Function at 0x4d9230
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60e9aa
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x6ba394]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0xc
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
push str.SELECT_RID_FROM_Owners_WHERE_SID___SID
lea esi, [edi + 0x28]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x38], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
push str.SELECT_RID_FROM_Owners_WHERE_Name___NAME
push eax
mov ecx, esi
mov dword [ebp - 4], 1
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x3c], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
push str.INSERT_INTO_Owners__SID__Name__VALUES___SID___NAME_
push eax
mov ecx, esi
mov dword [ebp - 4], 2
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x40], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
push str.SELECT_RID_FROM_MD5Signature_WHERE_MD5___MD5
push eax
mov ecx, esi
mov dword [ebp - 4], 3
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x44], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
push str.INSERT_INTO_MD5Signature_MD5__Signer_ID__VALUES___MD5___Signer_ID_
push eax
mov ecx, esi
mov dword [ebp - 4], 4
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x48], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
push str.SELECT_RID_FROM_SignerInfo_WHERE_Name___Name
push eax
mov ecx, esi
mov dword [ebp - 4], 5
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x4c], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
push str.INSERT_INTO_SignerInfo_Name__VALUES___Name_
mov dword [ebp - 4], 6
push eax
mov ecx, esi
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x50], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
push str.SELECT_RID_FROM_Directories_WHERE_Name___Name
push eax
mov ecx, esi
mov dword [ebp - 4], 7
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x54], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
push str.INSERT_INTO_Directories__Name__VALUES___Name_
push eax
mov ecx, esi
mov dword [ebp - 4], 8
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x58], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
push str.SELECT_Directories.NAme__Files.Name_FROM_Files_JOIN_Directories_ON_Files.Dir_ID__Directories.RID_WHERE_Files.RID___RID
push eax
mov ecx, esi
mov dword [ebp - 4], 9
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x5c], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
push str.SELECT_RID_FROM_Files_WHERE_Name___Name_AND_Dir_ID___Dir_ID
push eax
mov ecx, esi
mov dword [ebp - 4], 0xa
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x60], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
push str.INSERT_INTO_Files__Name__Dir_ID__VALUES___Name___Dir_ID_
push eax
mov ecx, esi
mov dword [ebp - 4], 0xb
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x64], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
push str.SELECT_RID_FROM_URL_ExtraInfo_WHERE_ExtraInfo___ExtraInfo
push eax
mov ecx, esi
mov dword [ebp - 4], 0xc
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x68], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
push str.INSERT_INTO_URL_ExtraInfo__ExtraInfo__VALUES___ExtraInfo_
push eax
mov ecx, esi
mov dword [ebp - 4], 0xd
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x6c], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
push str.SELECT_RID_FROM_URL_Path_WHERE_Path___Path
push eax
mov ecx, esi
mov dword [ebp - 4], 0xe
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x70], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
push str.INSERT_INTO_URL_Path__Path__VALUES___Path_
push eax
mov ecx, esi
mov dword [ebp - 4], 0xf
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x74], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
push str.SELECT_RID_FROM_URL_Prefix_WHERE_Protocol___Protocol_AND_Port___Port_AND_Host___Host
push eax
mov ecx, esi
mov dword [ebp - 4], 0x10
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x78], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
push str.INSERT_INTO_URL_Prefix__Protocol__Port__Host__VALUES___Protocol___Port___Host_
push eax
mov ecx, esi
mov dword [ebp - 4], 0x11
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x7c], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
push str.SELECT_RID_FROM_URLs_WHERE_Prefix_ID___Prefix_ID_AND_Path_ID___Path_ID_AND_ExtraInfo_ID___ExtraInfo_ID
push eax
mov ecx, esi
mov dword [ebp - 4], 0x12
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x80], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
push str.INSERT_INTO_URLs__Prefix_ID__Path_ID__ExtraInfo_ID__VALUES___Prefix_ID___Path_ID___ExtraInfo_ID_
push eax
mov ecx, esi
mov dword [ebp - 4], 0x13
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x84], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
push str.SELECT_Ps_RID_FROM_Ps_WHERE_Ps.PID___PID_AND_Ps.CreationTime___CreationTime
push eax
mov ecx, esi
mov dword [ebp - 4], 0x14
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x88], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
push str._INSERT_INTO_Ps____PID___CreationTime___TerminationTime__Args__PPs_ID__CertificateDescription_ID__Image_ID__ImageSig_ID__Owner_ID__n________________________________________VALUES____PID___CreationTime___0____________________1_______0__1_________1____________1__n
push eax
mov ecx, esi
mov dword [ebp - 4], 0x15
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x8c], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
push str.UPDATE_Ps__n_____________________________________SET_n________________________________________Args_t_t_t_t_t_t_t___Args__n________________________________________PPs_ID_t_t_t_t_t_t_t___PPs_ID__n________________________________________Image_ID_t_t_t_t_t_t___Image_ID__n________________________________________ImageSig_ID_t_t_t_t_t_t___ImageSig_ID__n________________________________________Owner_ID_t_t_t_t_t_t___Owner_ID__n_t_t_t_t_t_t_t_t_t_tCertificateDescription_ID_t_t___CertificateDescription_ID__n________________________________________LogonId_ID_________________________LogonId_ID__n________________________________________IntegrityLevel_____________________IntegrityLevel_n__________________________________________WHERE_Ps_RID___Ps_RID_n
push eax
mov ecx, esi
mov dword [ebp - 4], 0x16
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x90], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
push str.UPDATE_Ps__n_____________________________________________SET_TerminationTime___TerminationTime_n_____________________________________________WHERE_Ps_RID___Ps_RID_n
push eax
mov ecx, esi
mov dword [ebp - 4], 0x17
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x94], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
push str.INSERT_INTO_FileOp____OpenTime___CloseTime___Ps_ID___OpMask___File_ID___FileSize___Extra_ID__n_____________________________________________VALUES_____OpenTime___CloseTime___Ps_ID___OpMask____File_ID___FileSize___Extra_ID__n
push eax
mov ecx, esi
mov dword [ebp - 4], 0x18
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x98], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
push str.INSERT_INTO_FileExtra____MD5_ID___FileType__n_____________________________________________________VALUES_____MD5_ID___FileType__n
push eax
mov ecx, esi
mov dword [ebp - 4], 0x19
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x9c], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
push str.SELECT_RID_FROM_LnkFileOp_WHERE_LnkFile_ID___LnkFile_ID_n
push eax
mov ecx, esi
mov dword [ebp - 4], 0x1a
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0xa0], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
push str.INSERT_INTO_LnkFileOp__LnkFile_ID__OpMask__TargetFile_ID__Args__IconPath__HotKeyEnable__CveDetected__n_____________________________________________VALUES____LnkFile_ID___OpMask___TargetFile_ID___Args___IconPath___HotKeyEnable___CveDetected__n
push eax
mov ecx, esi
mov dword [ebp - 4], 0x1b
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0xa4], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
push str.INSERT_INTO_HttpOp____Time___Ps_ID___Action__URL_ID___HTTP_StatusCode___RedirectedURL_ID___RefererURL_ID___SrcSocket_ID___DstSocket_ID___UserAgent_ID___FlowId___n_______________________________________________VALUES____Time___Ps_ID___Action___URL_ID___HTTP_StatusCode___RedirectedURL_ID___RefererURL_ID___SrcSocket_ID___DstSocket_ID___UserAgent_ID___FlowId___n
push eax
mov ecx, esi
mov dword [ebp - 4], 0x1c
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0xa8], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
push str.UPDATE_HttpOp__n____________________________________SET_n___________________________________________HTTP_StatusCode____HTTP_StatusCode__n___________________________________________RedirectedURL_ID___RedirectedURL_ID_n___________________________WHERE__Time_____Time_AND__n_________________________________________FlowId___FlowId_n
push eax
mov ecx, esi
mov dword [ebp - 4], 0x1d
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0xac], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
push str.SELECT__LK_Protocol.Name:__Url_Prefix.Host_:Url_Prefix.Port_URL_Path.PathUrl_ExtraInfo.extraInfo__AS_URL_n_______________________________FROM_HTTPOp_n_________________________________JOIN_URLs__________ON_URLs.RID_____________HTTPOp.URL_ID_n_________________________________JOIN_URL_Prefix____ON_URLs.Prefix_ID_______URL_Prefix.RID_n_________________________________JOIN_URL_Path______ON_URLs.Path_ID_________URL_Path.RID_n_________________________________JOIN_URL_ExtraInfo_ON_URLs.ExtraInfo_ID____URL_ExtraInfo.RID_n_________________________________JOIN_LK_Protocol___ON_URL_Prefix.Protocol__LK_Protocol.RID_n_______________________________WHERE_FlowId___FlowId_AND_n_________________________________________Time_____Time__n
push eax
mov ecx, esi
mov dword [ebp - 4], 0x1e
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0xb0], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
push str.INSERT_INTO_DnsOp____Time___Ps_ID__DnsRequest__DnsResponse__n_______________________________________________VALUES____Time____Ps_ID____DnsRequest___DnsResponse__n
push eax
mov ecx, esi
mov dword [ebp - 4], 0x1f
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0xb4], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
push str.INSERT_INTO_RenameFileOp____FileOp_ID___OldFile_ID___n_________________________________________________________VALUES_____FileOp_ID___OldFile_ID___n
push eax
mov ecx, esi
mov dword [ebp - 4], 0x20
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0xb8], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
push str._SELECT_count_distinct_Files.RID__as_file_count__n_t_t_t_t_t_t_t_t_t_t_t____tFROM_Files__n_t_t_t_t_t_t_t_t_t_t_t_tINNER_JOIN_FileOp_ON_FileOp.File_ID__Files.RID__n_t_t_t_t_t_t_t_t_t_t_t_tINNER_JOIN_Directories_ON_Files.Dir_ID__Directories.RID__n_t_t_t_t_t_t_t_t_t_t_t_tWHERE_FileSize___0_AND__n_t_t_t_t_t_t_t_t_t_t_t_tDirectories.Name_LIKE__Folder__n_t_t_t_t_t_t_t_t_t_t_t_tAND_FileOp.OpenTime____OpTime_n_t_t_t_t_t_t_t_t_t_t_t_tAND_Files.RID_not_in____n_t_t_t_t_t_t_t_t_t_t_t_t_tSELECT__distinct_FileOp.File_ID__n_t_t_t_t_t_t_t_t_t_t_t_t_tFROM_FileOp___n_t_t_t_t_t_t_t_t_t_t_t_t_tWHERE_FileOp.OpMask__2__2__n_t_t_t_t_t_t_t_t_t_t_t_t
mov dword [ebp - 4], 0x21
push eax
mov ecx, esi
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x11c], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
push str.INSERT_INTO_Reboots__BootTime__VALUES__LastBootTime_
push eax
mov ecx, esi
mov dword [ebp - 4], 0x22
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0xbc], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
push str._n________________________________INSERT_INTO_Amsi___Ps_RID__OpTime__Hash__Source___n________________________________VALUES____Ps_RID___OpTime___Hash___Source___n
push eax
mov ecx, esi
mov dword [ebp - 4], 0x23
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0xc0], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
push str.SELECT_RID_FROM_SockAddr_WHERE_IpAddress___IpAddress_AND_Port___Port
push eax
mov ecx, esi
mov dword [ebp - 4], 0x24
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0xc4], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
push str.INSERT_INTO_SockAddr_____IpAddress___Port___n_________________________________________________VALUES______IpAddress___Port___n
push eax
mov ecx, esi
mov dword [ebp - 4], 0x25
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0xc8], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
push str.SELECT_RID_FROM_UserAgents_WHERE_UserAgent___UserAgent
push eax
mov ecx, esi
mov dword [ebp - 4], 0x26
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0xcc], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
push str.INSERT_INTO_UserAgents__UserAgent__VALUES___UserAgent_
push eax
mov ecx, esi
mov dword [ebp - 4], 0x27
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0xd0], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
push str.INSERT_INTO_SocketOP____Ps_ID___OpTime___IANAProtocol___SrcSocket_ID___DstSocket_ID___CreationTime___TerminationTime___BytesReceived___BytesSent___IsIncoming___n__________________________________________________VALUES____Ps_ID___OpTime___IANAProtocol___SrcSocket_ID___DstSocket_ID___CreationTime___TerminationTime___BytesReceived___BytesSent___IsIncoming___n
push eax
mov ecx, esi
mov dword [ebp - 4], 0x28
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0xd4], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
push str.UPDATE_SocketOP__n_______________________________________SET__n_______________________________________________Ps_ID____________Ps_ID___n_______________________________________________OpTime___________OpTime__n_______________________________________________IANAProtocol_____IANAProtocol___n_______________________________________________SrcSocket_ID_____SrcSocket_ID__n_______________________________________________DstSocket_ID_____DstSocket_ID___n_______________________________________________CreationTime_____CreationTime___n_______________________________________________TerminationTime__TerminationTime___n_______________________________________________BytesReceived____BytesReceived__n_______________________________________________BytesSent________BytesSent__n_______________________________________________IsIncoming_______IsIncoming_n______________________________________WHERE_RID___RID_n
push eax
mov ecx, esi
mov dword [ebp - 4], 0x29
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0xd8], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
push str.INSERT_INTO_PassiveConn____Ps_ID___OpTime__SrcSocket_ID___n__________________________________________________VALUES____Ps_ID___OpTime___SrcSocket_ID___n
push eax
mov ecx, esi
mov dword [ebp - 4], 0x2a
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0xdc], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
push str.SELECT_RID_FROM_RegistryValues_WHERE_Value___Value
push eax
mov ecx, esi
mov dword [ebp - 4], 0x2b
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0xe0], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
push str.INSERT_INTO_RegistryValues___Value___n______________________________________________________VALUES____Value___n
