wecsvc.dll

v10.0.19041.5794 64-bit Windows NT Analyzed
Download
Description
Event Collector Service
Authors
© Microsoft Corporation. All rights reserved.
File size
239.5 KB
Uploaded
2025-12-01 07:42
Views
80
SHA-256
7845bea73a6edbfcf9775e7a85c3bda5

Exported functions 4

ServiceMain #1 · 0x25b0
SvchostPushServiceGlobals #2 · 0x2510
DllRegisterServer #3 · 0x2c00
DllUnregisterServer #4 · 0x2c00

Imported DLLs & functions 169

ADVAPI32.dll 14
CredDeleteW 0x18002c828
CredEnumerateW 0x18002c820
CredFree 0x18002c810
CredReadW 0x18002c830
CredWriteW 0x18002c838
EventRegister 0x18002c800
EventUnregister 0x18002c7f8
EventWrite 0x18002c7d8
RegDeleteKeyExW 0x18002c7f0
RegDeleteKeyW 0x18002c808
RegEnumKeyExW 0x18002c7e0
RegQueryInfoKeyW 0x18002c7e8
RegQueryValueExW 0x18002c840
RevertToSelf 0x18002c818
api-ms-win-core-debug-l1-1-0.dll 3
DebugBreak 0x18002c930
IsDebuggerPresent 0x18002c940
OutputDebugStringW 0x18002c938
api-ms-win-core-errorhandling-l1-1-0.dll 4
GetLastError 0x18002c968
SetLastError 0x18002c950
SetUnhandledExceptionFilter 0x18002c958
UnhandledExceptionFilter 0x18002c960
api-ms-win-core-file-l1-1-0.dll 1
CompareFileTime 0x18002c978
api-ms-win-core-handle-l1-1-0.dll 1
CloseHandle 0x18002c988
api-ms-win-core-heap-l1-1-0.dll 3
GetProcessHeap 0x18002c9a8
HeapAlloc 0x18002c9a0
HeapFree 0x18002c998
api-ms-win-core-heap-l2-1-0.dll 1
LocalFree 0x18002c9b8
api-ms-win-core-kernel32-legacy-l1-1-0.dll 2
GetComputerNameW 0x18002c9d0
RegisterWaitForSingleObject 0x18002c9c8
api-ms-win-core-libraryloader-l1-2-0.dll 4
GetModuleFileNameA 0x18002c9f0
GetModuleHandleExW 0x18002c9e8
GetModuleHandleW 0x18002c9f8
GetProcAddress 0x18002c9e0
api-ms-win-core-localization-l1-2-0.dll 3
FormatMessageW 0x18002ca18
GetThreadLocale 0x18002ca08
LocaleNameToLCID 0x18002ca10
api-ms-win-core-localization-l1-2-2.dll 1
LCIDToLocaleName 0x18002ca28
api-ms-win-core-processthreads-l1-1-0.dll 7
GetCurrentProcess 0x18002ca60
GetCurrentProcessId 0x18002ca48
GetCurrentThread 0x18002ca68
GetCurrentThreadId 0x18002ca50
OpenThreadToken 0x18002ca38
SetThreadToken 0x18002ca40
TerminateProcess 0x18002ca58
api-ms-win-core-profile-l1-1-0.dll 1
QueryPerformanceCounter 0x18002ca78
api-ms-win-core-registry-l1-1-0.dll 5
RegCloseKey 0x18002ca90
RegCreateKeyExW 0x18002caa8
RegDeleteValueW 0x18002ca88
RegOpenKeyExW 0x18002ca98
RegSetValueExW 0x18002caa0
api-ms-win-core-rtlsupport-l1-1-0.dll 3
RtlCaptureContext 0x18002cab8
RtlLookupFunctionEntry 0x18002cac0
RtlVirtualUnwind 0x18002cac8
api-ms-win-core-synch-l1-1-0.dll 18
AcquireSRWLockExclusive 0x18002cb30
AcquireSRWLockShared 0x18002cb60
CreateEventW 0x18002cae8
CreateMutexExW 0x18002cad8
CreateSemaphoreExW 0x18002cae0
DeleteCriticalSection 0x18002caf8
EnterCriticalSection 0x18002cb00
InitializeCriticalSectionEx 0x18002cb28
LeaveCriticalSection 0x18002cb18
OpenSemaphoreW 0x18002cb08
ReleaseMutex 0x18002cb38
ReleaseSemaphore 0x18002cb40
ReleaseSRWLockExclusive 0x18002cb58
ReleaseSRWLockShared 0x18002cb50
ResetEvent 0x18002cb48
SetEvent 0x18002caf0
WaitForSingleObject 0x18002cb20
WaitForSingleObjectEx 0x18002cb10
api-ms-win-core-synch-l1-2-0.dll 1
Sleep 0x18002cb70
api-ms-win-core-sysinfo-l1-1-0.dll 4
GetComputerNameExW 0x18002cb98
GetSystemTime 0x18002cb80
