btw as shown by my experiments when you add ugly code like printf("WindowsProcEventSubscriber: %p\n", &osquery:registries:kWindowsProcEventSubscriber); - magic happens and constructor for osquery:registries:kWindowsEventLogEventPublisher linked right