ntevt.dll

v10.0.19041.5794 64-bit Windows NT Analyzed
Download
Description
WMI Event Log Provider
Authors
© Microsoft Corporation. All rights reserved.
File size
280.5 KB
Uploaded
2025-12-01 07:51
Views
68
SHA-256
d545db03b014e4d24491a0ba53f5d74b

Exported functions 4

DllCanUnloadNow #1 · 0x89e0
DllGetClassObject #2 · 0x63f0
DllRegisterServer #3 · 0x16aa0
DllUnregisterServer #4 · 0x17aa0

Imported DLLs & functions 215

api-ms-win-core-com-l1-1-0.dll 2
CoGetCallContext 0x180030320
StringFromGUID2 0x180030318
api-ms-win-core-debug-l1-1-0.dll 3
DebugBreak 0x180030340
IsDebuggerPresent 0x180030338
OutputDebugStringW 0x180030330
api-ms-win-core-errorhandling-l1-1-0.dll 4
GetLastError 0x180030350
SetLastError 0x180030358
SetUnhandledExceptionFilter 0x180030360
UnhandledExceptionFilter 0x180030368
api-ms-win-core-file-l1-1-0.dll 1
CompareFileTime 0x180030378
api-ms-win-core-handle-l1-1-0.dll 1
CloseHandle 0x180030388
api-ms-win-core-heap-l1-1-0.dll 4
GetProcessHeap 0x1800303a8
HeapAlloc 0x1800303a0
HeapFree 0x1800303b0
HeapReAlloc 0x180030398
api-ms-win-core-heap-l2-1-0.dll 1
LocalFree 0x1800303c0
api-ms-win-core-libraryloader-l1-2-0.dll 6
DisableThreadLibraryCalls 0x1800303e8
GetModuleFileNameA 0x1800303f0
GetModuleFileNameW 0x1800303f8
GetModuleHandleExW 0x1800303d0
GetModuleHandleW 0x1800303e0
GetProcAddress 0x1800303d8
api-ms-win-core-localization-l1-2-0.dll 2
FormatMessageW 0x180030408
LCMapStringW 0x180030410
api-ms-win-core-processenvironment-l1-1-0.dll 1
ExpandEnvironmentStringsW 0x180030420
api-ms-win-core-processthreads-l1-1-0.dll 6
GetCurrentProcess 0x180030458
GetCurrentProcessId 0x180030448
GetCurrentThread 0x180030440
GetCurrentThreadId 0x180030430
OpenThreadToken 0x180030438
TerminateProcess 0x180030450
api-ms-win-core-profile-l1-1-0.dll 1
QueryPerformanceCounter 0x180030468
api-ms-win-core-registry-l1-1-0.dll 5
RegCloseKey 0x180030490
RegCreateKeyExW 0x180030480
RegEnumKeyExW 0x180030478
RegOpenKeyExW 0x180030498
RegSetValueExW 0x180030488
api-ms-win-core-registry-l2-1-0.dll 1
RegDeleteKeyW 0x1800304a8
api-ms-win-core-rtlsupport-l1-1-0.dll 3
RtlCaptureContext 0x1800304c0
RtlLookupFunctionEntry 0x1800304b8
RtlVirtualUnwind 0x1800304c8
api-ms-win-core-string-l1-1-0.dll 1
MultiByteToWideChar 0x1800304d8
api-ms-win-core-synch-l1-1-0.dll 16
AcquireSRWLockExclusive 0x180030508
AcquireSRWLockShared 0x1800304f8
CreateMutexExW 0x1800304f0
CreateSemaphoreExW 0x180030560
DeleteCriticalSection 0x180030550
EnterCriticalSection 0x180030548
InitializeCriticalSectionAndSpinCount 0x180030558
InitializeCriticalSectionEx 0x180030510
LeaveCriticalSection 0x180030540
OpenSemaphoreW 0x180030530
ReleaseMutex 0x180030500
ReleaseSemaphore 0x1800304e8
ReleaseSRWLockExclusive 0x180030528
ReleaseSRWLockShared 0x180030538
WaitForSingleObject 0x180030520
WaitForSingleObjectEx 0x180030518
api-ms-win-core-synch-l1-2-0.dll 1
Sleep 0x180030570
api-ms-win-core-sysinfo-l1-1-0.dll 3
GetSystemTimeAsFileTime 0x180030588
GetTickCount 0x180030580
GetTickCount64 0x180030590
api-ms-win-core-threadpool-l1-2-0.dll 4
CloseThreadpoolTimer 0x1800305a8
CreateThreadpoolTimer 0x1800305a0
SetThreadpoolTimer 0x1800305b8
WaitForThreadpoolTimerCallbacks 0x1800305b0
api-ms-win-core-timezone-l1-1-0.dll 3
FileTimeToSystemTime 0x1800305d8
GetTimeZoneInformation 0x1800305d0
SystemTimeToFileTime 0x1800305c8
api-ms-win-eventing-classicprovider-l1-1-0.dll 6
GetTraceEnableFlags 0x1800305e8
GetTraceEnableLevel 0x180030610
GetTraceLoggerHandle 0x180030608
RegisterTraceGuidsW 0x180030600
TraceMessage 0x1800305f0
UnregisterTraceGuids 0x1800305f8
api-ms-win-security-base-l1-1-0.dll 5
GetLengthSid 0x180030630
GetSecurityDescriptorDacl 0x180030628
GetTokenInformation 0x180030638
ImpersonateSelf 0x180030620
RevertToSelf 0x180030640
api-ms-win-security-lsalookup-l1-1-0.dll 1
LookupAccountSidLocalW 0x180030650
api-ms-win-security-provider-l1-1-0.dll 1
GetExplicitEntriesFromAclW 0x180030660
api-ms-win-security-sddl-l1-1-0.dll 2
ConvertSidToStringSidW 0x180030670
ConvertStringSecurityDescriptorToSecurityDescriptorW 0x180030678
api-ms-win-security-trustee-l1-1-0.dll 1
BuildSecurityDescriptorW 0x180030688
msvcrt.dll 53
__C_specific_handler 0x180030720
__CxxFrameHandler3 0x180030768
__dllonexit 0x180030748
__RTtypeid 0x180030718
_amsg_exit 0x180030770
_CxxThrowException 0x1800306a0
_i64tow_s 0x180030760
_initterm 0x180030798
_lock 0x180030750
_onexit 0x1800306f0
_purecall 0x1800307c0
_ui64tow_s 0x180030788
_ultow_s 0x1800307b8
_unlock 0x180030778
_vsnprintf 0x1800307e8
_vsnprintf_s 0x180030830
_vsnwprintf 0x180030810
_vsnwprintf_s 0x180030730
_wcsicmp 0x1800307b0
_wtol 0x1800307d0
_XcptFilter 0x180030740
??0exception@@QEAA@AEBQEBD@Z 0x1800306c8
??0exception@@QEAA@AEBQEBDH@Z 0x1800306c0
??0exception@@QEAA@AEBV0@@Z 0x1800306b8
??0exception@@QEAA@XZ 0x1800306d8
??1exception@@UEAA@XZ 0x180030780
??1type_info@@UEAA@XZ 0x1800306d0
??8type_info@@QEBAHAEBV0@@Z 0x180030728
?terminate@@YAXXZ 0x1800306b0
?what@exception@@UEBAPEBDXZ 0x1800306a8
atol 0x1800307e0
free 0x180030758
iswalnum 0x1800307f0
iswalpha 0x1800307f8
iswdigit 0x180030818
iswspace 0x180030820
iswxdigit 0x180030800
malloc 0x1800306e0
memcmp 0x1800307a8
memcpy 0x180030698
memcpy_s 0x180030790
memmove 0x1800306e8
memmove_s 0x180030808
memset 0x1800307c8
realloc 0x1800306f8
sscanf_s 0x1800307d8
swprintf_s 0x180030738
swscanf_s 0x180030700
towlower 0x180030708
towupper 0x180030710
wcscmp 0x180030838
wcstol 0x180030828
wcstoul 0x1800307a0
OLEAUT32.dll 13
SafeArrayAccessData 0x180030128
SafeArrayCreate 0x180030140
SafeArrayDestroy 0x180030150
SafeArrayGetDim 0x180030158
SafeArrayUnaccessData 0x180030130
SysAllocString 0x180030138
SysAllocStringLen 0x180030160
SysFreeString 0x180030148
SysStringLen 0x180030178
VariantChangeTypeEx 0x180030168
VariantClear 0x180030118
VariantCopy 0x180030170
VariantInit 0x180030120
PROVTHRD.dll 46
??0QueryPreprocessor@@QEAA@XZ 0x180030260
??0WmiSignedIntegerNode@@QEAA@PEAGJKPEAVWmiTreeNode@@@Z 0x180030248
??0WmiSignedIntegerRangeNode@@QEAA@PEAGKHHHHJJPEAVWmiTreeNode@@1@Z 0x180030228
??0WmiStringNode@@QEAA@PEAG0W4WmiValueFunction@WmiValueNode@@1KPEAVWmiTreeNode@@@Z 0x180030250