GetSystemTimeAsFileTime 0x18002cb88
GetTickCount 0x18002cb90
api-ms-win-core-threadpool-l1-2-0.dll 4
CloseThreadpoolTimer 0x18002cbc0
CreateThreadpoolTimer 0x18002cba8
SetThreadpoolTimer 0x18002cbb0
WaitForThreadpoolTimerCallbacks 0x18002cbb8
api-ms-win-core-threadpool-legacy-l1-1-0.dll 3
CreateTimerQueueTimer 0x18002cbe0
DeleteTimerQueueTimer 0x18002cbd8
UnregisterWaitEx 0x18002cbd0
api-ms-win-core-timezone-l1-1-0.dll 2
FileTimeToSystemTime 0x18002cbf0
SystemTimeToFileTime 0x18002cbf8
api-ms-win-eventing-classicprovider-l1-1-0.dll 6
GetTraceEnableFlags 0x18002cc20
GetTraceEnableLevel 0x18002cc10
GetTraceLoggerHandle 0x18002cc30
RegisterTraceGuidsW 0x18002cc18
TraceMessage 0x18002cc28
UnregisterTraceGuids 0x18002cc08
api-ms-win-security-base-l1-1-0.dll 3
AllocateAndInitializeSid 0x18002cc40
CheckTokenMembership 0x18002cc50
FreeSid 0x18002cc48
api-ms-win-security-sddl-l1-1-0.dll 1
ConvertStringSecurityDescriptorToSecurityDescriptorW 0x18002cc60
api-ms-win-service-core-l1-1-0.dll 2
RegisterServiceCtrlHandlerExW 0x18002cc70
SetServiceStatus 0x18002cc78
msvcrt.dll 38
__C_specific_handler 0x18002ccc8
__CxxFrameHandler3 0x18002cc98
__dllonexit 0x18002cca8
_amsg_exit 0x18002ccd8
_CxxThrowException 0x18002ccf8
_initterm 0x18002ccd0
_lock 0x18002ccc0
_onexit 0x18002cca0
_purecall 0x18002cda0
_ultow 0x18002cd18
_unlock 0x18002cda8
_vsnprintf_s 0x18002cd40
_vsnwprintf 0x18002cd50
_wcsicmp 0x18002cd90
_wcsnicmp 0x18002cd78
_XcptFilter 0x18002cce0
??0exception@@QEAA@AEBQEBD@Z 0x18002cd10
??0exception@@QEAA@AEBQEBDH@Z 0x18002cd08
??0exception@@QEAA@AEBV0@@Z 0x18002cd38
??0exception@@QEAA@XZ 0x18002cd60
??1exception@@UEAA@XZ 0x18002cd58
??1type_info@@UEAA@XZ 0x18002ccb8
?terminate@@YAXXZ 0x18002cc88
?what@exception@@UEBAPEBDXZ 0x18002cd00
abort 0x18002cd88
free 0x18002cd98
iswspace 0x18002cd68
malloc 0x18002cd80
memcmp 0x18002ccb0
memcpy 0x18002ccf0
memcpy_s 0x18002cd48
memmove 0x18002cce8
memmove_s 0x18002cd20
memset 0x18002cc90
swprintf_s 0x18002cd28
swscanf_s 0x18002cd30
wcscmp 0x18002cdb0
wcsncpy_s 0x18002cd70
ntdll.dll 1
EtwEventWriteFull 0x18002cdc0
RPCRT4.dll 13
NdrServerCall2 0x18002c878
NdrServerCallAll 0x18002c868
RpcBindingToStringBindingW 0x18002c898
RpcImpersonateClient 0x18002c890
RpcRevertToSelf 0x18002c888
RpcServerRegisterAuthInfoW 0x18002c858
RpcServerRegisterIfEx 0x18002c860
RpcServerUnregisterIfEx 0x18002c870
RpcServerUseProtseqEpW 0x18002c850
RpcStringBindingParseW 0x18002c8b0
RpcStringFreeW 0x18002c8a0
UuidCreate 0x18002c8a8
UuidToStringW 0x18002c880
wevtapi.dll 7
EvtClose 0x18002cdd8
EvtGetChannelConfigProperty 0x18002cdf8
EvtGetObjectArrayProperty 0x18002cdf0
EvtGetObjectArraySize 0x18002ce00
EvtGetPublisherMetadataProperty 0x18002cde0
EvtOpenChannelConfig 0x18002cde8
EvtOpenPublisherMetadata 0x18002cdd0
WsmSvc.DLL 13
WSManAckEvents 0x18002c900
WSManCloseEnumeratorHandle 0x18002c8c0
WSManCloseObjectHandle 0x18002c8d0
WSManCloseSessionHandle 0x18002c920
WSManCloseSubscriptionHandle 0x18002c918
WSManCreatePullSubscription 0x18002c8e0
WSManCreatePushSubscription 0x18002c8e8
WSManCreateSessionInternal 0x18002c910
WSManDecodeObject 0x18002c8f8
WSManEncodeObject 0x18002c8f0
WSManEnumeratorNextObject 0x18002c8c8
WSManPullEvents 0x18002c8d8
WSManSetSessionOption 0x18002c908