push eax
mov ecx, esi
mov dword [ebp - 4], 0x2c
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0xe4], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
push str.SELECT_RID_FROM_RegistryData_WHERE_Data___Data
push eax
mov ecx, esi
mov dword [ebp - 4], 0x2d
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0xe8], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
push str.INSERT_INTO_RegistryData___Data___n______________________________________________________VALUES____Data___n
push eax
mov ecx, esi
mov dword [ebp - 4], 0x2e
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0xec], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
push str.SELECT_RID_FROM_RegistryKeys_WHERE_RootKey___RootKey_AND_RegKey___RegKey
push eax
mov ecx, esi
mov dword [ebp - 4], 0x2f
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0xf0], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
push str.INSERT_INTO_RegistryKeys____RootKey___RootKey___RegKey___n____________________________________________________VALUES____RootKey___RootKey___RegKey___n
push eax
mov ecx, esi
mov dword [ebp - 4], 0x30
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0xf4], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
push str.INSERT_INTO_RegistryOp____OpTime___Ps_ID___OpMask___Key_ID___Value_ID___n__________________________________________________VALUES___OpTime___Ps_ID___OpMask___Key_ID___Value_ID___n
push eax
mov ecx, esi
mov dword [ebp - 4], 0x31
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0xf8], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
push str.INSERT_INTO_RegistryDataChangeOp____RegOp_ID____OldData_ID___NewData_ID___n__________________________________________________________________________VALUES____RegOp_ID____OldData_ID___NewData_ID___n
push eax
mov ecx, esi
mov dword [ebp - 4], 0x32
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0xfc], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
push str._SELECT_COUNT___n_______________________________________FROM_EnvVar_n_______________________________________WHERE_Name_ID____Name_ID___AND__n_____________________________________________Value_ID___Value_ID__AND_n_____________________________________________Owner_ID___Owner_ID__AND_n_____________________________________________OpTime_____SELECT_MAX_OpTime__n_________________________________________________________FROM_EnvVar__n_________________________________________________________WHERE_Name_ID____Name_ID_AND_n_______________________________________________________________Owner_ID___Owner_ID_____n
push eax
mov ecx, esi
mov dword [ebp - 4], 0x33
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x100], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
push str.INSERT_INTO_EnvVar____OpTime___Owner_ID___Name_ID___Value_ID___n________________________________________________VALUES____OpTime___Owner_ID___Name_ID___Value_ID___n
push eax
mov ecx, esi
mov dword [ebp - 4], 0x34
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x104], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
push str.SELECT_RID_FROM_EnvVarNames_WHERE_Name___Name
push eax
mov ecx, esi
mov dword [ebp - 4], 0x35
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x108], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
push str.INSERT_INTO_EnvVarNames___Name____n________________________________________________________VALUES____Name___n
push eax
mov ecx, esi
mov dword [ebp - 4], 0x36
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x10c], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
push str.SELECT_RID_FROM_EnvVarValues_WHERE_Value___Value
push eax
mov ecx, esi
mov dword [ebp - 4], 0x37
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x110], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
push str.INSERT_INTO_EnvVarValues___Value___n____________________________________________________VALUES____Value___n
push eax
mov ecx, esi
mov dword [ebp - 4], 0x38
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x114], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
push str.SELECT_Image_ID_FROM_Ps_WHERE_Ps_RID___Ps_RID
push eax
mov ecx, esi
mov dword [ebp - 4], 0x39
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x118], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
push str._n________________________________________INSERT_INTO_RemoteMachineInfo___RID__IpAddress__MachineName___n________________________________________VALUES____RID___IpAddress___MachineName___n
push eax
mov ecx, esi
mov dword [ebp - 4], 0x3a
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x120], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
push str._n____________SELECT_RID_FROM_RemoteMachineInfo_WHERE_MachineName___MachineName_n
push eax
mov ecx, esi
mov dword [ebp - 4], 0x3b
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x124], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
push str._n____________________________________________________SELECT_RID_FROM_RemoteMachineInfo_n____________________________________________________WHERE_IpAddress___IpAddress_n____________________________________________________AND___MachineName___MachineName_n
