wevtsvc.dll

v10.0.19041.6280 64-bit Windows NT Analyzed
Description
Event Logging Service
Authors
© Microsoft Corporation. All rights reserved.
File size
1.8 MB
Uploaded
2025-12-01 07:42
Views
51
SHA-256
73742a2272138af946d36949e4515656

Exported functions 2

ServiceMain #1 · 0x50be0
SvchostPushServiceGlobalsEx #2 · 0x5c1b0

Imported DLLs & functions 436

api-ms-win-core-apiquery-l1-1-0.dll 1
ApiSetQueryApiSetPresence 0x1800f1f28
api-ms-win-core-datetime-l1-1-0.dll 2
GetDateFormatW 0x1800f1f40
GetTimeFormatW 0x1800f1f38
api-ms-win-core-datetime-l1-1-1.dll 2
GetDateFormatEx 0x1800f1f50
GetTimeFormatEx 0x1800f1f58
api-ms-win-core-debug-l1-1-0.dll 3
DebugBreak 0x1800f1f70
IsDebuggerPresent 0x1800f1f78
OutputDebugStringW 0x1800f1f68
api-ms-win-core-delayload-l1-1-0.dll 1
DelayLoadFailureHook 0x1800f1f88
api-ms-win-core-delayload-l1-1-1.dll 1
ResolveDelayLoadedAPI 0x1800f1f98
api-ms-win-core-errorhandling-l1-1-0.dll 4
GetLastError 0x1800f1fc0
SetLastError 0x1800f1fb8
SetUnhandledExceptionFilter 0x1800f1fb0
UnhandledExceptionFilter 0x1800f1fa8
api-ms-win-core-file-l1-1-0.dll 20
CompareFileTime 0x1800f2050
CreateDirectoryW 0x1800f2000
CreateFileW 0x1800f2048
DeleteFileW 0x1800f2028
FileTimeToLocalFileTime 0x1800f2030
FlushFileBuffers 0x1800f1fe8
GetDiskFreeSpaceExW 0x1800f1fd8
GetFileAttributesExW 0x1800f2060
GetFileAttributesW 0x1800f2068
GetFileInformationByHandle 0x1800f2038
GetFileSize 0x1800f1ff0
GetFileSizeEx 0x1800f2040
GetFileType 0x1800f2010
GetTempFileNameW 0x1800f2020
LocalFileTimeToFileTime 0x1800f2018
ReadFile 0x1800f1fd0
SetEndOfFile 0x1800f1fe0
SetFilePointer 0x1800f2058
SetFilePointerEx 0x1800f2008
WriteFile 0x1800f1ff8
api-ms-win-core-file-l1-2-0.dll 1
GetTempPathW 0x1800f2078
api-ms-win-core-file-l2-1-0.dll 2
MoveFileExW 0x1800f2088
ReOpenFile 0x1800f2090
api-ms-win-core-handle-l1-1-0.dll 1
CloseHandle 0x1800f20a0
api-ms-win-core-heap-l1-1-0.dll 6
GetProcessHeap 0x1800f20c8
HeapAlloc 0x1800f20c0
HeapDestroy 0x1800f20b0
HeapFree 0x1800f20d8
HeapReAlloc 0x1800f20b8
HeapSize 0x1800f20d0
api-ms-win-core-heap-l2-1-0.dll 2
LocalAlloc 0x1800f20e8
LocalFree 0x1800f20f0
api-ms-win-core-interlocked-l1-1-0.dll 1
InitializeSListHead 0x1800f2100
api-ms-win-core-kernel32-legacy-l1-1-0.dll 1
PulseEvent 0x1800f2110
api-ms-win-core-libraryloader-l1-2-0.dll 12
FindResourceExW 0x1800f2150
FreeLibrary 0x1800f2120
FreeResource 0x1800f2170
GetModuleFileNameA 0x1800f2138
GetModuleFileNameW 0x1800f2168
GetModuleHandleExW 0x1800f2160
GetModuleHandleW 0x1800f2140
GetProcAddress 0x1800f2148
LoadLibraryExW 0x1800f2128
LoadResource 0x1800f2178
LockResource 0x1800f2130
SizeofResource 0x1800f2158
api-ms-win-core-localization-l1-2-0.dll 7
FormatMessageW 0x1800f2188
GetSystemDefaultLangID 0x1800f21b0
GetThreadLocale 0x1800f2190
GetThreadPreferredUILanguages 0x1800f21a0
GetThreadUILanguage 0x1800f2198
SetThreadPreferredUILanguages 0x1800f21b8
SetThreadUILanguage 0x1800f21a8
api-ms-win-core-memory-l1-1-0.dll 3
CreateFileMappingW 0x1800f21d0
MapViewOfFile 0x1800f21c8
UnmapViewOfFile 0x1800f21d8
api-ms-win-core-perfcounters-l1-1-0.dll 6
PerfCreateInstance 0x1800f21f8
PerfDeleteInstance 0x1800f2200
PerfSetCounterRefValue 0x1800f21f0
PerfSetCounterSetInfo 0x1800f2208
PerfStartProviderEx 0x1800f2210
PerfStopProvider 0x1800f21e8
api-ms-win-core-processenvironment-l1-1-0.dll 4
ExpandEnvironmentStringsW 0x1800f2228
GetCurrentDirectoryW 0x1800f2230
GetEnvironmentVariableW 0x1800f2238
SearchPathW 0x1800f2220
api-ms-win-core-processthreads-l1-1-0.dll 13
CreateThread 0x1800f2248
GetCurrentProcess 0x1800f2270
GetCurrentProcessId 0x1800f22a8
GetCurrentThread 0x1800f2250
GetCurrentThreadId 0x1800f2280
OpenProcessToken 0x1800f2268
OpenThreadToken 0x1800f2288
SetThreadToken 0x1800f2278
TerminateProcess 0x1800f2258
TlsAlloc 0x1800f22a0
TlsFree 0x1800f2260
TlsGetValue 0x1800f2298
TlsSetValue 0x1800f2290
api-ms-win-core-processthreads-l1-1-1.dll 2
IsProcessorFeaturePresent 0x1800f22c0
OpenProcess 0x1800f22b8
api-ms-win-core-processthreads-l1-1-3.dll 1
SetThreadDescription 0x1800f22d0
api-ms-win-core-profile-l1-1-0.dll 1
QueryPerformanceCounter 0x1800f22e0
api-ms-win-core-registry-l1-1-0.dll 12
RegCloseKey 0x1800f2338
RegCreateKeyExW 0x1800f2310
RegDeleteKeyExW 0x1800f2320
RegDeleteValueW 0x1800f2308
RegEnumKeyExW 0x1800f2340
RegGetKeySecurity 0x1800f2330
RegGetValueW 0x1800f2348
RegNotifyChangeKeyValue 0x1800f2300
RegOpenKeyExW 0x1800f22f0
RegQueryInfoKeyW 0x1800f2318
RegQueryValueExW 0x1800f2328
RegSetValueExW 0x1800f22f8
api-ms-win-core-state-helpers-l1-1-0.dll 1
GetRegistryValueWithFallbackW 0x1800f2358
api-ms-win-core-string-l1-1-0.dll 3
CompareStringOrdinal 0x1800f2370
MultiByteToWideChar 0x1800f2378
WideCharToMultiByte 0x1800f2368
api-ms-win-core-synch-l1-1-0.dll 27
AcquireSRWLockExclusive 0x1800f2390
AcquireSRWLockShared 0x1800f23b0
CancelWaitableTimer 0x1800f23f8
CreateEventW 0x1800f23f0
CreateMutexExW 0x1800f2418
CreateSemaphoreExW 0x1800f2410
CreateWaitableTimerExW 0x1800f2420
DeleteCriticalSection 0x1800f2430
EnterCriticalSection 0x1800f2408
InitializeCriticalSection 0x1800f2438
InitializeCriticalSectionAndSpinCount 0x1800f2448
InitializeCriticalSectionEx 0x1800f23d8
InitializeSRWLock 0x1800f23d0
LeaveCriticalSection 0x1800f23e0
OpenEventW 0x1800f2450
OpenSemaphoreW 0x1800f23a0
ReleaseMutex 0x1800f23b8
ReleaseSemaphore 0x1800f2400
ReleaseSRWLockExclusive 0x1800f23a8
ReleaseSRWLockShared 0x1800f23c0
ResetEvent 0x1800f2398
SetEvent 0x1800f2458
SetWaitableTimer 0x1800f2440
TryAcquireSRWLockExclusive 0x1800f23e8
WaitForMultipleObjectsEx 0x1800f2428
WaitForSingleObject 0x1800f23c8
WaitForSingleObjectEx 0x1800f2388
api-ms-win-core-synch-l1-2-0.dll 7
InitializeConditionVariable 0x1800f2490
InitOnceBeginInitialize 0x1800f2480
InitOnceComplete 0x1800f2498
Sleep 0x1800f2488
SleepConditionVariableCS 0x1800f2468
SleepConditionVariableSRW 0x1800f2470
WakeAllConditionVariable 0x1800f2478
api-ms-win-core-sysinfo-l1-1-0.dll 9
GetComputerNameExW 0x1800f24c0
GetLocalTime 0x1800f24d0
GetSystemInfo 0x1800f24b0
GetSystemTime 0x1800f24e0
GetSystemTimeAsFileTime 0x1800f24c8
GetTickCount 0x1800f24a8
GetTickCount64 0x1800f24d8
GetVersionExW 0x1800f24e8
GlobalMemoryStatusEx 0x1800f24b8
api-ms-win-core-sysinfo-l1-2-0.dll 1
GetOsSafeBootMode 0x1800f24f8
api-ms-win-core-threadpool-l1-2-0.dll 20
CancelThreadpoolIo 0x1800f2590
CloseThreadpoolCleanupGroup 0x1800f2508
CloseThreadpoolCleanupGroupMembers 0x1800f2510
CloseThreadpoolIo 0x1800f2588
CloseThreadpoolTimer 0x1800f25a0
CloseThreadpoolWait 0x1800f2580
CloseThreadpoolWork 0x1800f2528
CreateThreadpoolCleanupGroup 0x1800f2540
CreateThreadpoolIo 0x1800f2550
CreateThreadpoolTimer 0x1800f2560
CreateThreadpoolWait 0x1800f2570
CreateThreadpoolWork 0x1800f2518
FreeLibraryWhenCallbackReturns 0x1800f2530
SetThreadpoolTimer 0x1800f2558
SetThreadpoolWait 0x1800f2568
StartThreadpoolIo 0x1800f2538
SubmitThreadpoolWork 0x1800f2598
WaitForThreadpoolIoCallbacks 0x1800f2578
WaitForThreadpoolTimerCallbacks 0x1800f2520
WaitForThreadpoolWaitCallbacks 0x1800f2548
api-ms-win-core-timezone-l1-1-0.dll 4
FileTimeToSystemTime 0x1800f25b0
GetTimeZoneInformation 0x1800f25c0
SystemTimeToFileTime 0x1800f25b8
SystemTimeToTzSpecificLocalTime 0x1800f25c8
api-ms-win-core-version-l1-1-0.dll 3
GetFileVersionInfoExW 0x1800f25e0
GetFileVersionInfoSizeExW 0x1800f25e8
VerQueryValueW 0x1800f25d8
api-ms-win-crt-private-l1-1-0.dll 73
__C_specific_handler 0x1800f27f8
__CxxFrameHandler3 0x1800f2750
__CxxFrameHandler4 0x1800f2808
__std_terminate 0x1800f2800
_CxxThrowException 0x1800f2820
_o___std_exception_copy 0x1800f27c8
_o___std_exception_destroy 0x1800f27c0
_o___std_type_info_destroy_list 0x1800f27b8
_o___stdio_common_vsnprintf_s 0x1800f27b0
_o___stdio_common_vsnwprintf_s 0x1800f27a8
_o___stdio_common_vsprintf 0x1800f27a0
_o___stdio_common_vsprintf_s 0x1800f2798
_o___stdio_common_vswprintf 0x1800f2790
_o___stdio_common_vswprintf_s 0x1800f2788
_o___stdio_common_vswscanf 0x1800f2780
_o__cexit 0x1800f2838
_o__configure_narrow_argv 0x1800f2818
_o__crt_atexit 0x1800f2810
_o__errno 0x1800f27d8
_o__execute_onexit_table 0x1800f27d0
_o__i64tow_s 0x1800f2778
_o__initialize_narrow_environment 0x1800f2770
_o__initialize_onexit_table 0x1800f2768
_o__invalid_parameter_noinfo 0x1800f2760
_o__invalid_parameter_noinfo_noreturn 0x1800f2758
_o__itow_s 0x1800f25f8
_o__purecall 0x1800f2600
_o__register_onexit_function 0x1800f2608
_o__seh_filter_dll 0x1800f2610
_o__set_errno 0x1800f2618
_o__strnicmp 0x1800f2620
_o__ui64tow_s 0x1800f2628
_o__ultow_s 0x1800f2630
_o__wcsicmp 0x1800f2638
_o__wcsnicmp 0x1800f2640
_o__wcstoi64 0x1800f2648
_o__wcstoui64 0x1800f2650
_o__wfopen 0x1800f2658
_o__wtof 0x1800f2668
_o__wtoi 0x1800f2670
_o__wtoi64 0x1800f2678
_o__wtol 0x1800f2680
_o_bsearch 0x1800f2688
_o_calloc 0x1800f2690
_o_fclose 0x1800f2698
_o_fgetws 0x1800f26a0
_o_free 0x1800f26a8
_o_iswalnum 0x1800f26b0
_o_iswalpha 0x1800f26b8
_o_iswdigit 0x1800f26c0
_o_iswspace 0x1800f26c8
_o_malloc 0x1800f26d0
_o_memcpy_s 0x1800f26d8
_o_qsort 0x1800f26e0
_o_strncpy_s 0x1800f26e8
_o_strtol 0x1800f26f0
_o_terminate 0x1800f26f8
_o_toupper 0x1800f2700
_o_towupper 0x1800f2708
_o_wcscpy_s 0x1800f2710
_o_wcsncpy_s 0x1800f2718
_o_wcstod 0x1800f2720
_o_wcstok_s 0x1800f2728
_o_wcstol 0x1800f2730
_o_wcstoul 0x1800f2738
memcmp 0x1800f2828
memcpy 0x1800f2830
memmove 0x1800f2660
strchr 0x1800f27e8
strrchr 0x1800f27e0
wcschr 0x1800f27f0
wcsrchr 0x1800f2740
wcsstr 0x1800f2748
api-ms-win-crt-runtime-l1-1-0.dll 2
_initterm 0x1800f2850
_initterm_e 0x1800f2848
api-ms-win-crt-string-l1-1-0.dll 9
memset 0x1800f2888
strncmp 0x1800f2860
strnlen 0x1800f2890
wcscmp 0x1800f2898
wcscspn 0x1800f2878
wcsncmp 0x1800f2870
wcsnlen 0x1800f28a0
wcspbrk 0x1800f2868
wcsspn 0x1800f2880
api-ms-win-eventing-classicprovider-l1-1-0.dll 6
GetTraceEnableFlags 0x1800f28c0
GetTraceEnableLevel 0x1800f28b0
GetTraceLoggerHandle 0x1800f28d8
RegisterTraceGuidsW 0x1800f28d0
TraceMessage 0x1800f28b8
UnregisterTraceGuids 0x1800f28c8
api-ms-win-eventing-consumer-l1-1-0.dll 3
CloseTrace 0x1800f28f8
OpenTraceW 0x1800f28f0
ProcessTrace 0x1800f28e8
api-ms-win-eventing-controller-l1-1-0.dll 3
ControlTraceW 0x1800f2908
EnableTraceEx2 0x1800f2910
StartTraceW 0x1800f2918
api-ms-win-eventing-provider-l1-1-0.dll 6
EventActivityIdControl 0x1800f2950
EventProviderEnabled 0x1800f2938
EventRegister 0x1800f2930
EventSetInformation 0x1800f2928
EventUnregister 0x1800f2948
EventWriteTransfer 0x1800f2940
api-ms-win-security-base-l1-1-0.dll 28
AccessCheck 0x1800f29e8
AccessCheckAndAuditAlarmW 0x1800f2970
AddAce 0x1800f29d8
AdjustTokenPrivileges 0x1800f2a30
AllocateAndInitializeSid 0x1800f29c8
CreateWellKnownSid 0x1800f2a28
FreeSid 0x1800f2a20
GetAce 0x1800f29a8
GetAclInformation 0x1800f2988
GetLengthSid 0x1800f2998
GetSecurityDescriptorControl 0x1800f29b0
GetSecurityDescriptorDacl 0x1800f29a0
GetSecurityDescriptorGroup 0x1800f29f8
GetSecurityDescriptorLength 0x1800f2980
GetSecurityDescriptorOwner 0x1800f29e0
GetSecurityDescriptorSacl 0x1800f2978
GetTokenInformation 0x1800f2a38
InitializeAcl 0x1800f2990
InitializeSecurityDescriptor 0x1800f2a00
IsValidSecurityDescriptor 0x1800f29c0
IsValidSid 0x1800f29f0
IsWellKnownSid 0x1800f2960
MakeSelfRelativeSD 0x1800f29b8
MapGenericMask 0x1800f29d0
PrivilegeCheck 0x1800f2968
SetSecurityDescriptorDacl 0x1800f2a08
SetSecurityDescriptorGroup 0x1800f2a18
SetSecurityDescriptorOwner 0x1800f2a10
api-ms-win-security-base-l1-2-0.dll 1
CheckTokenMembershipEx 0x1800f2a48
api-ms-win-security-isolatedcontainer-l1-1-1.dll 1
IsProcessInWDAGContainer 0x1800f2a58
api-ms-win-security-sddl-l1-1-0.dll 4
ConvertSecurityDescriptorToStringSecurityDescriptorW 0x1800f2a68
ConvertSidToStringSidW 0x1800f2a78
ConvertStringSecurityDescriptorToSecurityDescriptorW 0x1800f2a70
ConvertStringSidToSidW 0x1800f2a80
api-ms-win-service-core-l1-1-0.dll 2
RegisterServiceCtrlHandlerExW 0x1800f2a98
SetServiceStatus 0x1800f2a90
api-ms-win-service-core-l1-1-3.dll 1
GetServiceRegistryStateKey 0x1800f2aa8
api-ms-win-service-core-l1-1-4.dll 1
GetServiceDirectory 0x1800f2ab8
bcrypt.dll 7
BCryptCloseAlgorithmProvider 0x1800f2ad0
BCryptCreateHash 0x1800f2af8
BCryptDestroyHash 0x1800f2ad8
BCryptFinishHash 0x1800f2ae0
BCryptGetProperty 0x1800f2af0
BCryptHashData 0x1800f2ae8
BCryptOpenAlgorithmProvider 0x1800f2ac8
msvcp_win.dll 7
_Mtx_destroy_in_situ 0x1800f2b20
_Mtx_init_in_situ 0x1800f2b10
_Mtx_lock 0x1800f2b18
_Mtx_unlock 0x1800f2b08
?_Throw_C_error@std@@YAXH@Z 0x1800f2b38
?_Xlength_error@std@@YAXPEBD@Z 0x1800f2b28
?_Xout_of_range@std@@YAXPEBD@Z 0x1800f2b30
ntdll.dll 50
NtClose 0x1800f2b88
NtCreateFile 0x1800f2c78
NtDeleteFile 0x1800f2b68
NtDuplicateObject 0x1800f2be0
NtOpenProcess 0x1800f2bd0
NtQueryAttributesFile 0x1800f2c90
NtQueryInformationProcess 0x1800f2c50
NtQuerySystemInformation 0x1800f2b48
NtQuerySystemTime 0x1800f2ca0
NtQueryVolumeInformationFile 0x1800f2c18
NtReadFile 0x1800f2c08
NtSetInformationFile 0x1800f2c30
NtWriteFile 0x1800f2c10
RtlAcquireSRWLockExclusive 0x1800f2b70
RtlAcquireSRWLockShared 0x1800f2b78
RtlAnsiStringToUnicodeString 0x1800f2bc8
RtlCaptureContext 0x1800f2c48
RtlComputeCrc32 0x1800f2c20
RtlDeleteCriticalSection 0x1800f2c80
RtlDeleteElementGenericTableAvl 0x1800f2ba0
RtlDosPathNameToNtPathName_U 0x1800f2b58
RtlEnterCriticalSection 0x1800f2ca8
RtlEnumerateGenericTableAvl 0x1800f2be8
RtlEthernetAddressToStringW 0x1800f2bb8
RtlFreeUnicodeString 0x1800f2b50
RtlGetLastNtStatus 0x1800f2cb0
RtlGetPersistedStateLocation 0x1800f2bf8
RtlGetVersion 0x1800f2cc8
RtlInitializeCriticalSection 0x1800f2cb8
RtlInitializeGenericTableAvl 0x1800f2bf0
RtlInitUnicodeString 0x1800f2bd8
RtlInsertElementGenericTableAvl 0x1800f2b98
RtlIpv4AddressToStringExW 0x1800f2ba8
RtlIpv6AddressToStringExW 0x1800f2bb0
RtlIpv6AddressToStringW 0x1800f2bc0
RtlLeaveCriticalSection 0x1800f2cc0
RtlLengthSid 0x1800f2cd0
RtlLookupElementGenericTableAvl 0x1800f2b90
RtlLookupFunctionEntry 0x1800f2c40
RtlNtStatusToDosError 0x1800f2c70
RtlNtStatusToDosErrorNoTeb 0x1800f2c98
RtlReleaseSRWLockExclusive 0x1800f2b60
RtlReleaseSRWLockShared 0x1800f2b80
RtlSecondsSince1970ToTime 0x1800f2c68
RtlSetLastWin32Error 0x1800f2c00
RtlSetLastWin32ErrorAndNtStatusFromNtStatus 0x1800f2c28
RtlSubscribeWnfStateChangeNotification 0x1800f2c60
RtlTimeToSecondsSince1970 0x1800f2c88
RtlUnsubscribeWnfNotificationWaitForCompletion 0x1800f2c58
RtlVirtualUnwind 0x1800f2c38
RPCRT4.dll 28
I_RpcBindingInqLocalClientPID 0x1800f1e50
I_RpcBindingIsClientLocal 0x1800f1e58
I_RpcMapWin32Status 0x1800f1d98
Ndr64AsyncServerCallAll 0x1800f1dd0
NdrAsyncServerCall 0x1800f1d90
NdrServerCall2 0x1800f1dd8
NdrServerCallAll 0x1800f1e40
RpcAsyncCompleteCall 0x1800f1da0
RpcBindingToStringBindingW 0x1800f1dc8
RpcBindingVectorFree 0x1800f1da8
RpcEpRegisterW 0x1800f1e28
RpcEpUnregister 0x1800f1e20
RpcImpersonateClient 0x1800f1e00
RpcRevertToSelf 0x1800f1e08
RpcRevertToSelfEx 0x1800f1e48
RpcServerInqBindings 0x1800f1e38
RpcServerInqCallAttributesW 0x1800f1e30
RpcServerRegisterAuthInfoW 0x1800f1e18
RpcServerRegisterIf3 0x1800f1de0
RpcServerRegisterIfEx 0x1800f1df8
RpcServerSubscribeForNotification 0x1800f1e60
RpcServerUnregisterIfEx 0x1800f1dc0
RpcServerUnsubscribeForNotification 0x1800f1e68
RpcServerUseProtseqEpW 0x1800f1db8
RpcServerUseProtseqExW 0x1800f1db0
RpcStringBindingParseW 0x1800f1df0
RpcStringFreeW 0x1800f1de8
UuidCreate 0x1800f1e10
USERENV.dll 4
EnterCriticalPolicySection 0x1800f1e88
LeaveCriticalPolicySection 0x1800f1e78
RegisterGPNotification 0x1800f1e90
UnregisterGPNotification 0x1800f1e80
WS2_32.dll 16
bind 0x1800f1f10
closesocket 0x1800f1f18
getpeername 0x1800f1ee8
listen 0x1800f1ef0
ntohl 0x1800f1ea8
ntohs 0x1800f1ed0
setsockopt 0x1800f1ec0
WSAAddressToStringW 0x1800f1ec8
WSACleanup 0x1800f1eb8
WSAGetLastError 0x1800f1eb0
WSAIoctl 0x1800f1ee0
WSARecv 0x1800f1f08
WSASend 0x1800f1ed8
WSASocketW 0x1800f1f00
WSAStartup 0x1800f1ea0
WSAStringToAddressW 0x1800f1ef8