??0WmiStringRangeNode@@QEAA@PEAGKHHHH00PEAVWmiTreeNode@@1@Z 0x180030218
??0WmiUnsignedIntegerNode@@QEAA@PEAGKKPEAVWmiTreeNode@@@Z 0x180030240
??0WmiUnsignedIntegerRangeNode@@QEAA@PEAGKHHHHKKPEAVWmiTreeNode@@1@Z 0x180030220
??1QueryPreprocessor@@UEAA@XZ 0x180030268
??1WmiSignedIntegerNode@@UEAA@XZ 0x180030210
??1WmiSignedIntegerRangeNode@@UEAA@XZ 0x1800301b0
??1WmiStringNode@@UEAA@XZ 0x180030238
??1WmiStringRangeNode@@UEAA@XZ 0x180030198
??1WmiUnsignedIntegerNode@@UEAA@XZ 0x1800301f0
??1WmiUnsignedIntegerRangeNode@@UEAA@XZ 0x1800301c8
?ClosedLowerBound@WmiRangeNode@@QEAAHXZ 0x180030258
?ClosedUpperBound@WmiRangeNode@@QEAAHXZ 0x1800302b8
?Copy@WmiSignedIntegerNode@@UEAAPEAVWmiTreeNode@@XZ 0x180030208
?Copy@WmiSignedIntegerRangeNode@@UEAAPEAVWmiTreeNode@@XZ 0x1800301a8
?Copy@WmiStringNode@@UEAAPEAVWmiTreeNode@@XZ 0x1800301d8
?Copy@WmiStringRangeNode@@UEAAPEAVWmiTreeNode@@XZ 0x180030190
?Copy@WmiUnsignedIntegerNode@@UEAAPEAVWmiTreeNode@@XZ 0x1800301e8
?Copy@WmiUnsignedIntegerRangeNode@@UEAAPEAVWmiTreeNode@@XZ 0x1800301c0
?CopyNode@WmiTreeNode@@UEAAPEAV1@XZ 0x180030200
?GetConstantFunction@WmiValueNode@@QEAA?AW4WmiValueFunction@1@XZ 0x1800302e8
?GetPartition@PartitionSet@@QEAAPEAV1@K@Z 0x180030290
?GetPartitionCount@PartitionSet@@QEAAKXZ 0x180030288
?GetPropertyFunction@WmiValueNode@@QEAA?AW4WmiValueFunction@1@XZ 0x1800302f0
?GetPropertyName@WmiValueNode@@QEAAPEAGXZ 0x180030230
?GetRange@PartitionSet@@QEAAPEAVWmiRangeNode@@XZ 0x180030298
?GetValue@WmiSignedIntegerNode@@QEAAJXZ 0x1800302b0
?GetValue@WmiStringNode@@QEAAPEAGXZ 0x1800302e0
?InfiniteLowerBound@WmiRangeNode@@QEAAHXZ 0x1800302a0
?InfiniteUpperBound@WmiRangeNode@@QEAAHXZ 0x1800302a8
?LowerBound@WmiStringRangeNode@@QEAAPEAGXZ 0x1800302c8
?LowerBound@WmiUnsignedIntegerRangeNode@@QEAAKXZ 0x1800302d0
?PreProcess@QueryPreprocessor@@QEAA?AW4QuadState@1@PEAXPEAUSQL_LEVEL_1_RPN_EXPRESSION@@AEAPEAVWmiTreeNode@@@Z 0x180030278
?PreProcess@QueryPreprocessor@@QEAA?AW4QuadState@1@PEAXPEAUSQL_LEVEL_1_RPN_EXPRESSION@@PEAVWmiTreeNode@@KPEAPEAGAEAPEAVPartitionSet@@@Z 0x180030280
?Print@WmiSignedIntegerNode@@UEAAXXZ 0x1800301f8
?Print@WmiSignedIntegerRangeNode@@UEAAXXZ 0x1800301a0
?Print@WmiStringNode@@UEAAXXZ 0x1800301d0
?Print@WmiStringRangeNode@@UEAAXXZ 0x180030188
?Print@WmiUnsignedIntegerNode@@UEAAXXZ 0x1800301e0
?Print@WmiUnsignedIntegerRangeNode@@UEAAXXZ 0x1800301b8
?Query@QueryPreprocessor@@QEAA?AW4QuadState@1@PEAGAEAPEAUSQL_LEVEL_1_RPN_EXPRESSION@@@Z 0x180030270
?UpperBound@WmiStringRangeNode@@QEAAPEAGXZ 0x1800302c0
?UpperBound@WmiUnsignedIntegerRangeNode@@QEAAKXZ 0x1800302d8
RPCRT4.dll 2
RpcStringFreeW 0x180030308
UuidToStringW 0x180030300
wevtapi.dll 16
EvtClearLog 0x1800308b0
EvtClose 0x1800308a0
EvtCreateRenderContext 0x180030858
EvtExportLog 0x1800308b8
EvtFormatMessage 0x180030848
EvtGetChannelConfigProperty 0x180030898
EvtGetLogInfo 0x180030878
EvtNext 0x180030868
EvtOpenChannelConfig 0x1800308a8
EvtOpenLog 0x1800308c0
EvtOpenPublisherMetadata 0x180030860
EvtQuery 0x180030870
EvtRender 0x180030850
EvtSaveChannelConfig 0x180030888
EvtSetChannelConfigProperty 0x180030890
EvtSubscribe 0x180030880