mov dword [ebp - 4], 0x3c
push eax
mov ecx, esi
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x128], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
push str._n________________________________INSERT_INTO_WmiExecutionOp___RID__Ps_ID__OpTime__CommandLine__CreatedProcess_ID__Attacker_ID__Victim_ID__ClientProcessId__ClientProcessCreationTime__IsLocal___n________________________________VALUES____RID___Ps_ID___OpTime___CommandLine___CreatedProcess_ID___Attacker_ID___Victim_ID___ClientProcessId___ClientProcessCreationTime___IsLocal___n
push eax
mov ecx, esi
mov dword [ebp - 4], 0x3d
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x12c], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
push str._n________________________________INSERT_INTO_ExtensionOp___RID__Ps_ID__OpTime__URL_ID__Referrer_ID__DownloadedFileMD5__DownloadedFileName___n________________________________VALUES____RID___Ps_ID___OpTime___URL_ID___Referrer_ID___DownloadedFileMD5___DownloadedFileName___n
push eax
mov ecx, esi
mov dword [ebp - 4], 0x3e
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x130], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
push str._n_______________________________SELECT_RID_FROM_LogonOp_WHERE_OpTime___OpTime_AND_LogonId_ID___LogonId_ID_n
push eax
mov ecx, esi
mov dword [ebp - 4], 0x3f
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x134], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
push str._n_____________________________________SELECT_RID_FROM_FailedLogonOp_WHERE_OpTime___OpTime_AND__n_________________________________________________________________________LastOpTime___LastOpTime_AND__n_________________________________________________________________________NumberOfAttempts___NumberOfAttempts_AND_n_________________________________________________________________________Owner_ID___Owner_ID_n
push eax
mov ecx, esi
mov dword [ebp - 4], 0x40
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x138], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
push str._n________________________________________INSERT_INTO_LogonOp___RID__Ps_ID__OpTime__EventId__EventType___n______________________________________________________________LogonType__RemoteMachine_ID__RemoteIpPort__n______________________________________________________________LogonId_ID__LinkedLogonId_ID__ClientProcess_ID__n______________________________________________________________IsRemote___n__n________________________________________VALUES____RID___Ps_ID___OpTime___EventId___EventType___n__________________________________________________LogonType___RemoteMachine_ID___RemoteIpPort__n__________________________________________________LogonId_ID___LinkedLogonId_ID___ClientProcess_ID__n__________________________________________________IsRemote___n
push eax
mov ecx, esi
mov dword [ebp - 4], 0x41
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x13c], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
push str._n________________________________________INSERT_INTO_FailedLogonOp___RID__Ps_ID__OpTime__LogonType__Owner_ID___n____________________________________________________________________RemoteMachine_ID___NumberOfAttempts___n____________________________________________________________________LastOpTime__StatusCode__SubStatusCode__IsRemote____n________________________________________VALUES____RID___Ps_ID___OpTime___LogonType___Owner_ID___n__________________________________________________RemoteMachine_ID____NumberOfAttempts___n__________________________________________________LastOpTime___StatusCode___SubStatusCode___IsRemote____n
push eax
mov ecx, esi
mov dword [ebp - 4], 0x42
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x140], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
push str._n________________________________________SELECT_RID_FROM_LogonIds_WHERE_LogonId___LogonId_n
push eax
mov ecx, esi
mov dword [ebp - 4], 0x43
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x144], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
push str._n________________________________________INSERT_INTO_LogonIds___RID__LogonId__Owner_ID___n________________________________________VALUES____RID___LogonId___Owner_ID___n
push eax
mov ecx, esi
mov dword [ebp - 4], 0x44
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x148], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
push str._n__________________________________________INSERT_INTO_RemoteExecutionOp___RID__Ps_ID__OpTime__SourceMachine_ID__SourceSocket_ID__DestinationSocket_ID__LogonId_ID__RemoteExecutionType___n__________________________________________VALUES____RID___Ps_ID___OpTime___SourceMachine_ID___SourceSocket_ID___DestinationSocket_ID___LogonId_ID___RemoteExecutionType___n
push eax
mov ecx, esi
mov dword [ebp - 4], 0x45
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
lea ecx, [edi + 0x150]
push esi
mov dword [edi + 0x14c], eax
call fcn.004be0b0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret