74 4c 6f 67 00 45 76 74 43 72 65 61 74 65 52 65 6e 64 65 72 43 6f 6e 74 65 vtExportLog.EvtCreateRenderConte
0980 78 74 00 5f 5f 69 6d 70 5f 45 76 74 43 72 65 61 74 65 52 65 6e 64 65 72 43 6f 6e 74 65 78 74 00 xt.__imp_EvtCreateRenderContext.
09a0 45 76 74 43 72 65 61 74 65 42 6f 6f 6b 6d 61 72 6b 00 5f 5f 69 6d 70 5f 45 76 74 43 72 65 61 74 EvtCreateBookmark.__imp_EvtCreat
09c0 65 42 6f 6f 6b 6d 61 72 6b 00 45 76 74 43 6c 6f 73 65 00 5f 5f 69 6d 70 5f 45 76 74 43 6c 6f 73 eBookmark.EvtClose.__imp_EvtClos
09e0 65 00 45 76 74 43 6c 65 61 72 4c 6f 67 00 5f 5f 69 6d 70 5f 45 76 74 43 6c 65 61 72 4c 6f 67 00 e.EvtClearLog.__imp_EvtClearLog.
0a00 45 76 74 43 61 6e 63 65 6c 00 5f 5f 69 6d 70 5f 45 76 74 43 61 6e 63 65 6c 00 45 76 74 41 72 63 EvtCancel.__imp_EvtCancel.EvtArc
0a20 68 69 76 65 45 78 70 6f 72 74 65 64 4c 6f 67 00 5f 5f 69 6d 70 5f 45 76 74 41 72 63 68 69 76 65 hiveExportedLog.__imp_EvtArchive
0a40 45 78 70 6f 72 74 65 64 4c 6f 67 00 64 61 77 71 74 2e 6f 2f 20 20 20 20 20 20 20 20 31 35 31 36 ExportedLog.dawqt.o/........1516
0a60 31 36 30 38 36 36 20 20 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 36 33 31 20 160866..0.....0.....100666..631.
0a80 20 20 20 20 20 20 60 0a 64 86 06 00 00 00 00 00 20 01 00 00 0f 00 00 00 00 00 05 00 2e 74 65 78 ......`.d....................tex
0aa0 74 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 t...............................
0ac0 20 00 50 60 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ..P`.data.......................
0ae0 00 00 00 00 00 00 00 00 40 00 50 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........@.P..bss................
0b00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 50 c0 2e 69 64 61 74 61 24 34 00 00 00 00 ..................P..idata$4....
0b20 00 00 00 00 08 00 00 00 04 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 69 64 61 ........................@.0..ida
0b40 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 0c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ta$5............................
0b60 40 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 0c 00 00 00 14 01 00 00 00 00 00 00 @.0..idata$7....................
0b80 00 00 00 00 00 00 00 00 40 00 30 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 77 65 76 74 ........@.0.................wevt
0ba0 61 70 69 2e 64 6c 6c 00 2e 66 69 6c 65 00 00 00 00 00 00 00 fe ff 00 00 67 01 66 61 6b 65 00 00 api.dll..file...........g.fake..
0bc0 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 01 00 00 .............text...............
0be0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 00 00 .................data...........
0c00 03 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 62 73 73 00 00 00 00 00 00 00 00 .....................bss........
0c20 03 00 00 00 03 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 69 64 61 74 61 24 34 .........................idata$4
0c40 00 00 00 00 04 00 00 00 03 01 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 69 64 61 .............................ida
0c60 74 61 24 35 00 00 00 00 05 00 00 00 03 01 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ta$5............................
0c80 2e 69 64 61 74 61 24 37 00 00 00 00 06 00 00 00 03 01 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 .idata$7........................
0ca0 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 06 00 00 00 02 00 49 00 00 00 5f 5f 43 5f 5f 55 ......................I...__C__U
0cc0 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 sers_Peter_Code_winapi_rs_x86_64
0ce0 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 65 76 74 61 70 69 5f 61 5f 69 6e 61 6d 65 00 0a _lib_libwinapi_wevtapi_a_iname..
0d00 64 61 77 71 68 2e 6f 2f 20 20 20 20 20 20 20 20 31 35 31 36 31 36 30 38 36 36 20 20 30 20 20 20 dawqh.o/........1516160866..0...
0d20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 37 33 38 20 20 20 20 20 20 20 60 0a 64 86 06 00 ..0.....100666..738.......`.d...
0d40 00 00 00 00 36 01 00 00 10 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 ....6............text...........
0d60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 50 60 2e 64 61 74 61 00 00 00 ......................P`.data...
0d80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 50 c0 ............................@.P.
0da0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .bss............................
0dc0 00 00 00 00 80 00 50 c0 2e 69 64 61 74 61 24 32 00 00 00 00 00 00 00 00 14 00 00 00 04 01 00 00 ......P..idata$2................
0de0 18 01 00 00 00 00 00 00 03 00 00 00 40 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 ............@.0..idata$5........
0e00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 69 64 61 74 61 24 34 ....................@.0..idata$4
0e20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 ............................@.0.
0e40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 00 00 00 03 00 0c 00 ................................
0e60 00 00 0f 00 00 00 03 00 10 00 00 00 0d 00 00 00 03 00 2e 66 69 6c 65 00 00 00 00 00 00 00 fe ff ...................file.........
0e80 00 00 67 01 66 61 6b 65 00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 6e 61 6d 65 00 00 00 00 00 ..g.fake..............hname.....
0ea0 00 00 06 00 00 00 03 00 66 74 68 75 6e 6b 00 00 00 00 00 00 05 00 00 00 03 00 2e 74 65 78 74 00 ........fthunk.............text.
0ec0 00 00 00 00 00 00 01 00 00 00 03 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 64 ...............................d
0ee0 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ata.............................
0f00 00 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 01 00 00 00 00 00 00 00 00 00 00 00 00 ...bss..........................
0f20 00 00 00 00 00 00 2e 69 64 61 74 61 24 32 00 00 00 00 04 00 00 00 03 01 14 00 00 00 03 00 00 00 .......idata$2..................
0f40 00 00 00 00 00 00 00 00 00 00 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 ...........idata$4...........ida
0f60 74 61 24 35 00 00 00 00 05 00 00 00 03 00 00 00 00 00 04 00 00 00 00 00 00 00 04 00 00 00 02 00 ta$5............................
0f80 00 00 00 00 47 00 00 00 00 00 00 00 00 00 00 00 02 00 8c 00 00 00 5f 68 65 61 64 5f 43 5f 5f 55 ....G................._head_C__U
0fa0 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 sers_Peter_Code_winapi_rs_x86_64
0fc0 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 65 76 74 61 70 69 5f 61 00 5f 5f 43 5f 5f 55 73 _lib_libwinapi_wevtapi_a.__C__Us
0fe0 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f ers_Peter_Code_winapi_rs_x86_64_
1000 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 65 76 74 61 70 69 5f 61 5f 69 6e 61 6d 65 00 64 61 lib_libwinapi_wevtapi_a_iname.da
1020 77 71 73 30 30 30 34 33 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 38 36 36 20 20 30 20 20 20 20 20 wqs00043.o/...1516160866..0.....
1040 30 20 20 20 20 20 31 30 30 36 36 36 20 20 36 38 31 20 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 0.....100666..681.......`.d.....
1060 00 00 84 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 08 00 ...............text.............
1080 00 00 2c 01 00 00 5c 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 ..,...\.............0`.data.....
10a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 ..........................@.0..b
10c0 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ss..............................
10e0 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 66 01 ....0..idata$7............4...f.
1100 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 08 00 ............0..idata$5..........
1120 00 00 38 01 00 00 70 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 ..8...p.............0..idata$4..
1140 00 00 00 00 00 00 08 00 00 00 40 01 00 00 7a 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 ..........@...z.............0..i
1160 64 61 74 61 24 36 00 00 00 00 00 00 00 00 14 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 data$6............H.............
1180 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .......%........................
11a0 00 00 2b 00 45 76 74 55 70 64 61 74 65 42 6f 6f 6b 6d 61 72 6b 00 02 00 00 00 08 00 00 00 04 00 ..+.EvtUpdateBookmark...........
11c0 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 ...............................t
11e0 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 00 00 ext..............data...........
1200 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 ...bss...............idata$7....
1220 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 .......idata$5...........idata$4
1240 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 00 00 00 00 ...........idata$6..............
1260 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 16 00 00 00 00 00 00 00 05 00 00 00 02 00 ................................
1280 00 00 00 00 2e 00 00 00 00 00 00 00 00 00 00 00 02 00 71 00 00 00 45 76 74 55 70 64 61 74 65 42 ..................q...EvtUpdateB
12a0 6f 6f 6b 6d 61 72 6b 00 5f 5f 69 6d 70 5f 45 76 74 55 70 64 61 74 65 42 6f 6f 6b 6d 61 72 6b 00 ookmark.__imp_EvtUpdateBookmark.
12c0 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 _head_C__Users_Peter_Code_winapi
12e0 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 65 76 74 61 70 69 _rs_x86_64_lib_libwinapi_wevtapi
1300 5f 61 00 0a 64 61 77 71 73 30 30 30 34 32 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 38 36 36 20 20 _a..dawqs00042.o/...1516160866..
1320 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 36 36 37 20 20 20 20 20 20 20 60 0a 0.....0.....100666..667.......`.
1340 64 86 07 00 00 00 00 00 80 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 d....................text.......
1360 00 00 00 00 08 00 00 00 2c 01 00 00 58 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 ........,...X.............0`.dat
1380 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a...............................
13a0 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 @.0..bss........................
13c0 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 ..........0..idata$7............
13e0 34 01 00 00 62 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 4...b.............0..idata$5....
1400 00 00 00 00 08 00 00 00 38 01 00 00 6c 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 ........8...l.............0..ida
1420 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 76 01 00 00 00 00 00 00 01 00 00 00 ta$4............@...v...........
1440 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 10 00 00 00 48 01 00 00 00 00 00 00 ..0..idata$6............H.......
1460 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 .............%..................
1480 00 00 00 00 00 00 00 00 2a 00 45 76 74 53 75 62 73 63 72 69 62 65 00 00 02 00 00 00 08 00 00 00 ........*.EvtSubscribe..........
14a0 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 ................................
14c0 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 .text..............data.........
14e0 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 .....bss...............idata$7..
1500 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 .........idata$5...........idata
1520 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 00 00 $4...........idata$6............
1540 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 11 00 00 00 00 00 00 00 05 00 00 00 ................................
1560 02 00 00 00 00 00 24 00 00 00 00 00 00 00 00 00 00 00 02 00 67 00 00 00 45 76 74 53 75 62 73 63 ......$.............g...EvtSubsc
1580 72 69 62 65 00 5f 5f 69 6d 70 5f 45 76 74 53 75 62 73 63 72 69 62 65 00 5f 68 65 61 64 5f 43 5f ribe.__imp_EvtSubscribe._head_C_
15a0 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f _Users_Peter_Code_winapi_rs_x86_
15c0 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 61 77 71 64_lib_libwinapi_wevtapi_a..dawq
15e0 73 30 30 30 34 31 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 38 36 36 20 20 30 20 20 20 20 20 30 20 s00041.o/...1516160866..0.....0.
1600 20 20 20 20 31 30 30 36 36 36 20 20 37 31 33 20 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 ....100666..713.......`.d.......
1620 90 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 .............text...............
1640 2c 01 00 00 68 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 ,...h.............0`.data.......
1660 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 ........................@.0..bss
1680 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................................
16a0 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 72 01 00 00 ..0..idata$7............4...r...
16c0 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 ..........0..idata$5............
16e0 38 01 00 00 7c 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 8...|.............0..idata$4....
1700 00 00 00 00 08 00 00 00 40 01 00 00 86 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 ........@.................0..ida
1720 74 61 24 36 00 00 00 00 00 00 00 00 1e 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ta$6............H...............
1740 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .....%..........................
1760 29 00 45 76 74 53 65 74 43 68 61 6e 6e 65 6c 43 6f 6e 66 69 67 50 72 6f 70 65 72 74 79 00 00 00 ).EvtSetChannelConfigProperty...
1780 02 00 00 00 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 ................................
17a0 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 .........text..............data.
17c0 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 .............bss...............i
17e0 64 61 74 61 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 data$7...........idata$5........
1800 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 ...idata$4...........idata$6....
1820 07 00 00 00 03 00 00 00 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 20 00 00 00 ................................
1840 00 00 00 00 05 00 00 00 02 00 00 00 00 00 42 00 00 00 00 00 00 00 00 00 00 00 02 00 85 00 00 00 ..............B.................
