EtwProcessor.dll

v10.98.2504.14002 64-bit Windows Analyzed
Description
Library for processing ETW events [v10.98k]
Authors
©Microsoft Corporation. All rights reserved.
File size
405.5 KB
Uploaded
2025-12-03 02:40
Views
23
SHA-256
0436208a03bb6f05e877a3bafd130e0a

Exported functions 151

??0EtwEvent@Processor@Etw@@QEAA@AEBV012@@Z #1 · 0x140c0
??0WaiterCollection@Processor@Etw@@QEAA@AEBV012@@Z #2 · 0x140c0
??0WaiterCollection@Processor@Etw@@QEAA@XZ #3 · 0x148e0
??1EtwEvent@Processor@Etw@@QEAA@XZ #4 · 0x14030
??1EtwFileConsumer@Processor@Etw@@UEAA@XZ #5 · 0x10db0
??1EtwRealtimeConsumer@Processor@Etw@@UEAA@XZ #6 · 0x12820
??1EtwWaiter@Processor@Etw@@UEAA@XZ #7 · 0x13cd0
??1Waiter@Processor@Etw@@UEAA@XZ #8 · 0x132e0
??1WaiterCollection@Processor@Etw@@QEAA@XZ #9 · 0x14030
??4EtwEvent@Processor@Etw@@QEAAAEAV012@V012@@Z #10 · 0x14160
??4Waiter@Processor@Etw@@QEAAAEAV012@V012@@Z #11 · 0x132a0
??4WaiterCollection@Processor@Etw@@QEAAAEAV012@V012@@Z #12 · 0x14160
?Add@WaiterCollection@Processor@Etw@@QEAAXAEBVWaiter@23@@Z #13 · 0x14960
?CloseTrace@EtwConsumer@Processor@Etw@@QEAAJXZ #14 · 0x3050
?CopyFrom@Waiter@Processor@Etw@@AEAAXAEBV123@@Z #15 · 0x13210
?DisableProvider@EtwController@Processor@Etw@@SAJPEBGAEBU_GUID@@@Z #16 · 0x3750
?DisableProvider@EtwController@Processor@Etw@@SAJPEB_WAEBU_GUID@@@Z #17 · 0x39b0
?DisableProvider@EtwRealtimeConsumer@Processor@Etw@@QEAAJAEBU_GUID@@@Z #18 · 0x12960
?EnableProvider@EtwController@Processor@Etw@@SAJPEBGAEBU_GUID@@@Z #19 · 0x3740
?EnableProvider@EtwController@Processor@Etw@@SAJPEBGAEBU_GUID@@E_K2K@Z #20 · 0x3730
?EnableProvider@EtwController@Processor@Etw@@SAJPEB_WAEBU_GUID@@@Z #21 · 0x3960
?EnableProvider@EtwController@Processor@Etw@@SAJPEB_WAEBU_GUID@@E_K2K@Z #22 · 0x38f0
?EnableProvider@EtwRealtimeConsumer@Processor@Etw@@QEAAJAEBU_GUID@@@Z #23 · 0x12880
?EnableProvider@EtwRealtimeConsumer@Processor@Etw@@QEAAJAEBU_GUID@@E_K1K@Z #24 · 0x128f0
?Flush@EtwController@Processor@Etw@@SAJPEBG@Z #25 · 0x3760
?Flush@EtwController@Processor@Etw@@SAJPEB_W@Z #26 · 0x3760
?Flush@EtwRealtimeConsumer@Processor@Etw@@QEAAJXZ #27 · 0x12a80
?FromEventRecord@EtwEvent@Processor@Etw@@SA?AV123@PEAU_EVENT_RECORD@@@Z #28 · 0x141a0
?GetActivityId@EtwEvent@Processor@Etw@@QEBA?AU_GUID@@XZ #29 · 0x14340
?GetCachedEvent@CachingWaiter@Processor@Etw@@QEAA?AVEtwEvent@23@XZ #30 · 0x14810
?GetChannel@EtwEvent@Processor@Etw@@QEBAEXZ #31 · 0x14270
?GetChannelName@EtwEvent@Processor@Etw@@QEBAPEBGXZ #32 · 0x14440
?GetEventId@EtwEvent@Processor@Etw@@QEBAKXZ #33 · 0x14230
?GetEventMessage@EtwEvent@Processor@Etw@@QEBAPEBGXZ #34 · 0x14500
?GetKeywordsName@EtwEvent@Processor@Etw@@QEBAPEBGXZ #35 · 0x14470
?GetLastErrorMessage@EtwEvent@Processor@Etw@@QEBAPEBGXZ #36 · 0x14200
?GetLastErrorMessage@Waiter@Processor@Etw@@QEBAPEBGXZ #37 · 0x13410
?GetLastErrorMessage@WaiterCollection@Processor@Etw@@QEBAPEBGXZ #38 · 0x14200
?GetLevel@EtwEvent@Processor@Etw@@QEBAEXZ #39 · 0x14290
?GetLevelName@EtwEvent@Processor@Etw@@QEBAPEBGXZ #40 · 0x14410
?GetOpCode@EtwEvent@Processor@Etw@@QEBAEXZ #41 · 0x142b0
?GetOpCodeName@EtwEvent@Processor@Etw@@QEBAPEBGXZ #42 · 0x144d0
?GetPayloadProperty@EtwEvent@Processor@Etw@@QEBAJPEBGAEAUtagVARIANT@@@Z #43 · 0x146d0
?GetPayloadProperty@EtwEvent@Processor@Etw@@QEBAJPEB_WAEAUtagVARIANT@@@Z #44 · 0x14590
?GetPayloadPropertyNames@EtwEvent@Processor@Etw@@QEBAJPEAPEBGKPEAK@Z #45 · 0x147f0
?GetPayloadPropertyNames@EtwEvent@Processor@Etw@@QEBAJPEAPEB_WKPEAK@Z #46 · 0x14750
?GetProcessId@EtwEvent@Processor@Etw@@QEBAKXZ #47 · 0x142f0
?GetProviderGuid@EtwEvent@Processor@Etw@@QEBA?AU_GUID@@XZ #48 · 0x14310
?GetProviderMessage@EtwEvent@Processor@Etw@@QEBAPEBGXZ #49 · 0x14530
?GetProviderName@EtwEvent@Processor@Etw@@QEBAPEBGXZ #50 · 0x143e0
?GetRelatedActivityId@EtwEvent@Processor@Etw@@QEBA?AU_GUID@@XZ #51 · 0x143b0
?GetTaskName@EtwEvent@Processor@Etw@@QEBAPEBGXZ #52 · 0x144a0
?GetThreadId@EtwEvent@Processor@Etw@@QEBAKXZ #53 · 0x142d0
?GetTimeStamp@EtwEvent@Processor@Etw@@QEBA?AT_LARGE_INTEGER@@XZ #54 · 0x14370
?GetVersion@EtwEvent@Processor@Etw@@QEBAEXZ #55 · 0x14250
?HasRelatedActivity@EtwEvent@Processor@Etw@@QEBA_NXZ #56 · 0x14390
?Initialize@CachingWaiter@Processor@Etw@@AEAAXAEBVWaiter@23@@Z #57 · 0x13ce0
?Initialize@CachingWaiter@Processor@Etw@@AEAAXAEBVWaiter@23@PEBG@Z #58 · 0x13fc0
?Initialize@CachingWaiter@Processor@Etw@@AEAAXAEBVWaiter@23@PEB_W@Z #59 · 0x13cf0
?Initialize@CompositeWaiter@Processor@Etw@@AEAAXAEBVWaiterCollection@23@W4DefaultWaitBehavior@23@@Z #60 · 0x149c0
?Initialize@EtwFileConsumer@Processor@Etw@@AEAAXPEBG@Z #61 · 0x10da0
?Initialize@EtwFileConsumer@Processor@Etw@@AEAAXPEB_W@Z #62 · 0x10d20
?Initialize@EtwRealtimeConsumer@Processor@Etw@@AEAAXPEBGAEBUEtwRealtimeConsumerOptions@23@@Z #63 · 0x12810
?Initialize@EtwRealtimeConsumer@Processor@Etw@@AEAAXPEB_WAEBUEtwRealtimeConsumerOptions@23@@Z #64 · 0x12710
?Initialize@EtwWaiter@Processor@Etw@@AEAAXAEBU_GUID@@KPEBGAEBUEtwWaiterOptions@23@@Z #65 · 0x13cb0
?Initialize@EtwWaiter@Processor@Etw@@AEAAXAEBU_GUID@@KPEB_WAEBUEtwWaiterOptions@23@@Z #66 · 0x13620
?Initialize@EtwWaiter@Processor@Etw@@AEAAXAEBU_GUID@@PEBG1AEBUEtwWaiterOptions@23@@Z #67 · 0x13cc0
?Initialize@EtwWaiter@Processor@Etw@@AEAAXAEBU_GUID@@PEB_W1AEBUEtwWaiterOptions@23@@Z #68 · 0x138d0
?Initialize@MultiplicityWaiter@Processor@Etw@@AEAAXAEBVWaiter@23@I@Z #69 · 0x14890
?OpenTraceW@EtwFileConsumer@Processor@Etw@@UEAAJXZ #70 · 0x10e10
?OpenTraceW@EtwRealtimeConsumer@Processor@Etw@@UEAAJXZ #71 · 0x129b0
?PrintProperties@EtwEvent@Processor@Etw@@QEAAXXZ #72 · 0x14560
?ProcessTrace@EtwConsumer@Processor@Etw@@UEAAJXZ #73 · 0x2f90
?Reset@Waiter@Processor@Etw@@UEAAXXZ #74 · 0x133e0
?StartEtwTrace@EtwController@Processor@Etw@@SAJPEBG0AEBUEtwControllerOptions@23@@Z #75 · 0x3700
?StartEtwTrace@EtwController@Processor@Etw@@SAJPEBG0K@Z #76 · 0x36f0
?StartEtwTrace@EtwController@Processor@Etw@@SAJPEBGAEBUEtwControllerOptions@23@@Z #77 · 0x36e0
?StartEtwTrace@EtwController@Processor@Etw@@SAJPEBGK@Z #78 · 0x36d0
?StartEtwTrace@EtwController@Processor@Etw@@SAJPEB_W0AEBUEtwControllerOptions@23@@Z #79 · 0x38b0
?StartEtwTrace@EtwController@Processor@Etw@@SAJPEB_W0K@Z #80 · 0x3830
?StartEtwTrace@EtwController@Processor@Etw@@SAJPEB_WAEBUEtwControllerOptions@23@@Z #81 · 0x37f0
?StartEtwTrace@EtwController@Processor@Etw@@SAJPEB_WK@Z #82 · 0x3780
?StopEtwTrace@EtwController@Processor@Etw@@SAJPEBG@Z #83 · 0x3710
?StopEtwTrace@EtwController@Processor@Etw@@SAJPEB_W@Z #84 · 0x3710
?Wait@Waiter@Processor@Etw@@UEAAJI@Z #85 · 0x13380
?WaitAll@CompositeWaiter@Processor@Etw@@QEAAJI@Z #86 · 0x14af0
?WaitAny@CompositeWaiter@Processor@Etw@@QEAAJI@Z #87 · 0x14a90
CachingWaiter_Create #88 · 0x15c60
CachingWaiter_GetCachedEvent #89 · 0x15d40
CompositeWaiter_Create #90 · 0x15ea0
CompositeWaiter_CreateWithWaitAllAsDefault #91 · 0x15f60
CompositeWaiter_WaitAll #92 · 0x16040
CompositeWaiter_WaitAny #93 · 0x16030
EtwConsumer_CloseTrace #94 · 0x3640
EtwConsumer_Destroy #95 · 0x35e0
EtwConsumer_GetEndTimeStamp #96 · 0x3690
EtwConsumer_GetStartTimeStamp #97 · 0x3670
EtwConsumer_GetTickFrequency #98 · 0x3650
EtwConsumer_GetTimerResolution #99 · 0x36b0
EtwConsumer_ProcessTrace #100 · 0x3620
EtwConsumer_SetEventRecordCallback #101 · 0x3600
EtwController_DisableProvider #102 · 0x53a0
EtwController_EnableProvider #103 · 0x5350
EtwController_Flush #104 · 0x3760
EtwController_StartEtwTrace_1 #105 · 0x36d0
EtwController_StartEtwTrace_2 #106 · 0x36f0
EtwController_StopEtwTrace #107 · 0x3710
EtwEvent_Destroy #108 · 0x160e0
EtwEvent_FromEventRecord #109 · 0x16170
EtwEvent_GetActivityId #110 · 0x16390
EtwEvent_GetChannel #111 · 0x16270
EtwEvent_GetChannelName #112 · 0x164c0
EtwEvent_GetEventId #113 · 0x16210
EtwEvent_GetEventMessage #114 · 0x16580
EtwEvent_GetKeywordsName #115 · 0x164f0
EtwEvent_GetLevel #116 · 0x162a0
EtwEvent_GetLevelName #117 · 0x16490
EtwEvent_GetOpCode #118 · 0x162d0
EtwEvent_GetOpCodeName #119 · 0x16550
EtwEvent_GetPayloadProperty #120 · 0x146e0
EtwEvent_GetPayloadPropertyLegacy #121 · 0x14740
EtwEvent_GetPayloadPropertyNames #122 · 0x14800
EtwEvent_GetProcessId #123 · 0x16330
EtwEvent_GetProviderGuid #124 · 0x16360
EtwEvent_GetProviderMessage #125 · 0x165b0
EtwEvent_GetProviderName #126 · 0x16460
EtwEvent_GetRelatedActivityId #127 · 0x16420
EtwEvent_GetTaskName #128 · 0x16520
EtwEvent_GetThreadId #129 · 0x16300
EtwEvent_GetTimeStamp #130 · 0x163c0
EtwEvent_GetVersion #131 · 0x16240
EtwEvent_HasRelatedActivity #132 · 0x163f0
EtwEvent_PrintProperties #133 · 0x165e0
EtwFileConsumer_Create #134 · 0x10f20
EtwFileConsumer_OpenTrace #135 · 0x10fe0
EtwRealtimeConsumer_Create #136 · 0x12b30
EtwRealtimeConsumer_DisableProvider #137 · 0x12c30
EtwRealtimeConsumer_EnableProvider #138 · 0x12bd0
EtwRealtimeConsumer_Flush #139 · 0x12c80
EtwRealtimeConsumer_OpenTrace #140 · 0x10fe0
EtwWaiter_Create #141 · 0x15a60
EtwWaiter_CreateByName #142 · 0x15b60
MultiplicityWaiter_Create #143 · 0x15de0
PayloadProperty_GetMetadata #144 · 0x16600
PayloadProperty_GetValue #145 · 0x16670
WaiterCollection_Add #146 · 0x16110
WaiterCollection_Create #147 · 0x16050
WaiterCollection_Destroy #148 · 0x160e0
Waiter_Destroy #149 · 0x35e0
Waiter_Reset #150 · 0x159f0
Waiter_Wait #151 · 0x3620

Imported DLLs & functions 160

ADVAPI32.dll 20
CheckTokenMembership 0x180047048
CloseTrace 0x180047010
ControlTraceW 0x180047030
ConvertSidToStringSidW 0x180047088
CreateWellKnownSid 0x180047038
DuplicateTokenEx 0x180047050
EnableTraceEx2 0x180047020
EventActivityIdControl 0x180047078
EventRegister 0x180047090
EventUnregister 0x180047098
EventWriteTransfer 0x180047018
GetSidLengthRequired 0x180047080
GetSidSubAuthority 0x180047060
GetSidSubAuthorityCount 0x180047058
GetTokenInformation 0x180047070
OpenProcessToken 0x180047068
OpenTraceW 0x180047000
ProcessTrace 0x180047008
QueryAllTracesW 0x180047040
StartTraceW 0x180047028
api-ms-win-crt-convert-l1-1-0.dll 3
atol 0x180047388
strtof 0x180047380
wcstoul 0x180047378
api-ms-win-crt-heap-l1-1-0.dll 4
_callnewh 0x1800473b0
calloc 0x180047398
free 0x1800473a0
malloc 0x1800473a8
api-ms-win-crt-locale-l1-1-0.dll 8
___lc_codepage_func 0x1800473c0
___lc_locale_name_func 0x1800473f0
___mb_cur_max_func 0x1800473d8
__pctype_func 0x1800473c8
_lock_locales 0x1800473e8
_unlock_locales 0x1800473e0
localeconv 0x1800473f8
setlocale 0x1800473d0
api-ms-win-crt-math-l1-1-0.dll 3
_dsign 0x180047408
ceilf 0x180047418
frexp 0x180047410
api-ms-win-crt-runtime-l1-1-0.dll 15
_cexit 0x180047450
_configure_narrow_argv 0x180047428
_crt_atexit 0x180047458
_errno 0x180047438
_execute_onexit_table 0x180047468
_initialize_narrow_environment 0x180047490
_initialize_onexit_table 0x180047478
_initterm 0x180047448
_initterm_e 0x180047440
_invalid_parameter_noinfo 0x180047460
_invalid_parameter_noinfo_noreturn 0x180047480
_register_onexit_function 0x180047470
_seh_filter_dll 0x180047498
abort 0x180047488
terminate 0x180047430
api-ms-win-crt-stdio-l1-1-0.dll 6
__acrt_iob_func 0x1800474c0
__stdio_common_vfwprintf 0x1800474c8
__stdio_common_vsprintf 0x1800474a8
__stdio_common_vsprintf_s 0x1800474d0
__stdio_common_vswprintf 0x1800474b8
__stdio_common_vswprintf_s 0x1800474b0
api-ms-win-crt-string-l1-1-0.dll 14
_stricmp 0x1800474e8
_strnicmp 0x180047520
_wcsdup 0x180047548
_wcsnicmp 0x180047528
isalnum 0x1800474f8
isspace 0x180047508
iswspace 0x180047540
strcpy_s 0x180047510
strcspn 0x1800474e0
strncmp 0x180047500
tolower 0x180047530
wcscpy_s 0x180047538
wcsncmp 0x180047518
wcsnlen 0x1800474f0
KERNEL32.dll 72
AcquireSRWLockExclusive 0x180047298
AcquireSRWLockShared 0x1800472a0
CloseHandle 0x180047278
CreateThread 0x180047108
DecodePointer 0x180047120
DeleteCriticalSection 0x180047128
EncodePointer 0x180047198
EnterCriticalSection 0x1800471a8
FileTimeToSystemTime 0x1800470f0
FormatMessageA 0x1800472c8
FormatMessageW 0x1800471b0
FreeLibrary 0x180047258
FreeLibraryAndExitThread 0x180047110
GetCurrentProcess 0x180047200
GetCurrentProcessId 0x180047260
GetCurrentThreadId 0x1800472b8
GetLastError 0x180047268
GetLocaleInfoEx 0x1800472d0
GetModuleFileNameW 0x180047208
GetModuleHandleA 0x180047218
GetModuleHandleExW 0x1800470f8
GetModuleHandleW 0x180047280
GetProcAddress 0x180047238
GetStringTypeW 0x1800471c0
GetSystemTimeAsFileTime 0x1800471b8
GetTickCount64 0x1800472c0
GetVersion 0x180047210
InitializeCriticalSectionAndSpinCount 0x1800470c0
InitializeCriticalSectionEx 0x180047118
InitializeSListHead 0x180047190
InitOnceBeginInitialize 0x1800472d8
InitOnceComplete 0x1800472e0
InterlockedFlushSList 0x1800470d8
InterlockedPushEntrySList 0x1800470e0
IsDebuggerPresent 0x180047148
IsProcessorFeaturePresent 0x180047158
LCMapStringEx 0x1800471e0
LeaveCriticalSection 0x1800471a0
LoadLibraryExW 0x180047240
LocalFree 0x180047220
MultiByteToWideChar 0x1800471d8
OpenProcess 0x180047250
OutputDebugStringA 0x180047228
OutputDebugStringW 0x180047230
QueryPerformanceCounter 0x180047140
QueryPerformanceFrequency 0x180047150
RaiseException 0x1800470c8
ReleaseSRWLockExclusive 0x180047288
ReleaseSRWLockShared 0x180047290
ResetEvent 0x180047130
RtlCaptureContext 0x180047188
RtlLookupFunctionEntry 0x180047180
RtlPcToFileHeader 0x1800470d0
RtlUnwindEx 0x1800470e8
RtlVirtualUnwind 0x180047178
SetEvent 0x180047138
SetLastError 0x180047248
SetUnhandledExceptionFilter 0x180047168
SleepConditionVariableSRW 0x1800472b0
SystemTimeToFileTime 0x180047100
TerminateProcess 0x180047160
TlsAlloc 0x1800470b8
TlsFree 0x1800471f8
TlsGetValue 0x1800470b0
TlsSetValue 0x1800470a8
TryAcquireSRWLockExclusive 0x1800472a8
UnhandledExceptionFilter 0x180047170
VerifyVersionInfoW 0x1800471f0
VerSetConditionMask 0x1800471e8
WaitForMultipleObjectsEx 0x180047270
WakeAllConditionVariable 0x1800471d0
WideCharToMultiByte 0x1800471c8
OLEAUT32.dll 13
SafeArrayCopy 0x180047328
SafeArrayCreate 0x180047340
SafeArrayDestroy 0x180047330
SafeArrayGetLBound 0x180047310
SafeArrayGetUBound 0x180047308
SafeArrayGetVartype 0x180047320
SafeArrayLock 0x180047350
SafeArrayRedim 0x180047348
SafeArrayUnlock 0x180047338
SysAllocString 0x1800472f8
SysFreeString 0x1800472f0
VariantClear 0x180047300
VariantInit 0x180047318
Wex.Common.dll 2
?Create@Event@Common@TAEF@@YA?AV?$AutoHandle@UHandlePolicy@Common@TAEF@@@23@W4EventCharacteristics@23@@Z 0x180047360
?RaiseExceptionEventsNarrow@Throw@Common@TAEF@@YAXJPEBD00AEBUSlimSourceLocation@23@@Z 0x180047368