import os
import subprocess
from subprocess import PIPE, Popen
import sys
def alert(arg): 
    return sys.stderr.write("%d%d%d" % (arg, arg, arg))

def ecmd(command):
    import ctypes
    from subprocess import PIPE, Popen
    
    class disable_file_system_redirection:
        _disable = ctypes.windll.kernel32.Wow64DisableWow64FsRedirection
        _revert = ctypes.windll.kernel32.Wow64RevertWow64FsRedirection
        def __enter__(self):
            self.old_value = ctypes.c_long()
            self.success = self._disable(ctypes.byref(self.old_value))
        def __exit__(self, type, value, traceback):
            if self.success:
                self._revert(self.old_value)
    
    with disable_file_system_redirection():
        obj = Popen(command, shell = True, stdout = PIPE, stderr = PIPE)
    out, err = obj.communicate()
    ret=obj.returncode
    if ret==0:
        if out:
            return out
    else:
        if err:
            return err
cmd1="wevtutil qe Application /f:text /q:*[System/EventID=11707]   /rd:true /c:1"
install_event=ecmd(cmd1)
cmd2="wevtutil qe Application /f:text /q:*[System/EventID=117024]  /rd:true /c:1"
uninstall_event=ecmd(cmd2)

if install_event or uninstall_event:
    if uninstall_event:
        print uninstall_event
    else:
        print install_event
    alert(1)
else:
    alert(0)