1860 45 76 74 53 65 74 43 68 61 6e 6e 65 6c 43 6f 6e 66 69 67 50 72 6f 70 65 72 74 79 00 5f 5f 69 6d EvtSetChannelConfigProperty.__im
1880 70 5f 45 76 74 53 65 74 43 68 61 6e 6e 65 6c 43 6f 6e 66 69 67 50 72 6f 70 65 72 74 79 00 5f 68 p_EvtSetChannelConfigProperty._h
18a0 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 ead_C__Users_Peter_Code_winapi_r
18c0 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 65 76 74 61 70 69 5f 61 s_x86_64_lib_libwinapi_wevtapi_a
18e0 00 0a 64 61 77 71 73 30 30 30 34 30 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 38 36 36 20 20 30 20 ..dawqs00040.o/...1516160866..0.
1900 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 36 34 35 20 20 20 20 20 20 20 60 0a 64 86 ....0.....100666..645.......`.d.
1920 07 00 00 00 00 00 7c 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 ......|............text.........
1940 00 00 08 00 00 00 2c 01 00 00 54 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 ......,...T.............0`.data.
1960 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 ..............................@.
1980 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0..bss..........................
19a0 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 ........0..idata$7............4.
19c0 00 00 5e 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 ..^.............0..idata$5......
19e0 00 00 08 00 00 00 38 01 00 00 68 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 ......8...h.............0..idata
1a00 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 72 01 00 00 00 00 00 00 01 00 00 00 00 00 $4............@...r.............
1a20 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 0a 00 00 00 48 01 00 00 00 00 00 00 00 00 0..idata$6............H.........
1a40 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ...........%....................
1a60 00 00 00 00 00 00 28 00 45 76 74 53 65 65 6b 00 00 00 02 00 00 00 08 00 00 00 04 00 00 00 00 00 ......(.EvtSeek.................
1a80 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 ...........................text.
1aa0 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 .............data..............b
1ac0 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 00 00 ss...............idata$7........
1ae0 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 ...idata$5...........idata$4....
1b00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 45 76 74 53 65 65 6b 00 .......idata$6..........EvtSeek.
1b20 00 00 00 00 01 00 00 00 02 00 00 00 00 00 04 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 00 00 ................................
1b40 12 00 00 00 00 00 00 00 00 00 00 00 02 00 55 00 00 00 5f 5f 69 6d 70 5f 45 76 74 53 65 65 6b 00 ..............U...__imp_EvtSeek.
1b60 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 _head_C__Users_Peter_Code_winapi
1b80 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 65 76 74 61 70 69 _rs_x86_64_lib_libwinapi_wevtapi
1ba0 5f 61 00 0a 64 61 77 71 73 30 30 30 33 39 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 38 36 36 20 20 _a..dawqs00039.o/...1516160866..
1bc0 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 36 39 31 20 20 20 20 20 20 20 60 0a 0.....0.....100666..691.......`.
1be0 64 86 07 00 00 00 00 00 88 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 d....................text.......
1c00 00 00 00 00 08 00 00 00 2c 01 00 00 60 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 ........,...`.............0`.dat
1c20 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a...............................
1c40 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 @.0..bss........................
1c60 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 ..........0..idata$7............
1c80 34 01 00 00 6a 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 4...j.............0..idata$5....
1ca0 00 00 00 00 08 00 00 00 38 01 00 00 74 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 ........8...t.............0..ida
1cc0 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 7e 01 00 00 00 00 00 00 01 00 00 00 ta$4............@...~...........
1ce0 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 18 00 00 00 48 01 00 00 00 00 00 00 ..0..idata$6............H.......
1d00 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 .............%..................
1d20 00 00 00 00 00 00 00 00 27 00 45 76 74 53 61 76 65 43 68 61 6e 6e 65 6c 43 6f 6e 66 69 67 00 00 ........'.EvtSaveChannelConfig..
1d40 02 00 00 00 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 ................................
1d60 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 .........text..............data.
1d80 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 .............bss...............i
1da0 64 61 74 61 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 data$7...........idata$5........
1dc0 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 ...idata$4...........idata$6....
1de0 07 00 00 00 03 00 00 00 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 19 00 00 00 ................................
1e00 00 00 00 00 05 00 00 00 02 00 00 00 00 00 34 00 00 00 00 00 00 00 00 00 00 00 02 00 77 00 00 00 ..............4.............w...
1e20 45 76 74 53 61 76 65 43 68 61 6e 6e 65 6c 43 6f 6e 66 69 67 00 5f 5f 69 6d 70 5f 45 76 74 53 61 EvtSaveChannelConfig.__imp_EvtSa
1e40 76 65 43 68 61 6e 6e 65 6c 43 6f 6e 66 69 67 00 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 veChannelConfig._head_C__Users_P
1e60 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c eter_Code_winapi_rs_x86_64_lib_l
1e80 69 62 77 69 6e 61 70 69 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 61 77 71 73 30 30 30 33 38 2e 6f ibwinapi_wevtapi_a..dawqs00038.o
1ea0 2f 20 20 20 31 35 31 36 31 36 30 38 36 36 20 20 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 /...1516160866..0.....0.....1006
1ec0 36 36 20 20 36 35 37 20 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 7c 01 00 00 0a 00 00 00 66..657.......`.d.......|.......
1ee0 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 2c 01 00 00 54 01 00 00 .....text...............,...T...
1f00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ..........0`.data...............
1f20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 ................@.0..bss........
1f40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 ..........................0..ida
1f60 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 5e 01 00 00 00 00 00 00 01 00 00 00 ta$7............4...^...........
1f80 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 38 01 00 00 68 01 00 00 ..0..idata$5............8...h...
1fa0 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 ..........0..idata$4............
1fc0 40 01 00 00 72 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 @...r.............0..idata$6....
1fe0 00 00 00 00 0c 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 ........H....................%..
2000 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 26 00 45 76 74 52 65 6e ........................&.EvtRen
2020 64 65 72 00 02 00 00 00 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 der.............................
2040 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 .............text..............d
2060 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 ata..............bss............
2080 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 ...idata$7...........idata$5....
20a0 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 .......idata$4...........idata$6
20c0 00 00 00 00 07 00 00 00 03 00 00 00 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 ................................
20e0 0e 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 02 00 ................................
2100 61 00 00 00 45 76 74 52 65 6e 64 65 72 00 5f 5f 69 6d 70 5f 45 76 74 52 65 6e 64 65 72 00 5f 68 a...EvtRender.__imp_EvtRender._h
2120 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 ead_C__Users_Peter_Code_winapi_r
2140 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 65 76 74 61 70 69 5f 61 s_x86_64_lib_libwinapi_wevtapi_a
2160 00 0a 64 61 77 71 73 30 30 30 33 37 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 38 36 36 20 20 30 20 ..dawqs00037.o/...1516160866..0.
2180 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 36 34 36 20 20 20 20 20 20 20 60 0a 64 86 ....0.....100666..646.......`.d.
21a0 07 00 00 00 00 00 7c 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 ......|............text.........
21c0 00 00 08 00 00 00 2c 01 00 00 54 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 ......,...T.............0`.data.
21e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 ..............................@.
2200 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0..bss..........................
2220 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 ........0..idata$7............4.
2240 00 00 5e 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 ..^.............0..idata$5......
2260 00 00 08 00 00 00 38 01 00 00 68 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 ......8...h.............0..idata
2280 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 72 01 00 00 00 00 00 00 01 00 00 00 00 00 $4............@...r.............
22a0 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 0c 00 00 00 48 01 00 00 00 00 00 00 00 00 0..idata$6............H.........
22c0 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ...........%....................
22e0 00 00 00 00 00 00 25 00 45 76 74 51 75 65 72 79 00 00 02 00 00 00 08 00 00 00 04 00 00 00 00 00 ......%.EvtQuery................
2300 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 ...........................text.
2320 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 .............data..............b
2340 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 00 00 ss...............idata$7........
2360 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 ...idata$5...........idata$4....
2380 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 45 76 74 51 75 65 72 79 .......idata$6..........EvtQuery
23a0 00 00 00 00 01 00 00 00 02 00 00 00 00 00 04 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 00 00 ................................
23c0 13 00 00 00 00 00 00 00 00 00 00 00 02 00 56 00 00 00 5f 5f 69 6d 70 5f 45 76 74 51 75 65 72 79 ..............V...__imp_EvtQuery
23e0 00 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 ._head_C__Users_Peter_Code_winap
2400 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 65 76 74 61 70 i_rs_x86_64_lib_libwinapi_wevtap
2420 69 5f 61 00 64 61 77 71 73 30 30 30 33 36 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 38 36 36 20 20 i_a.dawqs00036.o/...1516160866..
2440 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 36 37 35 20 20 20 20 20 20 20 60 0a 0.....0.....100666..675.......`.
2460 64 86 07 00 00 00 00 00 84 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 d....................text.......
2480 00 00 00 00 08 00 00 00 2c 01 00 00 5c 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 ........,...\.............0`.dat
24a0 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a...............................
24c0 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 @.0..bss........................
24e0 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 ..........0..idata$7............
2500 34 01 00 00 66 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 4...f.............0..idata$5....
2520 00 00 00 00 08 00 00 00 38 01 00 00 70 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 ........8...p.............0..ida
2540 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 7a 01 00 00 00 00 00 00 01 00 00 00 ta$4............@...z...........
2560 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 12 00 00 00 48 01 00 00 00 00 00 00 ..0..idata$6............H.......
2580 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 .............%..................
25a0 00 00 00 00 00 00 00 00 24 00 45 76 74 4f 70 65 6e 53 65 73 73 69 6f 6e 00 00 00 00 02 00 00 00 ........$.EvtOpenSession........
25c0 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 ................................
25e0 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 .....text..............data.....
2600 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 .........bss...............idata
2620 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 $7...........idata$5...........i
2640 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 data$4...........idata$6........
2660 03 00 00 00 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 13 00 00 00 00 00 00 00 ................................
2680 05 00 00 00 02 00 00 00 00 00 28 00 00 00 00 00 00 00 00 00 00 00 02 00 6b 00 00 00 45 76 74 4f ..........(.............k...EvtO
26a0 70 65 6e 53 65 73 73 69 6f 6e 00 5f 5f 69 6d 70 5f 45 76 74 4f 70 65 6e 53 65 73 73 69 6f 6e 00 penSession.__imp_EvtOpenSession.
26c0 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 _head_C__Users_Peter_Code_winapi
26e0 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 65 76 74 61 70 69 _rs_x86_64_lib_libwinapi_wevtapi
2700 5f 61 00 0a 64 61 77 71 73 30 30 30 33 35 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 38 36 36 20 20 _a..dawqs00035.o/...1516160866..
2720 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 37 30 33 20 20 20 20 20 20 20 60 0a 0.....0.....100666..703.......`.
2740 64 86 07 00 00 00 00 00 8c 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 d....................text.......
2760 00 00 00 00 08 00 00 00 2c 01 00 00 64 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 ........,...d.............0`.dat
2780 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a...............................
27a0 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 @.0..bss........................
27c0 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 ..........0..idata$7............
27e0 34 01 00 00 6e 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 4...n.............0..idata$5....
2800 00 00 00 00 08 00 00 00 38 01 00 00 78 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 ........8...x.............0..ida
2820 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 82 01 00 00 00 00 00 00 01 00 00 00 ta$4............@...............
2840 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 1c 00 00 00 48 01 00 00 00 00 00 00 ..0..idata$6............H.......
2860 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 .............%..................
2880 00 00 00 00 00 00 00 00 23 00 45 76 74 4f 70 65 6e 50 75 62 6c 69 73 68 65 72 4d 65 74 61 64 61 ........#.EvtOpenPublisherMetada
28a0 74 61 00 00 02 00 00 00 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 ta..............................
28c0 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 .............text..............d
28e0 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 ata..............bss............
2900 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 ...idata$7...........idata$5....
2920 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 .......idata$4...........idata$6
2940 00 00 00 00 07 00 00 00 03 00 00 00 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 ................................
2960 1d 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 02 00 ..................<.............
2980 7f 00 00 00 45 76 74 4f 70 65 6e 50 75 62 6c 69 73 68 65 72 4d 65 74 61 64 61 74 61 00 5f 5f 69 ....EvtOpenPublisherMetadata.__i
29a0 6d 70 5f 45 76 74 4f 70 65 6e 50 75 62 6c 69 73 68 65 72 4d 65 74 61 64 61 74 61 00 5f 68 65 61 mp_EvtOpenPublisherMetadata._hea
29c0 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f d_C__Users_Peter_Code_winapi_rs_
29e0 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 65 76 74 61 70 69 5f 61 00 0a x86_64_lib_libwinapi_wevtapi_a..
2a00 64 61 77 71 73 30 30 30 33 34 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 38 36 36 20 20 30 20 20 20 dawqs00034.o/...1516160866..0...
2a20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 36 39 31 20 20 20 20 20 20 20 60 0a 64 86 07 00 ..0.....100666..691.......`.d...
2a40 00 00 00 00 88 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 .................text...........
2a60 08 00 00 00 2c 01 00 00 60 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 ....,...`.............0`.data...
2a80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 ............................@.0.
2aa0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .bss............................
2ac0 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 ......0..idata$7............4...
2ae0 6a 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 j.............0..idata$5........
2b00 08 00 00 00 38 01 00 00 74 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 ....8...t.............0..idata$4
2b20 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 7e 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 ............@...~.............0.
2b40 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 18 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 .idata$6............H...........
2b60 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .........%......................
2b80 00 00 00 00 22 00 45 76 74 4f 70 65 6e 50 75 62 6c 69 73 68 65 72 45 6e 75 6d 00 00 02 00 00 00 ....".EvtOpenPublisherEnum......
2ba0 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 ................................
2bc0 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 .....text..............data.....
2be0 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 .........bss...............idata
2c00 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 $7...........idata$5...........i
2c20 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 data$4...........idata$6........
2c40 03 00 00 00 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 19 00 00 00 00 00 00 00 ................................
2c60 05 00 00 00 02 00 00 00 00 00 34 00 00 00 00 00 00 00 00 00 00 00 02 00 77 00 00 00 45 76 74 4f ..........4.............w...EvtO
2c80 70 65 6e 50 75 62 6c 69 73 68 65 72 45 6e 75 6d 00 5f 5f 69 6d 70 5f 45 76 74 4f 70 65 6e 50 75 penPublisherEnum.__imp_EvtOpenPu
2ca0 62 6c 69 73 68 65 72 45 6e 75 6d 00 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 blisherEnum._head_C__Users_Peter
2cc0 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 _Code_winapi_rs_x86_64_lib_libwi
2ce0 6e 61 70 69 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 61 77 71 73 30 30 30 33 33 2e 6f 2f 20 20 20 napi_wevtapi_a..dawqs00033.o/...
2d00 31 35 31 36 31 36 30 38 36 36 20 20 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 1516160866..0.....0.....100666..
2d20 36 36 33 20 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 80 01 00 00 0a 00 00 00 00 00 04 00 663.......`.d...................
2d40 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 2c 01 00 00 58 01 00 00 00 00 00 00 .text...............,...X.......
2d60 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ......0`.data...................
2d80 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 ............@.0..bss............
2da0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 ......................0..idata$7
2dc0 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 62 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 ............4...b.............0.
2de0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 38 01 00 00 6c 01 00 00 00 00 00 00 .idata$5............8...l.......
2e00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 ......0..idata$4............@...
2e20 76 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 v.............0..idata$6........
2e40 0e 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 ....H....................%......
2e60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 00 45 76 74 4f 70 65 6e 4c 6f 67 ....................!.EvtOpenLog
2e80 00 00 00 00 02 00 00 00 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 ................................
2ea0 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 .............text..............d
2ec0 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 ata..............bss............
2ee0 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 ...idata$7...........idata$5....
2f00 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 .......idata$4...........idata$6
2f20 00 00 00 00 07 00 00 00 03 00 00 00 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 ................................
2f40 0f 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 02 00 ................................
2f60 63 00 00 00 45 76 74 4f 70 65 6e 4c 6f 67 00 5f 5f 69 6d 70 5f 45 76 74 4f 70 65 6e 4c 6f 67 00 c...EvtOpenLog.__imp_EvtOpenLog.
2f80 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 _head_C__Users_Peter_Code_winapi
2fa0 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 65 76 74 61 70 69 _rs_x86_64_lib_libwinapi_wevtapi
2fc0 5f 61 00 0a 64 61 77 71 73 30 30 30 33 32 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 38 36 36 20 20 _a..dawqs00032.o/...1516160866..
2fe0 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 37 30 33 20 20 20 20 20 20 20 60 0a 0.....0.....100666..703.......`.
3000 64 86 07 00 00 00 00 00 8c 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 d....................text.......
3020 00 00 00 00 08 00 00 00 2c 01 00 00 64 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 ........,...d.............0`.dat
3040 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a...............................
3060 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 @.0..bss........................
3080 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 ..........0..idata$7............
30a0 34 01 00 00 6e 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 4...n.............0..idata$5....
30c0 00 00 00 00 08 00 00 00 38 01 00 00 78 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 ........8...x.............0..ida
30e0 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 82 01 00 00 00 00 00 00 01 00 00 00 ta$4............@...............
3100 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 1c 00 00 00 48 01 00 00 00 00 00 00 ..0..idata$6............H.......
3120 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 .............%..................
3140 00 00 00 00 00 00 00 00 20 00 45 76 74 4f 70 65 6e 45 76 65 6e 74 4d 65 74 61 64 61 74 61 45 6e ..........EvtOpenEventMetadataEn
3160 75 6d 00 00 02 00 00 00 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 um..............................
3180 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 .............text..............d
31a0 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 ata..............bss............
31c0 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 ...idata$7...........idata$5....
31e0 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 .......idata$4...........idata$6
3200 00 00 00 00 07 00 00 00 03 00 00 00 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 ................................
3220 1d 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 02 00 ..................<.............
3240 7f 00 00 00 45 76 74 4f 70 65 6e 45 76 65 6e 74 4d 65 74 61 64 61 74 61 45 6e 75 6d 00 5f 5f 69 ....EvtOpenEventMetadataEnum.__i
3260 6d 70 5f 45 76 74 4f 70 65 6e 45 76 65 6e 74 4d 65 74 61 64 61 74 61 45 6e 75 6d 00 5f 68 65 61 mp_EvtOpenEventMetadataEnum._hea
3280 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f d_C__Users_Peter_Code_winapi_rs_
32a0 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 65 76 74 61 70 69 5f 61 00 0a x86_64_lib_libwinapi_wevtapi_a..
32c0 64 61 77 71 73 30 30 30 33 31 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 38 36 36 20 20 30 20 20 20 dawqs00031.o/...1516160866..0...
32e0 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 36 38 37 20 20 20 20 20 20 20 60 0a 64 86 07 00 ..0.....100666..687.......`.d...
3300 00 00 00 00 88 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 .................text...........
3320 08 00 00 00 2c 01 00 00 60 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 ....,...`.............0`.data...
3340 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 ............................@.0.
3360 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .bss............................
3380 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 ......0..idata$7............4...
33a0 6a 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 j.............0..idata$5........
33c0 08 00 00 00 38 01 00 00 74 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 ....8...t.............0..idata$4
33e0 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 7e 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 ............@...~.............0.
3400 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 16 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 .idata$6............H...........
3420 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .........%......................
3440 00 00 00 00 1f 00 45 76 74 4f 70 65 6e 43 68 61 6e 6e 65 6c 45 6e 75 6d 00 00 00 00 02 00 00 00 ......EvtOpenChannelEnum........
3460 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 ................................
3480 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 .....text..............data.....
34a0 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 .........bss...............idata
34c0 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 $7...........idata$5...........i
34e0 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 data$4...........idata$6........
3500 03 00 00 00 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 17 00 00 00 00 00 00 00 ................................
3520 05 00 00 00 02 00 00 00 00 00 30 00 00 00 00 00 00 00 00 00 00 00 02 00 73 00 00 00 45 76 74 4f ..........0.............s...EvtO
3540 70 65 6e 43 68 61 6e 6e 65 6c 45 6e 75 6d 00 5f 5f 69 6d 70 5f 45 76 74 4f 70 65 6e 43 68 61 6e penChannelEnum.__imp_EvtOpenChan
3560 6e 65 6c 45 6e 75 6d 00 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 nelEnum._head_C__Users_Peter_Cod
3580 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 e_winapi_rs_x86_64_lib_libwinapi
35a0 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 61 77 71 73 30 30 30 33 30 2e 6f 2f 20 20 20 31 35 31 36 _wevtapi_a..dawqs00030.o/...1516
35c0 31 36 30 38 36 36 20 20 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 36 39 31 20 160866..0.....0.....100666..691.
35e0 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 88 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 ......`.d....................tex
3600 74 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 2c 01 00 00 60 01 00 00 00 00 00 00 01 00 00 00 t...............,...`...........
3620 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ..0`.data.......................
3640 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........@.0..bss................
3660 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 ..................0..idata$7....
3680 00 00 00 00 04 00 00 00 34 01 00 00 6a 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 ........4...j.............0..ida
36a0 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 38 01 00 00 74 01 00 00 00 00 00 00 01 00 00 00 ta$5............8...t...........
36c0 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 7e 01 00 00 ..0..idata$4............@...~...
36e0 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 18 00 00 00 ..........0..idata$6............
3700 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 H....................%..........
3720 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1e 00 45 76 74 4f 70 65 6e 43 68 61 6e 6e 65 6c ..................EvtOpenChannel
3740 43 6f 6e 66 69 67 00 00 02 00 00 00 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 Config..........................
3760 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 .................text...........
3780 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 ...data..............bss........
37a0 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 .......idata$7...........idata$5
37c0 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 ...........idata$4...........ida
37e0 74 61 24 36 00 00 00 00 07 00 00 00 03 00 00 00 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 ta$6............................
3800 00 00 00 00 19 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 00 00 34 00 00 00 00 00 00 00 00 00 ......................4.........
3820 00 00 02 00 77 00 00 00 45 76 74 4f 70 65 6e 43 68 61 6e 6e 65 6c 43 6f 6e 66 69 67 00 5f 5f 69 ....w...EvtOpenChannelConfig.__i
3840 6d 70 5f 45 76 74 4f 70 65 6e 43 68 61 6e 6e 65 6c 43 6f 6e 66 69 67 00 5f 68 65 61 64 5f 43 5f mp_EvtOpenChannelConfig._head_C_
3860 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f _Users_Peter_Code_winapi_rs_x86_
3880 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 61 77 71 64_lib_libwinapi_wevtapi_a..dawq
38a0 73 30 30 30 32 39 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 38 36 36 20 20 30 20 20 20 20 20 30 20 s00029.o/...1516160866..0.....0.
38c0 20 20 20 20 31 30 30 36 36 36 20 20 36 38 37 20 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 ....100666..687.......`.d.......
38e0 88 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 .............text...............
3900 2c 01 00 00 60 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 ,...`.............0`.data.......
3920 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 ........................@.0..bss
3940 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................................
3960 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 6a 01 00 00 ..0..idata$7............4...j...
3980 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 ..........0..idata$5............
39a0 38 01 00 00 74 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 8...t.............0..idata$4....
39c0 00 00 00 00 08 00 00 00 40 01 00 00 7e 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 ........@...~.............0..ida
39e0 74 61 24 36 00 00 00 00 00 00 00 00 16 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ta$6............H...............
3a00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .....%..........................
3a20 1d 00 45 76 74 4e 65 78 74 50 75 62 6c 69 73 68 65 72 49 64 00 00 00 00 02 00 00 00 08 00 00 00 ..EvtNextPublisherId............
3a40 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 ................................
3a60 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 .text..............data.........
3a80 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 .....bss...............idata$7..
3aa0 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 .........idata$5...........idata
3ac0 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 00 00 $4...........idata$6............
3ae0 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 17 00 00 00 00 00 00 00 05 00 00 00 ................................
3b00 02 00 00 00 00 00 30 00 00 00 00 00 00 00 00 00 00 00 02 00 73 00 00 00 45 76 74 4e 65 78 74 50 ......0.............s...EvtNextP
3b20 75 62 6c 69 73 68 65 72 49 64 00 5f 5f 69 6d 70 5f 45 76 74 4e 65 78 74 50 75 62 6c 69 73 68 65 ublisherId.__imp_EvtNextPublishe
3b40 72 49 64 00 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 rId._head_C__Users_Peter_Code_wi
3b60 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 65 76 napi_rs_x86_64_lib_libwinapi_wev
3b80 74 61 70 69 5f 61 00 0a 64 61 77 71 73 30 30 30 32 38 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 38 tapi_a..dawqs00028.o/...15161608
3ba0 36 36 20 20 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 36 39 31 20 20 20 20 20 66..0.....0.....100666..691.....
3bc0 20 20 60 0a 64 86 07 00 00 00 00 00 88 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 ..`.d....................text...
3be0 00 00 00 00 00 00 00 00 08 00 00 00 2c 01 00 00 60 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 ............,...`.............0`
3c00 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .data...........................
3c20 00 00 00 00 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ....@.0..bss....................
3c40 00 00 00 00 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 ..............0..idata$7........
3c60 04 00 00 00 34 01 00 00 6a 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 ....4...j.............0..idata$5
3c80 00 00 00 00 00 00 00 00 08 00 00 00 38 01 00 00 74 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 ............8...t.............0.
3ca0 2e 69 64 61 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 7e 01 00 00 00 00 00 00 .idata$4............@...~.......
3cc0 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 18 00 00 00 48 01 00 00 ......0..idata$6............H...
3ce0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 .................%..............
3d00 00 00 00 00 00 00 00 00 00 00 00 00 1c 00 45 76 74 4e 65 78 74 45 76 65 6e 74 4d 65 74 61 64 61 ..............EvtNextEventMetada
3d20 74 61 00 00 02 00 00 00 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 ta..............................
3d40 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 .............text..............d
3d60 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 ata..............bss............
3d80 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 ...idata$7...........idata$5....
3da0 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 .......idata$4...........idata$6
3dc0 00 00 00 00 07 00 00 00 03 00 00 00 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 ................................
3de0 19 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 00 00 34 00 00 00 00 00 00 00 00 00 00 00 02 00 ..................4.............
3e00 77 00 00 00 45 76 74 4e 65 78 74 45 76 65 6e 74 4d 65 74 61 64 61 74 61 00 5f 5f 69 6d 70 5f 45 w...EvtNextEventMetadata.__imp_E
3e20 76 74 4e 65 78 74 45 76 65 6e 74 4d 65 74 61 64 61 74 61 00 5f 68 65 61 64 5f 43 5f 5f 55 73 65 vtNextEventMetadata._head_C__Use
3e40 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c rs_Peter_Code_winapi_rs_x86_64_l
3e60 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 61 77 71 73 30 30 30 ib_libwinapi_wevtapi_a..dawqs000
3e80 32 37 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 38 36 36 20 20 30 20 20 20 20 20 30 20 20 20 20 20 27.o/...1516160866..0.....0.....
3ea0 31 30 30 36 36 36 20 20 36 38 37 20 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 88 01 00 00 100666..687.......`.d...........
3ec0 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 2c 01 00 00 .........text...............,...
3ee0 60 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 00 00 `.............0`.data...........
3f00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 00 00 00 00 ....................@.0..bss....
3f20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 30 c0 ..............................0.
3f40 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 6a 01 00 00 00 00 00 00 .idata$7............4...j.......
3f60 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 38 01 00 00 ......0..idata$5............8...
3f80 74 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 00 00 00 00 t.............0..idata$4........
3fa0 08 00 00 00 40 01 00 00 7e 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 36 ....@...~.............0..idata$6
3fc0 00 00 00 00 00 00 00 00 16 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 c0 ............H...................
3fe0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1b 00 45 76 .%............................Ev
4000 74 4e 65 78 74 43 68 61 6e 6e 65 6c 50 61 74 68 00 00 00 00 02 00 00 00 08 00 00 00 04 00 00 00 tNextChannelPath................
4020 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 .............................tex
4040 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 t..............data.............
4060 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 .bss...............idata$7......
4080 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 .....idata$5...........idata$4..
40a0 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 00 00 00 00 04 00 .........idata$6................
40c0 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 17 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 ................................
40e0 00 00 30 00 00 00 00 00 00 00 00 00 00 00 02 00 73 00 00 00 45 76 74 4e 65 78 74 43 68 61 6e 6e ..0.............s...EvtNextChann
4100 65 6c 50 61 74 68 00 5f 5f 69 6d 70 5f 45 76 74 4e 65 78 74 43 68 61 6e 6e 65 6c 50 61 74 68 00 elPath.__imp_EvtNextChannelPath.
4120 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 _head_C__Users_Peter_Code_winapi
4140 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 65 76 74 61 70 69 _rs_x86_64_lib_libwinapi_wevtapi
4160 5f 61 00 0a 64 61 77 71 73 30 30 30 32 36 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 38 36 36 20 20 _a..dawqs00026.o/...1516160866..
4180 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 36 34 35 20 20 20 20 20 20 20 60 0a 0.....0.....100666..645.......`.
41a0 64 86 07 00 00 00 00 00 7c 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 d.......|............text.......
41c0 00 00 00 00 08 00 00 00 2c 01 00 00 54 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 ........,...T.............0`.dat
41e0 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a...............................
4200 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 @.0..bss........................
4220 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 ..........0..idata$7............
4240 34 01 00 00 5e 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 4...^.............0..idata$5....
4260 00 00 00 00 08 00 00 00 38 01 00 00 68 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 ........8...h.............0..ida
4280 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 72 01 00 00 00 00 00 00 01 00 00 00 ta$4............@...r...........
42a0 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 0a 00 00 00 48 01 00 00 00 00 00 00 ..0..idata$6............H.......
42c0 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 .............%..................
42e0 00 00 00 00 00 00 00 00 1a 00 45 76 74 4e 65 78 74 00 00 00 02 00 00 00 08 00 00 00 04 00 00 00 ..........EvtNext...............
4300 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 .............................tex
4320 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 t..............data.............
4340 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 .bss...............idata$7......
4360 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 .....idata$5...........idata$4..
4380 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 45 76 74 4e 65 78 .........idata$6..........EvtNex
43a0 74 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 04 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 t...............................
43c0 00 00 12 00 00 00 00 00 00 00 00 00 00 00 02 00 55 00 00 00 5f 5f 69 6d 70 5f 45 76 74 4e 65 78 ................U...__imp_EvtNex
43e0 74 00 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 t._head_C__Users_Peter_Code_wina
4400 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 65 76 74 61 pi_rs_x86_64_lib_libwinapi_wevta
4420 70 69 5f 61 00 0a 64 61 77 71 73 30 30 30 32 35 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 38 36 36 pi_a..dawqs00025.o/...1516160866
4440 20 20 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 37 32 39 20 20 20 20 20 20 20 ..0.....0.....100666..729.......
4460 60 0a 64 86 07 00 00 00 00 00 94 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 `.d....................text.....
4480 00 00 00 00 00 00 08 00 00 00 2c 01 00 00 6c 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 ..........,...l.............0`.d
44a0 61 74 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ata.............................
44c0 00 00 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ..@.0..bss......................
44e0 00 00 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 ............0..idata$7..........
4500 00 00 34 01 00 00 76 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 ..4...v.............0..idata$5..
4520 00 00 00 00 00 00 08 00 00 00 38 01 00 00 80 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 ..........8.................0..i
4540 64 61 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 8a 01 00 00 00 00 00 00 01 00 data$4............@.............
4560 00 00 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 24 00 00 00 48 01 00 00 00 00 ....0..idata$6........$...H.....
4580 00 00 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 ...............%................
45a0 00 00 00 00 00 00 00 00 00 00 19 00 45 76 74 49 6e 74 57 72 69 74 65 58 6d 6c 45 76 65 6e 74 54 ............EvtIntWriteXmlEventT
45c0 6f 4c 6f 63 61 6c 4c 6f 67 66 69 6c 65 00 02 00 00 00 08 00 00 00 04 00 00 00 00 00 09 00 00 00 oLocalLogfile...................
45e0 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 .......................text.....
4600 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 .........data..............bss..
4620 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 .............idata$7...........i
4640 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 00 00 data$5...........idata$4........
4660 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 00 00 00 00 04 00 00 00 00 00 00 00 ...idata$6......................
4680 01 00 00 00 02 00 00 00 00 00 26 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 00 00 4e 00 00 00 ..........&.................N...
46a0 00 00 00 00 00 00 00 00 02 00 91 00 00 00 45 76 74 49 6e 74 57 72 69 74 65 58 6d 6c 45 76 65 6e ..............EvtIntWriteXmlEven
46c0 74 54 6f 4c 6f 63 61 6c 4c 6f 67 66 69 6c 65 00 5f 5f 69 6d 70 5f 45 76 74 49 6e 74 57 72 69 74 tToLocalLogfile.__imp_EvtIntWrit
46e0 65 58 6d 6c 45 76 65 6e 74 54 6f 4c 6f 63 61 6c 4c 6f 67 66 69 6c 65 00 5f 68 65 61 64 5f 43 5f eXmlEventToLocalLogfile._head_C_
4700 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f _Users_Peter_Code_winapi_rs_x86_
4720 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 61 77 71 64_lib_libwinapi_wevtapi_a..dawq
4740 73 30 30 30 32 34 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 38 36 36 20 20 30 20 20 20 20 20 30 20 s00024.o/...1516160866..0.....0.
4760 20 20 20 20 31 30 30 36 36 36 20 20 36 38 39 20 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 ....100666..689.......`.d.......
4780 88 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 .............text...............
47a0 2c 01 00 00 60 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 ,...`.............0`.data.......
47c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 ........................@.0..bss
47e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................................
4800 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 6a 01 00 00 ..0..idata$7............4...j...
4820 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 ..........0..idata$5............
4840 38 01 00 00 74 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 8...t.............0..idata$4....
4860 00 00 00 00 08 00 00 00 40 01 00 00 7e 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 ........@...~.............0..ida
4880 74 61 24 36 00 00 00 00 00 00 00 00 16 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ta$6............H...............
48a0 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .....%..........................
48c0 18 00 45 76 74 49 6e 74 52 65 74 72 61 63 74 43 6f 6e 66 69 67 00 00 00 02 00 00 00 08 00 00 00 ..EvtIntRetractConfig...........
48e0 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 ................................
4900 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 .text..............data.........
4920 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 .....bss...............idata$7..
4940 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 .........idata$5...........idata
4960 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 00 00 $4...........idata$6............
4980 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 18 00 00 00 00 00 00 00 05 00 00 00 ................................
49a0 02 00 00 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 02 00 75 00 00 00 45 76 74 49 6e 74 52 65 ......2.............u...EvtIntRe
49c0 74 72 61 63 74 43 6f 6e 66 69 67 00 5f 5f 69 6d 70 5f 45 76 74 49 6e 74 52 65 74 72 61 63 74 43 tractConfig.__imp_EvtIntRetractC
49e0 6f 6e 66 69 67 00 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f onfig._head_C__Users_Peter_Code_
4a00 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 winapi_rs_x86_64_lib_libwinapi_w
4a20 65 76 74 61 70 69 5f 61 00 0a 64 61 77 71 73 30 30 30 32 33 2e 6f 2f 20 20 20 31 35 31 36 31 36 evtapi_a..dawqs00023.o/...151616
4a40 30 38 36 36 20 20 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 37 32 35 20 20 20 0866..0.....0.....100666..725...
4a60 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 94 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 ....`.d....................text.
4a80 00 00 00 00 00 00 00 00 00 00 08 00 00 00 2c 01 00 00 6c 01 00 00 00 00 00 00 01 00 00 00 20 00 ..............,...l.............
4aa0 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0`.data.........................
4ac0 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ......@.0..bss..................
4ae0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 ................0..idata$7......
4b00 00 00 04 00 00 00 34 01 00 00 76 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 ......4...v.............0..idata
4b20 24 35 00 00 00 00 00 00 00 00 08 00 00 00 38 01 00 00 80 01 00 00 00 00 00 00 01 00 00 00 00 00 $5............8.................
4b40 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 8a 01 00 00 00 00 0..idata$4............@.........
4b60 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 22 00 00 00 48 01 ........0..idata$6........"...H.
4b80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 ...................%............
4ba0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 17 00 45 76 74 49 6e 74 52 65 70 6f 72 74 45 76 65 6e ................EvtIntReportEven
4bc0 74 41 6e 64 53 6f 75 72 63 65 41 73 79 6e 63 00 00 00 02 00 00 00 08 00 00 00 04 00 00 00 00 00 tAndSourceAsync.................
4be0 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 ...........................text.
4c00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 .............data..............b
4c20 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 00 00 ss...............idata$7........
4c40 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 ...idata$5...........idata$4....
4c60 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 00 00 00 00 04 00 00 00 .......idata$6..................
4c80 00 00 00 00 01 00 00 00 02 00 00 00 00 00 24 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 00 00 ..............$.................
4ca0 4a 00 00 00 00 00 00 00 00 00 00 00 02 00 8d 00 00 00 45 76 74 49 6e 74 52 65 70 6f 72 74 45 76 J.................EvtIntReportEv
4cc0 65 6e 74 41 6e 64 53 6f 75 72 63 65 41 73 79 6e 63 00 5f 5f 69 6d 70 5f 45 76 74 49 6e 74 52 65 entAndSourceAsync.__imp_EvtIntRe
4ce0 70 6f 72 74 45 76 65 6e 74 41 6e 64 53 6f 75 72 63 65 41 73 79 6e 63 00 5f 68 65 61 64 5f 43 5f portEventAndSourceAsync._head_C_
4d00 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f _Users_Peter_Code_winapi_rs_x86_
4d20 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 61 77 71 64_lib_libwinapi_wevtapi_a..dawq
4d40 73 30 30 30 32 32 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 38 36 36 20 20 30 20 20 20 20 20 30 20 s00022.o/...1516160866..0.....0.
4d60 20 20 20 20 31 30 30 36 36 36 20 20 37 33 39 20 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 ....100666..739.......`.d.......
4d80 98 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 .............text...............
4da0 2c 01 00 00 70 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 ,...p.............0`.data.......
4dc0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 ........................@.0..bss
4de0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................................
4e00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 7a 01 00 00 ..0..idata$7............4...z...
4e20 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 ..........0..idata$5............
4e40 38 01 00 00 84 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 8.................0..idata$4....
4e60 00 00 00 00 08 00 00 00 40 01 00 00 8e 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 ........@.................0..ida
4e80 74 61 24 36 00 00 00 00 00 00 00 00 28 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ta$6........(...H...............
4ea0 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .....%..........................
4ec0 16 00 45 76 74 49 6e 74 52 65 70 6f 72 74 41 75 74 68 7a 45 76 65 6e 74 41 6e 64 53 6f 75 72 63 ..EvtIntReportAuthzEventAndSourc
4ee0 65 41 73 79 6e 63 00 00 02 00 00 00 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 eAsync..........................
4f00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 .................text...........
4f20 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 ...data..............bss........
4f40 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 .......idata$7...........idata$5
4f60 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 ...........idata$4...........ida
4f80 74 61 24 36 00 00 00 00 07 00 00 00 03 00 00 00 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 ta$6............................
4fa0 00 00 00 00 29 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 00 00 54 00 00 00 00 00 00 00 00 00 ....).................T.........
4fc0 00 00 02 00 97 00 00 00 45 76 74 49 6e 74 52 65 70 6f 72 74 41 75 74 68 7a 45 76 65 6e 74 41 6e ........EvtIntReportAuthzEventAn
4fe0 64 53 6f 75 72 63 65 41 73 79 6e 63 00 5f 5f 69 6d 70 5f 45 76 74 49 6e 74 52 65 70 6f 72 74 41 dSourceAsync.__imp_EvtIntReportA
5000 75 74 68 7a 45 76 65 6e 74 41 6e 64 53 6f 75 72 63 65 41 73 79 6e 63 00 5f 68 65 61 64 5f 43 5f uthzEventAndSourceAsync._head_C_
5020 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f _Users_Peter_Code_winapi_rs_x86_
5040 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 61 77 71 64_lib_libwinapi_wevtapi_a..dawq
5060 73 30 30 30 32 31 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 38 36 36 20 20 30 20 20 20 20 20 30 20 s00021.o/...1516160866..0.....0.
5080 20 20 20 20 31 30 30 36 36 36 20 20 37 32 39 20 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 ....100666..729.......`.d.......
50a0 94 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 .............text...............
50c0 2c 01 00 00 6c 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 ,...l.............0`.data.......
50e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 ........................@.0..bss
5100 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................................
5120 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 76 01 00 00 ..0..idata$7............4...v...
5140 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 ..........0..idata$5............
5160 38 01 00 00 80 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 8.................0..idata$4....
5180 00 00 00 00 08 00 00 00 40 01 00 00 8a 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 ........@.................0..ida
51a0 74 61 24 36 00 00 00 00 00 00 00 00 24 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ta$6........$...H...............
51c0 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .....%..........................
51e0 15 00 45 76 74 49 6e 74 52 65 6e 64 65 72 52 65 73 6f 75 72 63 65 45 76 65 6e 74 54 65 6d 70 6c ..EvtIntRenderResourceEventTempl
5200 61 74 65 00 02 00 00 00 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 ate.............................
5220 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 .............text..............d
5240 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 ata..............bss............
5260 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 ...idata$7...........idata$5....
5280 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 .......idata$4...........idata$6
52a0 00 00 00 00 07 00 00 00 03 00 00 00 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 ................................
52c0 26 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 00 00 4e 00 00 00 00 00 00 00 00 00 00 00 02 00 &.................N.............
52e0 91 00 00 00 45 76 74 49 6e 74 52 65 6e 64 65 72 52 65 73 6f 75 72 63 65 45 76 65 6e 74 54 65 6d ....EvtIntRenderResourceEventTem
5300 70 6c 61 74 65 00 5f 5f 69 6d 70 5f 45 76 74 49 6e 74 52 65 6e 64 65 72 52 65 73 6f 75 72 63 65 plate.__imp_EvtIntRenderResource
5320 45 76 65 6e 74 54 65 6d 70 6c 61 74 65 00 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 EventTemplate._head_C__Users_Pet
5340 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 er_Code_winapi_rs_x86_64_lib_lib
5360 77 69 6e 61 70 69 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 61 77 71 73 30 30 30 32 30 2e 6f 2f 20 winapi_wevtapi_a..dawqs00020.o/.
5380 20 20 31 35 31 36 31 36 30 38 36 36 20 20 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 ..1516160866..0.....0.....100666
53a0 20 20 37 32 33 20 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 94 01 00 00 0a 00 00 00 00 00 ..723.......`.d.................
53c0 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 2c 01 00 00 6c 01 00 00 00 00 ...text...............,...l.....
53e0 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........0`.data.................
5400 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 ..............@.0..bss..........
5420 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 ........................0..idata
5440 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 76 01 00 00 00 00 00 00 01 00 00 00 00 00 $7............4...v.............
5460 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 38 01 00 00 80 01 00 00 00 00 0..idata$5............8.........
5480 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 ........0..idata$4............@.
54a0 00 00 8a 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 ................0..idata$6......
54c0 00 00 22 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 .."...H....................%....
54e0 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 14 00 45 76 74 49 6e 74 47 65 ........................EvtIntGe
5500 74 43 6c 61 73 73 69 63 4c 6f 67 44 69 73 70 6c 61 79 4e 61 6d 65 00 00 00 00 02 00 00 00 08 00 tClassicLogDisplayName..........
5520 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 ................................
5540 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 ...text..............data.......
5560 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 .......bss...............idata$7
5580 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 ...........idata$5...........ida
55a0 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 ta$4...........idata$6..........
55c0 00 00 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 23 00 00 00 00 00 00 00 05 00 ......................#.........
55e0 00 00 02 00 00 00 00 00 48 00 00 00 00 00 00 00 00 00 00 00 02 00 8b 00 00 00 45 76 74 49 6e 74 ........H.................EvtInt
5600 47 65 74 43 6c 61 73 73 69 63 4c 6f 67 44 69 73 70 6c 61 79 4e 61 6d 65 00 5f 5f 69 6d 70 5f 45 GetClassicLogDisplayName.__imp_E
5620 76 74 49 6e 74 47 65 74 43 6c 61 73 73 69 63 4c 6f 67 44 69 73 70 6c 61 79 4e 61 6d 65 00 5f 68 vtIntGetClassicLogDisplayName._h
5640 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 ead_C__Users_Peter_Code_winapi_r
5660 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 65 76 74 61 70 69 5f 61 s_x86_64_lib_libwinapi_wevtapi_a
5680 00 0a 64 61 77 71 73 30 30 30 31 39 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 38 36 36 20 20 30 20 ..dawqs00019.o/...1516160866..0.
56a0 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 37 30 33 20 20 20 20 20 20 20 60 0a 64 86 ....0.....100666..703.......`.d.
56c0 07 00 00 00 00 00 8c 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 ...................text.........
56e0 00 00 08 00 00 00 2c 01 00 00 64 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 ......,...d.............0`.data.
5700 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 ..............................@.
5720 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0..bss..........................
5740 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 ........0..idata$7............4.
5760 00 00 6e 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 ..n.............0..idata$5......
5780 00 00 08 00 00 00 38 01 00 00 78 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 ......8...x.............0..idata
57a0 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 82 01 00 00 00 00 00 00 01 00 00 00 00 00 $4............@.................
57c0 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 1c 00 00 00 48 01 00 00 00 00 00 00 00 00 0..idata$6............H.........
57e0 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ...........%....................
5800 00 00 00 00 00 00 13 00 45 76 74 49 6e 74 43 72 65 61 74 65 4c 6f 63 61 6c 4c 6f 67 66 69 6c 65 ........EvtIntCreateLocalLogfile
5820 00 00 02 00 00 00 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 ................................
5840 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 ...........text..............dat
5860 61 00 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 a..............bss..............
5880 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 .idata$7...........idata$5......
58a0 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 .....idata$4...........idata$6..
58c0 00 00 07 00 00 00 03 00 00 00 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 1d 00 ................................
58e0 00 00 00 00 00 00 05 00 00 00 02 00 00 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 02 00 7f 00 ................<...............
5900 00 00 45 76 74 49 6e 74 43 72 65 61 74 65 4c 6f 63 61 6c 4c 6f 67 66 69 6c 65 00 5f 5f 69 6d 70 ..EvtIntCreateLocalLogfile.__imp
5920 5f 45 76 74 49 6e 74 43 72 65 61 74 65 4c 6f 63 61 6c 4c 6f 67 66 69 6c 65 00 5f 68 65 61 64 5f _EvtIntCreateLocalLogfile._head_
5940 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 C__Users_Peter_Code_winapi_rs_x8
5960 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 61 6_64_lib_libwinapi_wevtapi_a..da
5980 77 71 73 30 30 30 31 38 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 38 36 36 20 20 30 20 20 20 20 20 wqs00018.o/...1516160866..0.....
59a0 30 20 20 20 20 20 31 30 30 36 36 36 20 20 37 32 35 20 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 0.....100666..725.......`.d.....
59c0 00 00 94 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 08 00 ...............text.............
59e0 00 00 2c 01 00 00 6c 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 ..,...l.............0`.data.....
5a00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 ..........................@.0..b
5a20 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ss..............................
5a40 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 76 01 ....0..idata$7............4...v.
5a60 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 08 00 ............0..idata$5..........
5a80 00 00 38 01 00 00 80 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 ..8.................0..idata$4..
5aa0 00 00 00 00 00 00 08 00 00 00 40 01 00 00 8a 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 ..........@.................0..i
5ac0 64 61 74 61 24 36 00 00 00 00 00 00 00 00 22 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 data$6........"...H.............
5ae0 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .......%........................
5b00 00 00 12 00 45 76 74 49 6e 74 43 72 65 61 74 65 42 69 6e 58 4d 4c 46 72 6f 6d 43 75 73 74 6f 6d ....EvtIntCreateBinXMLFromCustom
5b20 58 4d 4c 00 00 00 02 00 00 00 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 XML.............................
5b40 00 00 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 ...............text.............
5b60 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 .data..............bss..........
5b80 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 .....idata$7...........idata$5..
5ba0 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 .........idata$4...........idata
5bc0 24 36 00 00 00 00 07 00 00 00 03 00 00 00 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 $6..............................
5be0 00 00 24 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 00 00 4a 00 00 00 00 00 00 00 00 00 00 00 ..$.................J...........
5c00 02 00 8d 00 00 00 45 76 74 49 6e 74 43 72 65 61 74 65 42 69 6e 58 4d 4c 46 72 6f 6d 43 75 73 74 ......EvtIntCreateBinXMLFromCust
5c20 6f 6d 58 4d 4c 00 5f 5f 69 6d 70 5f 45 76 74 49 6e 74 43 72 65 61 74 65 42 69 6e 58 4d 4c 46 72 omXML.__imp_EvtIntCreateBinXMLFr
5c40 6f 6d 43 75 73 74 6f 6d 58 4d 4c 00 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 omCustomXML._head_C__Users_Peter
5c60 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 _Code_winapi_rs_x86_64_lib_libwi
5c80 6e 61 70 69 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 61 77 71 73 30 30 30 31 37 2e 6f 2f 20 20 20 napi_wevtapi_a..dawqs00017.o/...
5ca0 31 35 31 36 31 36 30 38 36 36 20 20 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 1516160866..0.....0.....100666..
5cc0 36 38 37 20 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 88 01 00 00 0a 00 00 00 00 00 04 00 687.......`.d...................
5ce0 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 2c 01 00 00 60 01 00 00 00 00 00 00 .text...............,...`.......
5d00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ......0`.data...................
5d20 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 ............@.0..bss............
5d40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 ......................0..idata$7
5d60 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 6a 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 ............4...j.............0.
5d80 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 38 01 00 00 74 01 00 00 00 00 00 00 .idata$5............8...t.......
5da0 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 ......0..idata$4............@...
5dc0 7e 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 ~.............0..idata$6........
5de0 16 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 ....H....................%......
5e00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 00 45 76 74 49 6e 74 41 73 73 65 ......................EvtIntAsse
5e20 72 74 43 6f 6e 66 69 67 00 00 00 00 02 00 00 00 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 rtConfig........................
5e40 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 .....................text.......
5e60 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 .......data..............bss....
5e80 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 ...........idata$7...........ida
5ea0 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 ta$5...........idata$4..........
5ec0 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 00 00 00 00 04 00 00 00 00 00 00 00 01 00 .idata$6........................
5ee0 00 00 02 00 00 00 00 00 17 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 00 00 30 00 00 00 00 00 ..........................0.....
5f00 00 00 00 00 00 00 02 00 73 00 00 00 45 76 74 49 6e 74 41 73 73 65 72 74 43 6f 6e 66 69 67 00 5f ........s...EvtIntAssertConfig._
5f20 5f 69 6d 70 5f 45 76 74 49 6e 74 41 73 73 65 72 74 43 6f 6e 66 69 67 00 5f 68 65 61 64 5f 43 5f _imp_EvtIntAssertConfig._head_C_
5f40 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f _Users_Peter_Code_winapi_rs_x86_
5f60 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 61 77 71 64_lib_libwinapi_wevtapi_a..dawq
5f80 73 30 30 30 31 36 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 38 36 36 20 20 30 20 20 20 20 20 30 20 s00016.o/...1516160866..0.....0.
5fa0 20 20 20 20 31 30 30 36 36 36 20 20 36 37 37 20 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 ....100666..677.......`.d.......
5fc0 84 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 .............text...............
5fe0 2c 01 00 00 5c 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 ,...\.............0`.data.......
6000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 ........................@.0..bss
6020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................................
6040 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 66 01 00 00 ..0..idata$7............4...f...
6060 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 ..........0..idata$5............
6080 38 01 00 00 70 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 8...p.............0..idata$4....
60a0 00 00 00 00 08 00 00 00 40 01 00 00 7a 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 ........@...z.............0..ida
60c0 74 61 24 36 00 00 00 00 00 00 00 00 12 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ta$6............H...............
60e0 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .....%..........................
6100 10 00 45 76 74 47 65 74 51 75 65 72 79 49 6e 66 6f 00 00 00 02 00 00 00 08 00 00 00 04 00 00 00 ..EvtGetQueryInfo...............
6120 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 .............................tex
6140 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 t..............data.............
6160 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 .bss...............idata$7......
6180 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 .....idata$5...........idata$4..
61a0 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 00 00 00 00 04 00 .........idata$6................
61c0 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 14 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 ................................
61e0 00 00 2a 00 00 00 00 00 00 00 00 00 00 00 02 00 6d 00 00 00 45 76 74 47 65 74 51 75 65 72 79 49 ..*.............m...EvtGetQueryI
6200 6e 66 6f 00 5f 5f 69 6d 70 5f 45 76 74 47 65 74 51 75 65 72 79 49 6e 66 6f 00 5f 68 65 61 64 5f nfo.__imp_EvtGetQueryInfo._head_
6220 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 C__Users_Peter_Code_winapi_rs_x8
6240 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 61 6_64_lib_libwinapi_wevtapi_a..da
6260 77 71 73 30 30 30 31 35 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 38 36 36 20 20 30 20 20 20 20 20 wqs00015.o/...1516160866..0.....
6280 30 20 20 20 20 20 31 30 30 36 36 36 20 20 37 32 35 20 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 0.....100666..725.......`.d.....
62a0 00 00 94 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 08 00 ...............text.............
62c0 00 00 2c 01 00 00 6c 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 ..,...l.............0`.data.....
62e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 ..........................@.0..b
6300 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ss..............................
6320 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 76 01 ....0..idata$7............4...v.
6340 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 08 00 ............0..idata$5..........
6360 00 00 38 01 00 00 80 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 ..8.................0..idata$4..
6380 00 00 00 00 00 00 08 00 00 00 40 01 00 00 8a 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 ..........@.................0..i
63a0 64 61 74 61 24 36 00 00 00 00 00 00 00 00 22 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 data$6........"...H.............
63c0 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .......%........................
63e0 00 00 0f 00 45 76 74 47 65 74 50 75 62 6c 69 73 68 65 72 4d 65 74 61 64 61 74 61 50 72 6f 70 65 ....EvtGetPublisherMetadataPrope
6400 72 74 79 00 00 00 02 00 00 00 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 rty.............................
6420 00 00 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 ...............text.............
6440 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 .data..............bss..........
6460 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 .....idata$7...........idata$5..
6480 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 .........idata$4...........idata
64a0 24 36 00 00 00 00 07 00 00 00 03 00 00 00 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 $6..............................
64c0 00 00 24 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 00 00 4a 00 00 00 00 00 00 00 00 00 00 00 ..$.................J...........
64e0 02 00 8d 00 00 00 45 76 74 47 65 74 50 75 62 6c 69 73 68 65 72 4d 65 74 61 64 61 74 61 50 72 6f ......EvtGetPublisherMetadataPro
6500 70 65 72 74 79 00 5f 5f 69 6d 70 5f 45 76 74 47 65 74 50 75 62 6c 69 73 68 65 72 4d 65 74 61 64 perty.__imp_EvtGetPublisherMetad
6520 61 74 61 50 72 6f 70 65 72 74 79 00 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 ataProperty._head_C__Users_Peter
6540 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 _Code_winapi_rs_x86_64_lib_libwi
6560 6e 61 70 69 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 61 77 71 73 30 30 30 31 34 2e 6f 2f 20 20 20 napi_wevtapi_a..dawqs00014.o/...
6580 31 35 31 36 31 36 30 38 36 36 20 20 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 1516160866..0.....0.....100666..
65a0 36 39 33 20 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 88 01 00 00 0a 00 00 00 00 00 04 00 693.......`.d...................
65c0 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 2c 01 00 00 60 01 00 00 00 00 00 00 .text...............,...`.......
65e0 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ......0`.data...................
6600 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 ............@.0..bss............
6620 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 ......................0..idata$7
6640 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 6a 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 ............4...j.............0.
6660 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 38 01 00 00 74 01 00 00 00 00 00 00 .idata$5............8...t.......
6680 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 ......0..idata$4............@...
66a0 7e 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 ~.............0..idata$6........
66c0 18 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 ....H....................%......
66e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0e 00 45 76 74 47 65 74 4f 62 6a 65 ......................EvtGetObje
6700 63 74 41 72 72 61 79 53 69 7a 65 00 02 00 00 00 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 ctArraySize.....................
6720 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 .....................text.......
6740 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 .......data..............bss....
6760 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 ...........idata$7...........ida
6780 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 ta$5...........idata$4..........
67a0 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 00 00 00 00 04 00 00 00 00 00 00 00 01 00 .idata$6........................
67c0 00 00 02 00 00 00 00 00 1a 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 00 00 36 00 00 00 00 00 ..........................6.....
67e0 00 00 00 00 00 00 02 00 79 00 00 00 45 76 74 47 65 74 4f 62 6a 65 63 74 41 72 72 61 79 53 69 7a ........y...EvtGetObjectArraySiz
6800 65 00 5f 5f 69 6d 70 5f 45 76 74 47 65 74 4f 62 6a 65 63 74 41 72 72 61 79 53 69 7a 65 00 5f 68 e.__imp_EvtGetObjectArraySize._h
6820 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 ead_C__Users_Peter_Code_winapi_r
6840 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 65 76 74 61 70 69 5f 61 s_x86_64_lib_libwinapi_wevtapi_a
6860 00 0a 64 61 77 71 73 30 30 30 31 33 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 38 36 36 20 20 30 20 ..dawqs00013.o/...1516160866..0.
6880 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 37 30 35 20 20 20 20 20 20 20 60 0a 64 86 ....0.....100666..705.......`.d.
68a0 07 00 00 00 00 00 8c 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 ...................text.........
68c0 00 00 08 00 00 00 2c 01 00 00 64 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 ......,...d.............0`.data.
68e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 ..............................@.
6900 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0..bss..........................
6920 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 ........0..idata$7............4.
6940 00 00 6e 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 ..n.............0..idata$5......
6960 00 00 08 00 00 00 38 01 00 00 78 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 ......8...x.............0..idata
6980 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 82 01 00 00 00 00 00 00 01 00 00 00 00 00 $4............@.................
69a0 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 1c 00 00 00 48 01 00 00 00 00 00 00 00 00 0..idata$6............H.........
69c0 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ...........%....................
69e0 00 00 00 00 00 00 0d 00 45 76 74 47 65 74 4f 62 6a 65 63 74 41 72 72 61 79 50 72 6f 70 65 72 74 ........EvtGetObjectArrayPropert
6a00 79 00 02 00 00 00 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 y...............................
6a20 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 ...........text..............dat
6a40 61 00 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 a..............bss..............
6a60 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 .idata$7...........idata$5......
6a80 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 .....idata$4...........idata$6..
6aa0 00 00 07 00 00 00 03 00 00 00 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 1e 00 ................................
6ac0 00 00 00 00 00 00 05 00 00 00 02 00 00 00 00 00 3e 00 00 00 00 00 00 00 00 00 00 00 02 00 81 00 ................>...............
6ae0 00 00 45 76 74 47 65 74 4f 62 6a 65 63 74 41 72 72 61 79 50 72 6f 70 65 72 74 79 00 5f 5f 69 6d ..EvtGetObjectArrayProperty.__im
6b00 70 5f 45 76 74 47 65 74 4f 62 6a 65 63 74 41 72 72 61 79 50 72 6f 70 65 72 74 79 00 5f 68 65 61 p_EvtGetObjectArrayProperty._hea
6b20 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f d_C__Users_Peter_Code_winapi_rs_
6b40 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 65 76 74 61 70 69 5f 61 00 0a x86_64_lib_libwinapi_wevtapi_a..
6b60 64 61 77 71 73 30 30 30 31 32 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 38 36 36 20 20 30 20 20 20 dawqs00012.o/...1516160866..0...
6b80 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 36 36 39 20 20 20 20 20 20 20 60 0a 64 86 07 00 ..0.....100666..669.......`.d...
6ba0 00 00 00 00 80 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 .................text...........
6bc0 08 00 00 00 2c 01 00 00 58 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 ....,...X.............0`.data...
6be0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 ............................@.0.
6c00 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .bss............................
6c20 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 ......0..idata$7............4...
6c40 62 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 b.............0..idata$5........
6c60 08 00 00 00 38 01 00 00 6c 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 ....8...l.............0..idata$4
6c80 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 76 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 ............@...v.............0.
6ca0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 10 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 .idata$6............H...........
6cc0 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .........%......................
6ce0 00 00 00 00 0c 00 45 76 74 47 65 74 4c 6f 67 49 6e 66 6f 00 02 00 00 00 08 00 00 00 04 00 00 00 ......EvtGetLogInfo.............
6d00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 .............................tex
6d20 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 t..............data.............
6d40 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 .bss...............idata$7......
6d60 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 .....idata$5...........idata$4..
6d80 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 00 00 00 00 04 00 .........idata$6................
6da0 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 12 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 ................................
6dc0 00 00 26 00 00 00 00 00 00 00 00 00 00 00 02 00 69 00 00 00 45 76 74 47 65 74 4c 6f 67 49 6e 66 ..&.............i...EvtGetLogInf
6de0 6f 00 5f 5f 69 6d 70 5f 45 76 74 47 65 74 4c 6f 67 49 6e 66 6f 00 5f 68 65 61 64 5f 43 5f 5f 55 o.__imp_EvtGetLogInfo._head_C__U
6e00 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 sers_Peter_Code_winapi_rs_x86_64
6e20 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 61 77 71 73 30 _lib_libwinapi_wevtapi_a..dawqs0
6e40 30 30 31 31 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 38 36 36 20 20 30 20 20 20 20 20 30 20 20 20 0011.o/...1516160866..0.....0...
6e60 20 20 31 30 30 36 36 36 20 20 36 39 31 20 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 88 01 ..100666..691.......`.d.........
6e80 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 2c 01 ...........text...............,.
6ea0 00 00 60 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 ..`.............0`.data.........
6ec0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 00 00 ......................@.0..bss..
6ee0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 ................................
6f00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 6a 01 00 00 00 00 0..idata$7............4...j.....
6f20 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 38 01 ........0..idata$5............8.
6f40 00 00 74 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 00 00 ..t.............0..idata$4......
6f60 00 00 08 00 00 00 40 01 00 00 7e 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 ......@...~.............0..idata
6f80 24 36 00 00 00 00 00 00 00 00 18 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 $6............H.................
6fa0 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0b 00 ...%............................
6fc0 45 76 74 47 65 74 45 78 74 65 6e 64 65 64 53 74 61 74 75 73 00 00 02 00 00 00 08 00 00 00 04 00 EvtGetExtendedStatus............
6fe0 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 ...............................t
7000 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 00 00 ext..............data...........
7020 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 ...bss...............idata$7....
7040 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 .......idata$5...........idata$4
7060 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 00 00 00 00 ...........idata$6..............
7080 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 19 00 00 00 00 00 00 00 05 00 00 00 02 00 ................................
70a0 00 00 00 00 34 00 00 00 00 00 00 00 00 00 00 00 02 00 77 00 00 00 45 76 74 47 65 74 45 78 74 65 ....4.............w...EvtGetExte
70c0 6e 64 65 64 53 74 61 74 75 73 00 5f 5f 69 6d 70 5f 45 76 74 47 65 74 45 78 74 65 6e 64 65 64 53 ndedStatus.__imp_EvtGetExtendedS
70e0 74 61 74 75 73 00 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f tatus._head_C__Users_Peter_Code_
7100 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 winapi_rs_x86_64_lib_libwinapi_w
7120 65 76 74 61 70 69 5f 61 00 0a 64 61 77 71 73 30 30 30 31 30 2e 6f 2f 20 20 20 31 35 31 36 31 36 evtapi_a..dawqs00010.o/...151616
7140 30 38 36 36 20 20 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 37 31 33 20 20 20 0866..0.....0.....100666..713...
7160 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 90 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 ....`.d....................text.
7180 00 00 00 00 00 00 00 00 00 00 08 00 00 00 2c 01 00 00 68 01 00 00 00 00 00 00 01 00 00 00 20 00 ..............,...h.............
71a0 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0`.data.........................
71c0 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ......@.0..bss..................
71e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 ................0..idata$7......
7200 00 00 04 00 00 00 34 01 00 00 72 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 ......4...r.............0..idata
7220 24 35 00 00 00 00 00 00 00 00 08 00 00 00 38 01 00 00 7c 01 00 00 00 00 00 00 01 00 00 00 00 00 $5............8...|.............
7240 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 86 01 00 00 00 00 0..idata$4............@.........
7260 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 1e 00 00 00 48 01 ........0..idata$6............H.
7280 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 ...................%............
72a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0a 00 45 76 74 47 65 74 45 76 65 6e 74 4d 65 74 61 64 ................EvtGetEventMetad
72c0 61 74 61 50 72 6f 70 65 72 74 79 00 00 00 02 00 00 00 08 00 00 00 04 00 00 00 00 00 09 00 00 00 ataProperty.....................
72e0 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 .......................text.....
7300 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 .........data..............bss..
7320 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 .............idata$7...........i
7340 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 00 00 data$5...........idata$4........
7360 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 00 00 00 00 04 00 00 00 00 00 00 00 ...idata$6......................
7380 01 00 00 00 02 00 00 00 00 00 20 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 00 00 42 00 00 00 ............................B...
73a0 00 00 00 00 00 00 00 00 02 00 85 00 00 00 45 76 74 47 65 74 45 76 65 6e 74 4d 65 74 61 64 61 74 ..............EvtGetEventMetadat
73c0 61 50 72 6f 70 65 72 74 79 00 5f 5f 69 6d 70 5f 45 76 74 47 65 74 45 76 65 6e 74 4d 65 74 61 64 aProperty.__imp_EvtGetEventMetad
73e0 61 74 61 50 72 6f 70 65 72 74 79 00 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 ataProperty._head_C__Users_Peter
7400 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 _Code_winapi_rs_x86_64_lib_libwi
7420 6e 61 70 69 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 61 77 71 73 30 30 30 30 39 2e 6f 2f 20 20 20 napi_wevtapi_a..dawqs00009.o/...
7440 31 35 31 36 31 36 30 38 36 36 20 20 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 1516160866..0.....0.....100666..
7460 36 37 37 20 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 84 01 00 00 0a 00 00 00 00 00 04 00 677.......`.d...................
7480 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 2c 01 00 00 5c 01 00 00 00 00 00 00 .text...............,...\.......
74a0 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ......0`.data...................
74c0 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 ............@.0..bss............
74e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 ......................0..idata$7
7500 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 66 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 ............4...f.............0.
7520 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 38 01 00 00 70 01 00 00 00 00 00 00 .idata$5............8...p.......
7540 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 ......0..idata$4............@...
7560 7a 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 z.............0..idata$6........
7580 12 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 ....H....................%......
75a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 09 00 45 76 74 47 65 74 45 76 65 6e ......................EvtGetEven
75c0 74 49 6e 66 6f 00 00 00 02 00 00 00 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 tInfo...........................
75e0 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 .................text...........
7600 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 ...data..............bss........
7620 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 .......idata$7...........idata$5
7640 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 ...........idata$4...........ida
7660 74 61 24 36 00 00 00 00 07 00 00 00 03 00 00 00 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 ta$6............................
7680 00 00 00 00 14 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 00 00 2a 00 00 00 00 00 00 00 00 00 ......................*.........
76a0 00 00 02 00 6d 00 00 00 45 76 74 47 65 74 45 76 65 6e 74 49 6e 66 6f 00 5f 5f 69 6d 70 5f 45 76 ....m...EvtGetEventInfo.__imp_Ev
76c0 74 47 65 74 45 76 65 6e 74 49 6e 66 6f 00 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 tGetEventInfo._head_C__Users_Pet
76e0 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 er_Code_winapi_rs_x86_64_lib_lib
7700 77 69 6e 61 70 69 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 61 77 71 73 30 30 30 30 38 2e 6f 2f 20 winapi_wevtapi_a..dawqs00008.o/.
7720 20 20 31 35 31 36 31 36 30 38 36 36 20 20 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 ..1516160866..0.....0.....100666
7740 20 20 37 31 33 20 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 90 01 00 00 0a 00 00 00 00 00 ..713.......`.d.................
7760 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 2c 01 00 00 68 01 00 00 00 00 ...text...............,...h.....
7780 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........0`.data.................
77a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 ..............@.0..bss..........
77c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 ........................0..idata
77e0 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 72 01 00 00 00 00 00 00 01 00 00 00 00 00 $7............4...r.............
7800 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 38 01 00 00 7c 01 00 00 00 00 0..idata$5............8...|.....
7820 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 ........0..idata$4............@.
7840 00 00 86 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 ................0..idata$6......
7860 00 00 1e 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 ......H....................%....
7880 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 45 76 74 47 65 74 43 68 ........................EvtGetCh
78a0 61 6e 6e 65 6c 43 6f 6e 66 69 67 50 72 6f 70 65 72 74 79 00 00 00 02 00 00 00 08 00 00 00 04 00 annelConfigProperty.............
78c0 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 ...............................t
78e0 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 00 00 ext..............data...........
7900 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 ...bss...............idata$7....
7920 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 .......idata$5...........idata$4
7940 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 00 00 00 00 ...........idata$6..............
7960 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 20 00 00 00 00 00 00 00 05 00 00 00 02 00 ................................
7980 00 00 00 00 42 00 00 00 00 00 00 00 00 00 00 00 02 00 85 00 00 00 45 76 74 47 65 74 43 68 61 6e ....B.................EvtGetChan
79a0 6e 65 6c 43 6f 6e 66 69 67 50 72 6f 70 65 72 74 79 00 5f 5f 69 6d 70 5f 45 76 74 47 65 74 43 68 nelConfigProperty.__imp_EvtGetCh
79c0 61 6e 6e 65 6c 43 6f 6e 66 69 67 50 72 6f 70 65 72 74 79 00 5f 68 65 61 64 5f 43 5f 5f 55 73 65 annelConfigProperty._head_C__Use
79e0 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c rs_Peter_Code_winapi_rs_x86_64_l
7a00 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 61 77 71 73 30 30 30 ib_libwinapi_wevtapi_a..dawqs000
7a20 30 37 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 38 36 36 20 20 30 20 20 20 20 20 30 20 20 20 20 20 07.o/...1516160866..0.....0.....
7a40 31 30 30 36 36 36 20 20 36 37 39 20 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 84 01 00 00 100666..679.......`.d...........
7a60 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 2c 01 00 00 .........text...............,...
7a80 5c 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 00 00 \.............0`.data...........
7aa0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 00 00 00 00 ....................@.0..bss....
7ac0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 30 c0 ..............................0.
7ae0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 66 01 00 00 00 00 00 00 .idata$7............4...f.......
7b00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 38 01 00 00 ......0..idata$5............8...
7b20 70 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 00 00 00 00 p.............0..idata$4........
7b40 08 00 00 00 40 01 00 00 7a 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 36 ....@...z.............0..idata$6
7b60 00 00 00 00 00 00 00 00 14 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 c0 ............H...................
7b80 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 00 45 76 .%............................Ev
7ba0 74 46 6f 72 6d 61 74 4d 65 73 73 61 67 65 00 00 02 00 00 00 08 00 00 00 04 00 00 00 00 00 09 00 tFormatMessage..................
7bc0 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 .........................text...
7be0 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 73 73 ...........data..............bss
7c00 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 00 00 03 00 ...............idata$7..........
7c20 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 .idata$5...........idata$4......
7c40 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 00 00 00 00 04 00 00 00 00 00 .....idata$6....................
7c60 00 00 01 00 00 00 02 00 00 00 00 00 15 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 00 00 2c 00 ..............................,.
7c80 00 00 00 00 00 00 00 00 00 00 02 00 6f 00 00 00 45 76 74 46 6f 72 6d 61 74 4d 65 73 73 61 67 65 ............o...EvtFormatMessage
7ca0 00 5f 5f 69 6d 70 5f 45 76 74 46 6f 72 6d 61 74 4d 65 73 73 61 67 65 00 5f 68 65 61 64 5f 43 5f .__imp_EvtFormatMessage._head_C_
7cc0 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f _Users_Peter_Code_winapi_rs_x86_
7ce0 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 61 77 71 64_lib_libwinapi_wevtapi_a..dawq
7d00 73 30 30 30 30 36 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 38 36 36 20 20 30 20 20 20 20 20 30 20 s00006.o/...1516160866..0.....0.
7d20 20 20 20 20 31 30 30 36 36 36 20 20 36 36 37 20 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 ....100666..667.......`.d.......
7d40 80 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 .............text...............
7d60 2c 01 00 00 58 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 ,...X.............0`.data.......
7d80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 ........................@.0..bss
7da0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................................
7dc0 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 62 01 00 00 ..0..idata$7............4...b...
7de0 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 ..........0..idata$5............
7e00 38 01 00 00 6c 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 8...l.............0..idata$4....
7e20 00 00 00 00 08 00 00 00 40 01 00 00 76 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 ........@...v.............0..ida
7e40 74 61 24 36 00 00 00 00 00 00 00 00 10 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ta$6............H...............
7e60 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .....%..........................
7e80 06 00 45 76 74 45 78 70 6f 72 74 4c 6f 67 00 00 02 00 00 00 08 00 00 00 04 00 00 00 00 00 09 00 ..EvtExportLog..................
7ea0 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 .........................text...
7ec0 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 73 73 ...........data..............bss
7ee0 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 00 00 03 00 ...............idata$7..........
7f00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 .idata$5...........idata$4......
7f20 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 00 00 00 00 04 00 00 00 00 00 .....idata$6....................
7f40 00 00 01 00 00 00 02 00 00 00 00 00 11 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 00 00 24 00 ..............................$.
7f60 00 00 00 00 00 00 00 00 00 00 02 00 67 00 00 00 45 76 74 45 78 70 6f 72 74 4c 6f 67 00 5f 5f 69 ............g...EvtExportLog.__i
7f80 6d 70 5f 45 76 74 45 78 70 6f 72 74 4c 6f 67 00 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 mp_EvtExportLog._head_C__Users_P
7fa0 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c eter_Code_winapi_rs_x86_64_lib_l
7fc0 69 62 77 69 6e 61 70 69 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 61 77 71 73 30 30 30 30 35 2e 6f ibwinapi_wevtapi_a..dawqs00005.o
7fe0 2f 20 20 20 31 35 31 36 31 36 30 38 36 36 20 20 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 /...1516160866..0.....0.....1006
8000 36 36 20 20 36 39 39 20 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 8c 01 00 00 0a 00 00 00 66..699.......`.d...............
8020 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 2c 01 00 00 64 01 00 00 .....text...............,...d...
8040 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ..........0`.data...............
8060 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 ................@.0..bss........
8080 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 ..........................0..ida
80a0 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 6e 01 00 00 00 00 00 00 01 00 00 00 ta$7............4...n...........
80c0 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 38 01 00 00 78 01 00 00 ..0..idata$5............8...x...
80e0 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 ..........0..idata$4............
8100 40 01 00 00 82 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 @.................0..idata$6....
8120 00 00 00 00 1a 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 ........H....................%..
8140 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 05 00 45 76 74 43 72 65 ..........................EvtCre
8160 61 74 65 52 65 6e 64 65 72 43 6f 6e 74 65 78 74 00 00 00 00 02 00 00 00 08 00 00 00 04 00 00 00 ateRenderContext................
8180 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 .............................tex
81a0 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 t..............data.............
81c0 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 .bss...............idata$7......
81e0 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 .....idata$5...........idata$4..
8200 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 00 00 00 00 04 00 .........idata$6................
8220 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 1b 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 ................................
8240 00 00 38 00 00 00 00 00 00 00 00 00 00 00 02 00 7b 00 00 00 45 76 74 43 72 65 61 74 65 52 65 6e ..8.............{...EvtCreateRen
8260 64 65 72 43 6f 6e 74 65 78 74 00 5f 5f 69 6d 70 5f 45 76 74 43 72 65 61 74 65 52 65 6e 64 65 72 derContext.__imp_EvtCreateRender
8280 43 6f 6e 74 65 78 74 00 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 Context._head_C__Users_Peter_Cod
82a0 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 e_winapi_rs_x86_64_lib_libwinapi
82c0 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 61 77 71 73 30 30 30 30 34 2e 6f 2f 20 20 20 31 35 31 36 _wevtapi_a..dawqs00004.o/...1516
82e0 31 36 30 38 36 36 20 20 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 36 38 31 20 160866..0.....0.....100666..681.
8300 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 84 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 ......`.d....................tex
8320 74 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 2c 01 00 00 5c 01 00 00 00 00 00 00 01 00 00 00 t...............,...\...........
8340 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ..0`.data.......................
8360 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........@.0..bss................
8380 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 ..................0..idata$7....
83a0 00 00 00 00 04 00 00 00 34 01 00 00 66 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 ........4...f.............0..ida
83c0 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 38 01 00 00 70 01 00 00 00 00 00 00 01 00 00 00 ta$5............8...p...........
83e0 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 7a 01 00 00 ..0..idata$4............@...z...
8400 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 14 00 00 00 ..........0..idata$6............
8420 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 H....................%..........
8440 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 45 76 74 43 72 65 61 74 65 42 6f 6f 6b 6d ..................EvtCreateBookm
8460 61 72 6b 00 02 00 00 00 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 ark.............................
8480 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 .............text..............d
84a0 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 ata..............bss............
84c0 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 ...idata$7...........idata$5....
84e0 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 .......idata$4...........idata$6
8500 00 00 00 00 07 00 00 00 03 00 00 00 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 ................................
8520 16 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 00 00 2e 00 00 00 00 00 00 00 00 00 00 00 02 00 ................................
8540 71 00 00 00 45 76 74 43 72 65 61 74 65 42 6f 6f 6b 6d 61 72 6b 00 5f 5f 69 6d 70 5f 45 76 74 43 q...EvtCreateBookmark.__imp_EvtC
8560 72 65 61 74 65 42 6f 6f 6b 6d 61 72 6b 00 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 reateBookmark._head_C__Users_Pet
8580 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 er_Code_winapi_rs_x86_64_lib_lib
85a0 77 69 6e 61 70 69 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 61 77 71 73 30 30 30 30 33 2e 6f 2f 20 winapi_wevtapi_a..dawqs00003.o/.
85c0 20 20 31 35 31 36 31 36 30 38 36 36 20 20 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 ..1516160866..0.....0.....100666
85e0 20 20 36 34 36 20 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 7c 01 00 00 0a 00 00 00 00 00 ..646.......`.d.......|.........
8600 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 2c 01 00 00 54 01 00 00 00 00 ...text...............,...T.....
8620 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........0`.data.................
8640 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 ..............@.0..bss..........
8660 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 ........................0..idata
8680 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 5e 01 00 00 00 00 00 00 01 00 00 00 00 00 $7............4...^.............
86a0 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 38 01 00 00 68 01 00 00 00 00 0..idata$5............8...h.....
86c0 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 ........0..idata$4............@.
86e0 00 00 72 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 ..r.............0..idata$6......
8700 00 00 0c 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 ......H....................%....
8720 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 00 45 76 74 43 6c 6f 73 65 ........................EvtClose
8740 00 00 02 00 00 00 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 ................................
8760 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 ...........text..............dat
8780 61 00 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 a..............bss..............
87a0 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 .idata$7...........idata$5......
87c0 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 .....idata$4...........idata$6..
87e0 00 00 07 00 00 00 03 00 45 76 74 43 6c 6f 73 65 00 00 00 00 01 00 00 00 02 00 00 00 00 00 04 00 ........EvtClose................
8800 00 00 00 00 00 00 05 00 00 00 02 00 00 00 00 00 13 00 00 00 00 00 00 00 00 00 00 00 02 00 56 00 ..............................V.
8820 00 00 5f 5f 69 6d 70 5f 45 76 74 43 6c 6f 73 65 00 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f ..__imp_EvtClose._head_C__Users_
8840 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f Peter_Code_winapi_rs_x86_64_lib_
8860 6c 69 62 77 69 6e 61 70 69 5f 77 65 76 74 61 70 69 5f 61 00 64 61 77 71 73 30 30 30 30 32 2e 6f libwinapi_wevtapi_a.dawqs00002.o
8880 2f 20 20 20 31 35 31 36 31 36 30 38 36 36 20 20 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 /...1516160866..0.....0.....1006
88a0 36 36 20 20 36 36 35 20 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 80 01 00 00 0a 00 00 00 66..665.......`.d...............
88c0 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 2c 01 00 00 58 01 00 00 .....text...............,...X...
88e0 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ..........0`.data...............
8900 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 ................@.0..bss........
8920 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 ..........................0..ida
8940 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 62 01 00 00 00 00 00 00 01 00 00 00 ta$7............4...b...........
8960 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 38 01 00 00 6c 01 00 00 ..0..idata$5............8...l...
8980 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 ..........0..idata$4............
89a0 40 01 00 00 76 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 @...v.............0..idata$6....
89c0 00 00 00 00 0e 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 ........H....................%..
89e0 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 45 76 74 43 6c 65 ..........................EvtCle
8a00 61 72 4c 6f 67 00 00 00 02 00 00 00 08 00 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 arLog...........................
8a20 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 .................text...........
8a40 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 ...data..............bss........
8a60 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 .......idata$7...........idata$5
8a80 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 ...........idata$4...........ida
8aa0 74 61 24 36 00 00 00 00 07 00 00 00 03 00 00 00 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 ta$6............................
8ac0 00 00 00 00 10 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 00 00 22 00 00 00 00 00 00 00 00 00 ......................".........
8ae0 00 00 02 00 65 00 00 00 45 76 74 43 6c 65 61 72 4c 6f 67 00 5f 5f 69 6d 70 5f 45 76 74 43 6c 65 ....e...EvtClearLog.__imp_EvtCle
8b00 61 72 4c 6f 67 00 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f arLog._head_C__Users_Peter_Code_
8b20 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 winapi_rs_x86_64_lib_libwinapi_w
8b40 65 76 74 61 70 69 5f 61 00 0a 64 61 77 71 73 30 30 30 30 31 2e 6f 2f 20 20 20 31 35 31 36 31 36 evtapi_a..dawqs00001.o/...151616
8b60 30 38 36 36 20 20 30 20 20 20 20 20 30 20 20 20 20 20 31 30 30 36 36 36 20 20 36 35 37 20 20 20 0866..0.....0.....100666..657...
8b80 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 7c 01 00 00 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 ....`.d.......|............text.
8ba0 00 00 00 00 00 00 00 00 00 00 08 00 00 00 2c 01 00 00 54 01 00 00 00 00 00 00 01 00 00 00 20 00 ..............,...T.............
8bc0 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0`.data.........................
8be0 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ......@.0..bss..................
8c00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 30 c0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 ................0..idata$7......
8c20 00 00 04 00 00 00 34 01 00 00 5e 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 ......4...^.............0..idata
8c40 24 35 00 00 00 00 00 00 00 00 08 00 00 00 38 01 00 00 68 01 00 00 00 00 00 00 01 00 00 00 00 00 $5............8...h.............
8c60 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 00 00 00 00 08 00 00 00 40 01 00 00 72 01 00 00 00 00 0..idata$4............@...r.....
8c80 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 36 00 00 00 00 00 00 00 00 0c 00 00 00 48 01 ........0..idata$6............H.
8ca0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 c0 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 ...................%............
8cc0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 45 76 74 43 61 6e 63 65 6c 00 02 00 00 00 08 00 ................EvtCancel.......
8ce0 00 00 04 00 00 00 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 ................................
8d00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 ...text..............data.......
8d20 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 .......bss...............idata$7
8d40 00 00 00 00 04 00 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 ...........idata$5...........ida
8d60 74 61 24 34 00 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 ta$4...........idata$6..........
8d80 00 00 00 00 04 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 0e 00 00 00 00 00 00 00 05 00 ................................
8da0 00 00 02 00 00 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 02 00 61 00 00 00 45 76 74 43 61 6e ......................a...EvtCan
8dc0 63 65 6c 00 5f 5f 69 6d 70 5f 45 76 74 43 61 6e 63 65 6c 00 5f 68 65 61 64 5f 43 5f 5f 55 73 65 cel.__imp_EvtCancel._head_C__Use
8de0 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c rs_Peter_Code_winapi_rs_x86_64_l
8e00 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 65 76 74 61 70 69 5f 61 00 0a 64 61 77 71 73 30 30 30 ib_libwinapi_wevtapi_a..dawqs000
8e20 30 30 2e 6f 2f 20 20 20 31 35 31 36 31 36 30 38 36 36 20 20 30 20 20 20 20 20 30 20 20 20 20 20 00.o/...1516160866..0.....0.....
8e40 31 30 30 36 36 36 20 20 36 39 33 20 20 20 20 20 20 20 60 0a 64 86 07 00 00 00 00 00 88 01 00 00 100666..693.......`.d...........
8e60 0a 00 00 00 00 00 04 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 2c 01 00 00 .........text...............,...
8e80 60 01 00 00 00 00 00 00 01 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 00 00 00 00 00 00 00 00 `.............0`.data...........
8ea0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 62 73 73 00 00 00 00 ....................@.0..bss....
8ec0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 30 c0 ..............................0.
8ee0 2e 69 64 61 74 61 24 37 00 00 00 00 00 00 00 00 04 00 00 00 34 01 00 00 6a 01 00 00 00 00 00 00 .idata$7............4...j.......
8f00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 35 00 00 00 00 00 00 00 00 08 00 00 00 38 01 00 00 ......0..idata$5............8...
8f20 74 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 34 00 00 00 00 00 00 00 00 t.............0..idata$4........
8f40 08 00 00 00 40 01 00 00 7e 01 00 00 00 00 00 00 01 00 00 00 00 00 30 c0 2e 69 64 61 74 61 24 36 ....@...~.............0..idata$6
8f60 00 00 00 00 00 00 00 00 18 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 c0 ............H...................
8f80 ff 25 00 00 00 00 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 45 76 .%............................Ev
8fa0 74 41 72 63 68 69 76 65 45 78 70 6f 72 74 65 64 4c 6f 67 00 02 00 00 00 08 00 00 00 04 00 00 00 tArchiveExportedLog.............
8fc0 00 00 09 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 00 00 00 00 06 00 00 00 03 00 2e 74 65 78 .............................tex
8fe0 74 00 00 00 00 00 00 00 01 00 00 00 03 00 2e 64 61 74 61 00 00 00 00 00 00 00 02 00 00 00 03 00 t..............data.............
9000 2e 62 73 73 00 00 00 00 00 00 00 00 03 00 00 00 03 00 2e 69 64 61 74 61 24 37 00 00 00 00 04 00 .bss...............idata$7......
9020 00 00 03 00 2e 69 64 61 74 61 24 35 00 00 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 24 34 00 00 .....idata$5...........idata$4..
9040 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 00 00 00 00 07 00 00 00 03 00 00 00 00 00 04 00 .........idata$6................
9060 00 00 00 00 00 00 01 00 00 00 02 00 00 00 00 00 1a 00 00 00 00 00 00 00 05 00 00 00 02 00 00 00 ................................
9080 00 00 36 00 00 00 00 00 00 00 00 00 00 00 02 00 79 00 00 00 45 76 74 41 72 63 68 69 76 65 45 78 ..6.............y...EvtArchiveEx
90a0 70 6f 72 74 65 64 4c 6f 67 00 5f 5f 69 6d 70 5f 45 76 74 41 72 63 68 69 76 65 45 78 70 6f 72 74 portedLog.__imp_EvtArchiveExport
90c0 65 64 4c 6f 67 00 5f 68 65 61 64 5f 43 5f 5f 55 73 65 72 73 5f 50 65 74 65 72 5f 43 6f 64 65 5f edLog._head_C__Users_Peter_Code_
90e0 77 69 6e 61 70 69 5f 72 73 5f 78 38 36 5f 36 34 5f 6c 69 62 5f 6c 69 62 77 69 6e 61 70 69 5f 77 winapi_rs_x86_64_lib_libwinapi_w
9100 65 76 74 61 70 69 5f 61 00 0a evtapi_a..
Copyright © 2025 Valentin A. Popov. All Rights Reverse Engineered.