EvtNextPublisherId

// wevtapi.dll
#include <windows.h>

BOOL EvtNextPublisherId(
    EVT_HANDLE PublisherEnum,
    DWORD PublisherIdBufferSize,
    LPWSTR PublisherIdBuffer,   // optional
    DWORD* PublisherIdBufferUsed
);

<DllImport("wevtapi.dll", SetLastError:=True, ExactSpelling:=True)>
Public Shared Function EvtNextPublisherId(
    PublisherEnum As IntPtr,   ' EVT_HANDLE
    PublisherIdBufferSize As UInteger,   ' DWORD
    <MarshalAs(UnmanagedType.LPWStr)> PublisherIdBuffer As System.Text.StringBuilder,   ' LPWSTR optional, out
    <Out> ByRef PublisherIdBufferUsed As UInteger   ' DWORD* out
) As Boolean
End Function

' PublisherEnum : EVT_HANDLE
' PublisherIdBufferSize : DWORD
' PublisherIdBuffer : LPWSTR optional, out
' PublisherIdBufferUsed : DWORD* out
Declare PtrSafe Function EvtNextPublisherId Lib "wevtapi" ( _
    ByVal PublisherEnum As LongPtr, _
    ByVal PublisherIdBufferSize As Long, _
    ByVal PublisherIdBuffer As LongPtr, _
    ByRef PublisherIdBufferUsed As Long) As Long
' VBA7前提(PtrSafe)。32bit Office では LongPtr→Long。Integer=16bit / Long=32bit / LongLong=64bit。

import ctypes
from ctypes import wintypes

EvtNextPublisherId = ctypes.windll.wevtapi.EvtNextPublisherId
EvtNextPublisherId.restype = wintypes.BOOL
EvtNextPublisherId.argtypes = [
    ctypes.c_ssize_t,  # PublisherEnum : EVT_HANDLE
    wintypes.DWORD,  # PublisherIdBufferSize : DWORD
    wintypes.LPWSTR,  # PublisherIdBuffer : LPWSTR optional, out
    ctypes.POINTER(wintypes.DWORD),  # PublisherIdBufferUsed : DWORD* out
]
# GetLastError: use ctypes.GetLastError() (or ctypes.WinDLL(use_last_error=True))

require 'fiddle'
require 'fiddle/import'

lib = Fiddle.dlopen('wevtapi.dll')
EvtNextPublisherId = Fiddle::Function.new(
  lib['EvtNextPublisherId'],
  [
    Fiddle::TYPE_INTPTR_T,  # PublisherEnum : EVT_HANDLE
    -Fiddle::TYPE_INT,  # PublisherIdBufferSize : DWORD
    Fiddle::TYPE_VOIDP,  # PublisherIdBuffer : LPWSTR optional, out
    Fiddle::TYPE_VOIDP,  # PublisherIdBufferUsed : DWORD* out
  ],
  Fiddle::TYPE_INT)

#[link(name = "wevtapi")]
extern "system" {
    fn EvtNextPublisherId(
        PublisherEnum: isize,  // EVT_HANDLE
        PublisherIdBufferSize: u32,  // DWORD
        PublisherIdBuffer: *mut u16,  // LPWSTR optional, out
        PublisherIdBufferUsed: *mut u32  // DWORD* out
    ) -> i32;
}
// crates: windows-sys provides ready-made bindings for this API.

$sig = @"
[return: MarshalAs(UnmanagedType.Bool)]
[DllImport("wevtapi.dll", SetLastError = true)]
public static extern bool EvtNextPublisherId(IntPtr PublisherEnum, uint PublisherIdBufferSize, [MarshalAs(UnmanagedType.LPWStr)] System.Text.StringBuilder PublisherIdBuffer, out uint PublisherIdBufferUsed);
"@
$api = Add-Type -MemberDefinition $sig -Name 'wevtapi_EvtNextPublisherId' -Namespace Win32 -PassThru
# $api::EvtNextPublisherId(PublisherEnum, PublisherIdBufferSize, PublisherIdBuffer, PublisherIdBufferUsed)

#uselib "wevtapi.dll"
#func global EvtNextPublisherId "EvtNextPublisherId" sptr, sptr, sptr, sptr
; EvtNextPublisherId PublisherEnum, PublisherIdBufferSize, varptr(PublisherIdBuffer), varptr(PublisherIdBufferUsed)   ; 戻り値は stat
; PublisherEnum : EVT_HANDLE -> "sptr"
; PublisherIdBufferSize : DWORD -> "sptr"
; PublisherIdBuffer : LPWSTR optional, out -> "sptr"
; PublisherIdBufferUsed : DWORD* out -> "sptr"
; ※HSP3.7は #func のため戻り値はシステム変数 stat に格納されます。

#uselib "wevtapi.dll"
#cfunc global EvtNextPublisherId "EvtNextPublisherId" sptr, int, var, var
; res = EvtNextPublisherId(PublisherEnum, PublisherIdBufferSize, PublisherIdBuffer, PublisherIdBufferUsed)
; PublisherEnum : EVT_HANDLE -> "sptr"
; PublisherIdBufferSize : DWORD -> "int"
; PublisherIdBuffer : LPWSTR optional, out -> "var"
; PublisherIdBufferUsed : DWORD* out -> "var"
; ※出力/バッファ引数は var 方式(変数を直接渡す)。varptr 方式にも切替可。

; BOOL EvtNextPublisherId(EVT_HANDLE PublisherEnum, DWORD PublisherIdBufferSize, LPWSTR PublisherIdBuffer, DWORD* PublisherIdBufferUsed)
#uselib "wevtapi.dll"
#cfunc global EvtNextPublisherId "EvtNextPublisherId" intptr, int, var, var
; res = EvtNextPublisherId(PublisherEnum, PublisherIdBufferSize, PublisherIdBuffer, PublisherIdBufferUsed)
; PublisherEnum : EVT_HANDLE -> "intptr"
; PublisherIdBufferSize : DWORD -> "int"
; PublisherIdBuffer : LPWSTR optional, out -> "var"
; PublisherIdBufferUsed : DWORD* out -> "var"
; ※出力/バッファ引数は var 方式(変数を直接渡す)。varptr 方式にも切替可。

import (
	"golang.org/x/sys/windows"
	"unsafe"
)

var (
	wevtapi = windows.NewLazySystemDLL("wevtapi.dll")
	procEvtNextPublisherId = wevtapi.NewProc("EvtNextPublisherId")
)

// PublisherEnum (EVT_HANDLE), PublisherIdBufferSize (DWORD), PublisherIdBuffer (LPWSTR optional, out), PublisherIdBufferUsed (DWORD* out)
r1, _, err := procEvtNextPublisherId.Call(
	uintptr(PublisherEnum),
	uintptr(PublisherIdBufferSize),
	uintptr(PublisherIdBuffer),
	uintptr(PublisherIdBufferUsed),
)
_ = err  // syscall.Errno (valid when the call sets last-error)
_ = r1   // BOOL

function EvtNextPublisherId(
  PublisherEnum: NativeInt;   // EVT_HANDLE
  PublisherIdBufferSize: DWORD;   // DWORD
  PublisherIdBuffer: PWideChar;   // LPWSTR optional, out
  PublisherIdBufferUsed: Pointer   // DWORD* out
): BOOL; stdcall;
  external 'wevtapi.dll' name 'EvtNextPublisherId';

result := DllCall("wevtapi\EvtNextPublisherId"
    , "Ptr", PublisherEnum   ; EVT_HANDLE
    , "UInt", PublisherIdBufferSize   ; DWORD
    , "Ptr", PublisherIdBuffer   ; LPWSTR optional, out
    , "Ptr", PublisherIdBufferUsed   ; DWORD* out
    , "Int")   ; return: BOOL

●EvtNextPublisherId(PublisherEnum, PublisherIdBufferSize, PublisherIdBuffer, PublisherIdBufferUsed) = DLL("wevtapi.dll", "bool EvtNextPublisherId(int, dword, char*, void*)")
# 呼び出し: EvtNextPublisherId(PublisherEnum, PublisherIdBufferSize, PublisherIdBuffer, PublisherIdBufferUsed)
# PublisherEnum : EVT_HANDLE -> "int"
# PublisherIdBufferSize : DWORD -> "dword"
# PublisherIdBuffer : LPWSTR optional, out -> "char*"
# PublisherIdBufferUsed : DWORD* out -> "void*"
# なでしこ1は32bit・ANSI(Shift_JIS)。文字列=char*(ANSI)、ポインタ/ハンドル=void*(4byte)。