Fix memory leak

If treat mass eventlog, memoryleak visible.
Remove registry FFI call and use win32/registry ti fix memory leak.
Some optimization on memory usage and buffer (I think we don't need to reset/renew pointer, because it is a pointer).