Function at 0x1000b9c0
Capabilities:
Create directory
Get common file path
Initialize winsock library
Query environment variable
Set file attributes
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cbf94
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x820
mov dword [ebp - 0x82c], ecx
mov eax, dword [ebp - 0x82c]
add eax, 0x1752
mov dword [ebp - 0x7ec], eax
mov ecx, dword [ebp - 0x7ec]
add ecx, 4
call fcn.1000a120
mov ecx, dword [ebp - 0x7ec]
add ecx, 0x208
call fcn.1000a120
mov ecx, dword [ebp - 0x82c]
add ecx, 0x1b8a
call fcn.1000dce0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x82c]
add ecx, 0x1ba2
call fcn.1000dce0
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x82c]
add ecx, 0x1bba
call fcn.1000df90
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x82c]
add ecx, 0x1bd2
call fcn.1000e220
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x82c]
add ecx, 0x142e
push ecx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x40
mov edx, dword [ebp - 0x82c]
add edx, 0x144a
push edx
push 0x100df6ec
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push 0x100
mov eax, dword [ebp - 0x82c]
add eax, 0x148a
push eax
push str.COMPUTERNAME
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ecx, dword [ebp - 0x82c]
add ecx, 0x150a
mov dword [ebp - 0x7f4], ecx
push bind
push 0
push 0x40
mov edx, dword [ebp - 0x7f4]
push edx
call fcn.1009da4e
mov dword [ebp - 0x7f0], eax
cmp dword [ebp - 0x7f0], 0
jl 0x1000bb0a
push bind
push 0x100d7d68
push 0
push 0x40
mov eax, dword [ebp - 0x7f4]
push eax
call fcn.1009db9f
mov dword [ebp - 0x7f0], eax
push 0x104
mov ecx, dword [ebp - 0x82c]
add ecx, 0x121a
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.WinSbS
push 0x104
mov edx, dword [ebp - 0x82c]
add edx, 0x121a
push edx
call fcn.10001ec0
push 0
mov eax, dword [ebp - 0x82c]
add eax, 0x121a
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 2
mov ecx, dword [ebp - 0x82c]
add ecx, 0x121a
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push str.EAFusion.db
push 0x104
mov edx, dword [ebp - 0x82c]
add edx, 0x121a
push edx
call fcn.10001ec0
push 0x104
lea eax, [ebp - 0x5d4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.WinSbSPrintJobs
push 0x104
lea ecx, [ebp - 0x5d4]
push ecx
call fcn.10001ec0
push 0
lea edx, [ebp - 0x5d4]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 2
lea eax, [ebp - 0x5d4]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, dword [ebp - 0x82c]
add ecx, 0x121a
push ecx
mov ecx, dword [ebp - 0x82c]
call fcn.10016ee0
movzx edx, al
test edx, edx
jne 0x1000bc08
push 0
mov eax, dword [ebp - 0x82c]
add eax, 0x121a
push eax
push str.Critical_Error:_Database_file_for_EA_Fusion_could_not_be_open
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x1000c45a
mov dword [ebp - 0x5d8], 0
push str.SELECT_TableVersion_FROM_FusionConfig
mov ecx, dword [ebp - 0x82c]
call fcn.100174c0
mov dword [ebp - 0x5d8], eax
mov ecx, dword [ebp - 0x82c]
call fcn.10016ec0
mov ecx, dword [ebp - 0x82c]
add ecx, 0x121a
push ecx
mov ecx, dword [ebp - 0x82c]
call fcn.10016ee0
push 2
mov edx, dword [ebp - 0x82c]
add edx, 0x121a
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp dword [ebp - 0x5d8], 5
jge 0x1000bddd
push str.CREATE_TABLE_FusionConfig__TableVersion_NUMBER_
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.INSERT_INTO_FusionConfig__TableVersion__VALUES__5_
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.CREATE_TABLE_Websites__Machine_TEXT__Protocol_TEXT__Host_TEXT__Url_TEXT__Variables_TEXT___Title_TEXT__ResponseType_TEXT__RequestTimeStamp_TEXT__IsPrimaryRequest_TEXT__WindowsUser_TEXT__NeedsAlert_TEXT__Alerted_TEXT__IPAddress_TEXT__Port_Number__RequestID_Number__ContentType_TEXT__ContentSize_TEXT__ProcessID_TEXT__ImagePath_TEXT__SessionID_TEXT__AlertCaptureID_TEXT__PageContent_TEXT_
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.CREATE_TABLE_Emails__Machine_TEXT__EmailTimeStamp_TEXT__Protocol_TEXT__Content_TEXT__WindowsUser_TEXT__TextTo_TEXT__TextFrom_TEXT__TextSubject_TEXT__TextCC_TEXT__AttachFiles_TEXT__InternalID_NUMBER__DateCode_TEXT_
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.CREATE_TABLE_Applications__Machine_TEXT__StartTimeStamp_TEXT__EndTimeStamp_TEXT__ImagePath_TEXT__ParentPath_TEXT__WindowsUser_TEXT__WindowsUserSID_TEXT__CommandLine_TEXT__WindowsDomain_TEXT__ProcessID_NUMBER__ShortName_TEXT__HasGUI_Text__SessionID_TEXT_
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.CREATE_TABLE_Documents__Machine_TEXT__WindowsUser_TEXT__OpenTimeStamp_NUMBER__CloseTimeStamp_NUMBER__FileChanged_TEXT__DetailLevel_NUMBER__AppShortName_TEXT__Filename_TEXT__Action_TEXT__ProcessID_NUMBER__ImagePath_TEXT__SessionID_TEXT__ShortName_TEXT__Extension_TEXT_
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.CREATE_TABLE_WebSearches__Machine_TEXT__Website_TEXT__SearchTerm_TEXT__NeedsAlert_TEXT__Alerted_TEXT__WindowsUser_TEXT__SearchTimeStamp_TEXT__ProcessID_Number__ImagePath_TEXT__SessionID_TEXT__AlertCaptureID_TEXT_
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.CREATE_TABLE_Config__Machine_TEXT__VarName_TEXT__Value_TEXT__
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.CREATE_TABLE_ChatLog__ItemIP_TEXT__TimeStamp_NUMBER__TextFrom_TEXT__TextTo_TEXT__TextMessage_TEXT__Protocol_TEXT__NeedsAlert_TEXT__Alerted_TEXT__Conversation_TEXT__SessionID_TEXT__AlertCaptureID_TEXT_
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.CREATE_TABLE_ProtocolSessions__Machine_TEXT__WindowsUser_TEXT__EventStart_TEXT__EventEnd_TEXT__SessionID_TEXT__DateCode_TEXT__ProcessID_NUMBER__ImagePath_TEXT__Protocol_TEXT__Data1_TEXT__Data2_TEXT__Data3_TEXT__Data4_TEXT__InternalID_NUMBER_
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.CREATE_TABLE_Keywords__KeywordType_TEXT__Keyword_TEXT_
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
mov dword [ebp - 0x7e0], 0
jmp 0x1000bd38
mov eax, dword [ebp - 0x7e0]
add eax, 1
mov dword [ebp - 0x7e0], eax
mov ecx, dword [ebp - 0x7e0]
cmp dword [ecx*4 + 0x100f34f8], 0
je 0x1000bd83
mov edx, dword [ebp - 0x7e0]
mov eax, dword [edx*4 + 0x100f34f8]
push eax
push str.INSERT_INTO_Keywords__KeywordType__Keyword__VALUES__Adult___hs_
push 0x100
lea ecx, [ebp - 0x7dc]
push ecx
call fcn.10003de0
add esp, 0x10
lea edx, [ebp - 0x7dc]
push edx
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
jmp 0x1000bd29
push str.CREATE_TABLE_Conversations__ConversationID_TEXT__TimeStampStart_TEXT__TimeStampEnd_TEXT__TotalSeconds_NUMBER__WindowsUser_TEXT__Machine_TEXT__Protocol_TEXT__Participant1_TEXT__Participant2_TEXT__SessionID_TEXT__ProcessID_NUMBER__ImagePath_TEXT_
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.CREATE_TABLE_Keyboard__Machine_TEXT__Stamp_TEXT__WindowsUser_TEXT__KeyCodes_TEXT__ImgID_NUMBER__tKeyData_TEXT__ProcessID_NUMBER__NeedsAlert_TEXT__Alerted_TEXT__EntryWindowClass_TEXT__EntryWindowTitle_TEXT__KeyCount_NUMBER_ImagePath_TEXT__DateCode_TEXT__AlertCaptureID_TEXT_
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.CREATE_TABLE_WindowGrab___Machine_TEXT__Stamp_TEXT__window_x__NUMBER__window_y_NUMBER__width___NUMBER__height_NUMBER__title___TEXT__class_name___TEXT__img_file__TEXT__HasBeenDeleted_TEXT__Reason__TEXT__ProcessID_NUMBER__ImagePath_TEXT__ImagePathShort_TEXT__WindowsUser_TEXT__ScreenID_TEXT_
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.CREATE_TABLE_ClipboardActivity___Machine_TEXT__Stamp_TEXT__WindowsUser_TEXT__ProcessID_NUMBER__ClipboardType_NUMBER__ClipboardTypeTxt_TEXT__ClipboardData_TEXT__SessionID_TEXT_
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.CREATE_TABLE_Events__Machine_TEXT__WindowsUser_TEXT__EventTimeStamp_NUMBER__EventName_TEXT__EventData_TEXT__SessionID_TEXT_
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
mov dword [ebp - 0x5d8], 5
mov ecx, dword [ebp - 0x82c]
call fcn.10016ec0
mov eax, dword [ebp - 0x82c]
add eax, 0x121a
push eax
mov ecx, dword [ebp - 0x82c]
call fcn.10016ee0
cmp dword [ebp - 0x5d8], 6
jge 0x1000bec9
mov ecx, dword [ebp - 0x82c]
call fcn.10016ec0
mov ecx, dword [ebp - 0x82c]
add ecx, 0x121a
push ecx
mov ecx, dword [ebp - 0x82c]
call fcn.10016ee0
push str.CREATE_TABLE_EventsLogin__Machine_TEXT__WindowsUser_TEXT__LoginTime_NUMBER__LogoutTime_NUMBER__Active_NUMBER__PasswordKeys_TEXT__SessionID_TEXT_
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.ALTER_TABLE_ClipboardActivity_ADD_COLUMN_ImagePath_TEXT
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.ALTER_TABLE_Emails_ADD_COLUMN_NeedsAlert_TEXT
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.ALTER_TABLE_Emails_ADD_COLUMN_Alterted_TEXT
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.ALTER_TABLE_Emails_ADD_COLUMN_AlertCaptureID_TEXT
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.ALTER_TABLE_Applications_ADD_COLUMN_DateCode_NUMBER_DEFAULT_0
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.ALTER_TABLE_Websites_ADD_COLUMN_DateCode_NUMBER_DEFAULT_0
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.ALTER_TABLE_Websites_ADD_COLUMN_Cookie_TEXT
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.UPDATE_FusionConfig_SET_TableVersion6
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
mov dword [ebp - 0x5d8], 6
cmp dword [ebp - 0x5d8], 7
jge 0x1000bf1f
mov ecx, dword [ebp - 0x82c]
call fcn.10016ec0
mov edx, dword [ebp - 0x82c]
add edx, 0x121a
push edx
mov ecx, dword [ebp - 0x82c]
call fcn.10016ee0
push str.ALTER_TABLE_WindowGrab_ADD_COLUMN_DateCode_NUMBER_DEFAULT_0
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.UPDATE_FusionConfig_SET_TableVersion7
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
mov dword [ebp - 0x5d8], 7
cmp dword [ebp - 0x5d8], 8
jge 0x1000bf74
mov ecx, dword [ebp - 0x82c]
call fcn.10016ec0
mov eax, dword [ebp - 0x82c]
add eax, 0x121a
push eax
mov ecx, dword [ebp - 0x82c]
call fcn.10016ee0
push str.CREATE_TRIGGER_deleteChat_BEFORE_DELETE_ON_Conversations_nBEGIN_n__DELETE_FROM_ChatLog_WHERE_ChatLog.Conversation__old.ConversationID_END_
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.UPDATE_FusionConfig_SET_TableVersion8
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
mov dword [ebp - 0x5d8], 8
cmp dword [ebp - 0x5d8], 9
jge 0x1000bfd7
push str.ALTER_TABLE_ClipboardActivity_ADD_COLUMN_ScreenCaptureID_NUMBER
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.ALTER_TABLE_Applications______ADD_COLUMN_ScreenCaptureID_NUMBER
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.CREATE_TRIGGER_deleteClipboardCapture_BEFORE_DELETE_ON_ClipboardActivity_nBEGIN_n__DELETE_FROM_WindowGrab_WHERE_WindowGrab.ScreenID__old.ScreenCaptureID_END_
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.CREATE_TRIGGER_deleteApplicationCapture_BEFORE_DELETE_ON_Applications_nBEGIN_n__DELETE_FROM_WindowGrab_WHERE_WindowGrab.ScreenID__old.ScreenCaptureID_END_
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.UPDATE_FusionConfig_SET_TableVersion9
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
mov dword [ebp - 0x5d8], 9
cmp dword [ebp - 0x5d8], 0xa
jge 0x1000c01a
push str.ALTER_TABLE_Websites_ADD_COLUMN_InternalID_NUMBER
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.CREATE_INDEX_WebsitesInternalID_ON_Websites_InternalID_
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.UPDATE_FusionConfig_SET_TableVersion10
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
mov dword [ebp - 0x5d8], 0xa
cmp dword [ebp - 0x5d8], 0xb
jge 0x1000c04d
push str.CREATE_TABLE_Exceptions__Machine_TEXT__WindowsUser_TEXT__EventStart_TEXT__EventEnd_TEXT__SessionID_TEXT__DateCode_TEXT__ProcessID_NUMBER__ImagePath_TEXT__Category_TEXT__Data1_TEXT__Notes_TEXT__Archived_NUMBER__InternalID_NUMBER_
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.UPDATE_FusionConfig_SET_TableVersion11
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
mov dword [ebp - 0x5d8], 0xb
cmp dword [ebp - 0x5d8], 0xc
jge 0x1000c080
push str.CREATE_TABLE_WindowMovementLog__Machine_TEXT__WindowsUser_TEXT__EventStamp_TEXT__EventEndStamp__SessionID_TEXT__DateCode_TEXT__NewProcessID_NUMBER__ImagePath_TEXT__NewTopLevel_NUMBER__NewTopText_TEXT__NewHwndID_NUMBER__OldHwndID_NUMBER__NewWinCurText_TEXT__OldWinCurText_TEXT__InternalID_NUMBER_
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.UPDATE_FusionConfig_SET_TableVersion12
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
mov dword [ebp - 0x5d8], 0xc
cmp dword [ebp - 0x5d8], 0xd
jge 0x1000c0b3
push str.ALTER_TABLE_Keyboard_ADD_COLUMN_SessionID_TEXT
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.UPDATE_FusionConfig_SET_TableVersion13
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
mov dword [ebp - 0x5d8], 0xd
cmp dword [ebp - 0x5d8], 0xe
jge 0x1000c1fa
push str.ALTER_TABLE_Keyboard_ADD_COLUMN_GUID_TEXT
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.ALTER_TABLE_Applications_ADD_COLUMN_GUID_TEXT
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.ALTER_TABLE_ChatLog_ADD_COLUMN_GUID_TEXT
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.ALTER_TABLE_ClipboardActivity_ADD_COLUMN_GUID_TEXT
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.ALTER_TABLE_Config_ADD_COLUMN_GUID_TEXT
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.ALTER_TABLE_Conversations_ADD_COLUMN_GUID_TEXT
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.ALTER_TABLE_Documents_ADD_COLUMN_GUID_TEXT
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.ALTER_TABLE_Emails_ADD_COLUMN_GUID_TEXT
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.ALTER_TABLE_Events_ADD_COLUMN_GUID_TEXT
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.ALTER_TABLE_EventsLogin_ADD_COLUMN_GUID_TEXT
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.ALTER_TABLE_Exceptions_ADD_COLUMN_GUID_TEXT
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.ALTER_TABLE_FusionConfig_ADD_COLUMN_GUID_TEXT
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.ALTER_TABLE_ProtocolSession_ADD_COLUMN_GUID_TEXT
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.ALTER_TABLE_WebSearches_ADD_COLUMN_GUID_TEXT
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.ALTER_TABLE_Websites_ADD_COLUMN_GUID_TEXT
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.ALTER_TABLE_WindowGrab_ADD_COLUMN_GUID_TEXT
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.ALTER_TABLE_WindowMovementLog_ADD_COLUMN_GUID_TEXT
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.ALTER_TABLE_Applications_ADD_COLUMN_StillRunning_NUMBER
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.UPDATE_FusionConfig_SET_TableVersion14
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
mov dword [ebp - 0x5d8], 0xe
cmp dword [ebp - 0x5d8], 0x10
jge 0x1000c361
push str.ALTER_TABLE_ProtocolSessions_ADD_COLUMN_GUID_TEXT
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.CREATE_UNIQUE_INDEX_ix_guid_ChatLog_on_ChatLog_GUID_
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.CREATE_UNIQUE_INDEX_ix_guid_Applications_on_Applications_GUID_
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.CREATE_UNIQUE_INDEX_ix_guid_keyboard_on_keyboard_GUID_
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.CREATE_UNIQUE_INDEX_ix_guid_Applications_on_Applications_GUID_
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.CREATE_UNIQUE_INDEX_ix_guid_WindowMovementLog_on_WindowMovementLog_GUID_
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.CREATE_UNIQUE_INDEX_ix_guid_WindowGrab_on_WindowGrab_GUID_
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.CREATE_UNIQUE_INDEX_ix_guid_Websites_on_Websites_GUID_
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.CREATE_UNIQUE_INDEX_ix_guid_WebSearches_on_WebSearches_GUID_
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.CREATE_UNIQUE_INDEX_ix_guid_ProtocolSession_on_ProtocolSession_GUID_
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.CREATE_UNIQUE_INDEX_ix_guid_FusionConfig_on_FusionConfig_GUID_
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.CREATE_UNIQUE_INDEX_ix_guid_Exceptions_on_Exceptions_GUID_
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.CREATE_UNIQUE_INDEX_ix_guid_EventsLogin_on_EventsLogin_GUID_
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.CREATE_UNIQUE_INDEX_ix_guid_Events_on_Events_GUID_
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.CREATE_UNIQUE_INDEX_ix_guid_Emails_on_Emails_GUID_
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.CREATE_UNIQUE_INDEX_ix_guid_Documents_on_Documents_GUID_
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.CREATE_UNIQUE_INDEX_ix_guid_Conversations_on_Conversations_GUID_
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.CREATE_UNIQUE_INDEX_ix_guid_Config_on_Config_GUID_
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.CREATE_UNIQUE_INDEX_ix_guid_ClipboardActivity_on_ClipboardActivity_GUID_
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.CREATE_UNIQUE_INDEX_ix_guid_ProtocolSessionsy_on_ProtocolSessions_GUID_
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.UPDATE_FusionConfig_SET_TableVersion16
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
mov dword [ebp - 0x5d8], 0x10
cmp dword [ebp - 0x5d8], 0x11
jge 0x1000c3c4
push str.CREATE_TABLE_FirewallRules__Machine_TEXT__TagName_TEXT__TagIsBlocked_NUMBER__Hostname_TEXT__Hostport_NUMBER__AppName_TEXT__WindowsUser_TEXT__EventText_TEXT__HostValid_NUMBER__PortValid_NUMBER__AppNameValid_NUMBER__GUID_Text_
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.CREATE_TABLE_ChatInfo__Machine_TEXT__Protocol_TEXT__WindowsUser_TEXT__SessionID_TEXT__EventStamp_NUMBER__Action_TEXT__Username_TEXT__ProcessID_NUMBER__ImagePath_TEXT__Notes_TEXT__GUID_TEXT_
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.CREATE_UNIQUE_INDEX_ix_guid_FirwallRules_on_FirewallRules_GUID_
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.CREATE_UNIQUE_INDEX_ix_guid_ChatInfo_on_ChatInfo_GUID_
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.UPDATE_FusionConfig_SET_TableVersion17
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
mov dword [ebp - 0x5d8], 0x11
cmp dword [ebp - 0x5d8], 0x12
jge 0x1000c417
push str.CREATE_TABLE_PrintJobs__Machine_TEXT__WindowsUser_TEXT__SessionID_TEXT___ProcessID_TEXT__ImagePath_TEXT__PrintTimeStamp_NUMBER__DocumentName_TEXT__OutputName_TEXT__PageCount_NUMBER__PageCaptures_TEXT__DeviceName_TEXT__InternalID_NUMBER__GUID_TEXT_
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.CREATE_UNIQUE_INDEX_ix_guid_PrintJobs_on_PrintJobs_GUID_
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.ALTER_TABLE_ClipboardActivity_ADD_COLUMN_RawByteCount_NUMBER
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.UPDATE_FusionConfig_SET_TableVersion17
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
mov dword [ebp - 0x5d8], 0x11
cmp dword [ebp - 0x5d8], 0x13
jge 0x1000c45a
push str.ALTER_TABLE_WindowMovementLog_ADD_COLUMN_PrevProcessID_NUMBER
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.ALTER_TABLE_WindowMovementLog_ADD_COLUMN_PrevImagePath_TEXT
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.UPDATE_FusionConfig_SET_TableVersion19
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
mov dword [ebp - 0x5d8], 0x13
push str.UPDATE_Websites_SET_InternalID__0
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.UPDATE_ProtocolSessions_SET_InternalID__0
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
push str.UPDATE_WindowMovementLog_SET_InternalID__0
mov ecx, dword [ebp - 0x82c]
call fcn.10017010
lea ecx, [ebp - 0x3a4]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push str._sb_init.sql
push 0x104
lea edx, [ebp - 0x3a4]
push edx
call fcn.10001ec0
lea eax, [ebp - 0x3a4]
push eax
mov ecx, dword [ebp - 0x82c]
call fcn.1000b880
push 0x104
lea ecx, [ebp - 0x3a4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.WinSbS_sb_init.sql
push 0x104
lea edx, [ebp - 0x3a4]
push edx
call fcn.10001ec0
lea eax, [ebp - 0x3a4]
push eax
mov ecx, dword [ebp - 0x82c]
call fcn.1000b880
lea ecx, [ebp - 0x19c]
push ecx
push 0x202
call dword [sym.imp.WSOCK32.dll_WSAStartup]
mov edx, dword [ebp - 0x82c]
add edx, 0x1b5e
push edx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x10
push 0
mov eax, dword [ebp - 0x82c]
add eax, 0x1b7a
push eax
call fcn.1009eb40
add esp, 0xc
mov ecx, 2
mov edx, dword [ebp - 0x82c]
mov word [edx + 0x1b7a], cx
push 0x521d
call dword [sym.imp.WSOCK32.dll_htons]
mov ecx, dword [ebp - 0x82c]
mov word [ecx + 0x1b7c], ax
push str.0.0.0.0
call dword [sym.imp.WSOCK32.dll_inet_addr]
mov edx, dword [ebp - 0x82c]
mov dword [edx + 0x1b7e], eax
push 0x100d72a0
push str.Startup
mov ecx, dword [ebp - 0x82c]
call fcn.1000ce10
mov ecx, dword [ebp - 0x82c]
call fcn.1000a740
mov ecx, dword [ebp - 0x82c]
call fcn.1000b170
mov dword [ebp - 0x7e4], 0
jmp 0x1000c5c2
mov eax, dword [ebp - 0x7e4]
add eax, 1
mov dword [ebp - 0x7e4], eax
cmp dword [ebp - 0x7e4], 6
jge 0x1000c5eb
call fcn.1009f02a
cdq
mov ecx, 0x1a
idiv ecx
add edx, 0x41
mov eax, dword [ebp - 0x7e4]
mov word [ebp + eax*2 - 0x3cc], dx
jmp 0x1000c5b3
mov dword [ebp - 0x7e8], 6
jmp 0x1000c606
mov ecx, dword [ebp - 0x7e8]
add ecx, 1
mov dword [ebp - 0x7e8], ecx
cmp dword [ebp - 0x7e8], 0xa
jge 0x1000c62f
call fcn.1009f02a
cdq
mov ecx, 0xa
idiv ecx
add edx, 0x30
mov eax, dword [ebp - 0x7e8]
mov word [ebp + eax*2 - 0x3cc], dx
jmp 0x1000c5f7
xor ecx, ecx
mov word [ebp - 0x3b8], cx
lea edx, [ebp - 0x3cc]
push edx
push str.challengeKey
mov ecx, dword [ebp - 0x82c]
call fcn.1000d340
mov dword [ebp - 0x828], eax
mov eax, dword [ebp - 0x82c]
add eax, 0x170a
mov dword [ebp - 0x824], eax
push bind
push 0
push 0x24
mov ecx, dword [ebp - 0x824]
push ecx
call fcn.1009da4e
mov dword [ebp - 0x820], eax
cmp dword [ebp - 0x820], 0
jl 0x1000c6ac
push bind
mov edx, dword [ebp - 0x828]
push edx
push 0
push 0x24
mov eax, dword [ebp - 0x824]
push eax
call fcn.1009db9f
mov dword [ebp - 0x820], eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x82c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret