Function at 0x476260
Capabilities:
Access peb ldr_data
Get ntdll base address
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x603393
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x6ba394]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0xc
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
mov esi, dword [ebp + 8]
mov ecx, esi
push str.SELECT__LK_Protocol.Name__:____URL_Prefix.Host__URL_Path.Path__URL_ExtraInfo.ExtraInfo__AS_URL__________________________________________FROM_URLs_JOIN_URL_Prefix_ON_URLs.Prefix_ID__URL_Prefix.RID______________________________________________________________________________________JOIN_URL_Path_ON_URLs.Path_ID__URL_Path.RID______________________________________________________________________________________________________JOIN_URL_ExtraInfo_ON_URLs.ExtraInfo_ID__URL_ExtraInfo.RID_______________________________________________________________________________________JOIN_LK_Protocol_ON_URL_Prefix.Protocol__LK_Protocol.RID_________________________________________________________________________________________WHERE_Host_LIKE__Host_LIMIT__limit
push eax
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x10], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT__LK_Protocol.Name__:____URL_Prefix.Host__URL_Path.Path__URL_ExtraInfo.ExtraInfo__AS_URL__________________________________________FROM_URLs_JOIN_URL_Prefix_ON_URLs.Prefix_ID__URL_Prefix.RID______________________________________________________________________________________JOIN_URL_Path_ON_URLs.Path_ID__URL_Path.RID______________________________________________________________________________________________________JOIN_URL_ExtraInfo_ON_URLs.ExtraInfo_ID__URL_ExtraInfo.RID_______________________________________________________________________________________JOIN_LK_Protocol_ON_URL_Prefix.Protocol__LK_Protocol.RID_________________________________________________________________________________________WHERE_Host_LIKE__Host_AND_Path_LIKE__Path_COLLATE_NOCASE_LIMIT__limit
push eax
mov ecx, esi
mov dword [ebp - 4], 1
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x14], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT__LK_Protocol.Name__:____URL_Prefix.Host__URL_Path.Path__URL_ExtraInfo.ExtraInfo__AS_URL__________________________________________FROM_URLs_JOIN_URL_Prefix_ON_URLs.Prefix_ID__URL_Prefix.RID______________________________________________________________________________________JOIN_URL_Path_ON_URLs.Path_ID__URL_Path.RID______________________________________________________________________________________________________JOIN_URL_ExtraInfo_ON_URLs.ExtraInfo_ID__URL_ExtraInfo.RID_______________________________________________________________________________________JOIN_LK_Protocol_ON_URL_Prefix.Protocol__LK_Protocol.RID_________________________________________________________________________________________WHERE_Host_LIKE__Host_AND_Path___Path_COLLATE_NOCASE_AND_ExtraInfo_LIKE__ExtraInfo_COLLATE_NOCASE_LIMIT__limit
push eax
mov ecx, esi
mov dword [ebp - 4], 2
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x18], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str._SELECT__Directories.Name__Files.Name__AS_File_Path__Files.RID_n_t_t_t_t_t_t_t_t_t_t_tFROM_Files_JOIN_Directories_ON_Files.Dir_ID__Directories.RID_n_t_t_t_t_t_t_t_t_t_t_tJOIN_FileOp_ON_FileOp.File_ID__Files.RID_n_t_t_t_t_t_t_t_t_t_t_tWHERE_Directories.Name_GLOB__Dir_n_t_t_t_t_t_t_t_t_t_t_tAND_Files.Name_GLOB__FileName_n_t_t_t_t_t_t_t_t_t_t_tGROUP_BY_Files.RID_n_t_t_t_t_t_t_t_t_t_t_tORDER_BY_FileOp.OpenTime_DESC_n_t_t_t_t_t_t_t_t_t_t_tLIMIT__limit
push eax
mov ecx, esi
mov dword [ebp - 4], 3
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str._SELECT__Directories.Name__Files.Name__AS_File_Path__Files.RID_n_t_t_t_t_t_t_t_t_t_t_t_tFROM_Files_JOIN_Directories_ON_Files.Dir_ID__Directories.RID_n_t_t_t_t_t_t_t_t_t_t_t_tJOIN_FileOp_ON_FileOp.File_ID__Files.RID_n_t_t_t_t_t_t_t_t_t_t_t_tJOIN_Ps_ON_Ps.Image_ID__Files.RID__n_t_t_t_t_t_t_t_t_t_t_t_tAND_Files.Dir_ID__Directories.RID_n_t_t_t_t_t_t_t_t_t_t_t_tAND_Ps.PID___PID_n_t_t_t_t_t_t_t_t_t_t_t_tAND_Ps.CreationTime___CreationTime_n_t_t_t_t_t_t_t_t_t_t_t_tAND_Directories.Name_GLOB__Dir_n_t_t_t_t_t_t_t_t_t_t_t_tAND_Files.Name_GLOB__FileName_n_t_t_t_t_t_t_t_t_t_t_t_tGROUP_BY_Files.RID_n_t_t_t_t_t_t_t_t_t_t_t_tORDER_BY_FileOp.OpenTime_DESC_n_t_t_t_t_t_t_t_t_t_t_t_tLIMIT__limit
push eax
mov ecx, esi
mov dword [ebp - 4], 4
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 4], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str._SELECT_EXISTS__SELECT_1_FROM_Ps__n________________________________________________________WHERE_Ps.PID___PID_n_t_t_t____________________________________________AND_Ps.CreationTime___CreationTime_n____________________________________________________LIMIT_1__as_IsPsExists
push eax
mov ecx, esi
mov dword [ebp - 4], 5
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 8], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str._SELECT_PID__CreationTime_FROM_Ps__n________________________________________________________WHERE_PID___PID_n_t_t_t_t_t_t_t_t_t_t_t_t_tORDER_BY_CreationTime_DESC_n____________________________________________________LIMIT_1
mov dword [ebp - 4], 6
push eax
mov ecx, esi
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0xc], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT_EXISTS_SELECT_1_FROM_Ps_WHERE_Ps.Image_ID___Image_ID_LIMIT_1__as_IsExcuted
push eax
mov ecx, esi
mov dword [ebp - 4], 7
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x1c], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT__Directories.Name__Files.Name__AS_File_Path__Files.RID_n_t_t_t_t_t_t_t_t_t_t_t_tFROM_Files_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_n_t_t_t_t_t_t_t_t_t_t_t_tJOIN_Directories_ON_Files.Dir_ID__Directories.RID_t_t_t_t_t_n_t_t_t_t_t_t_t_t_t_t_t_tJOIN_FileOp_ON_FileOp.File_ID__Files.RID_t_t_t_t_t_t_t_n_t_t_t_t_t_t_t_t_t_t_t_tWHERE_Files.Name_GLOB__FileName_n_t_t_t_t_t_t_t_t_t_t_t_tGROUP_BY_Files.RID_n_t_t_t_t_t_t_t_t_t_t_t_tORDER_BY_FileOp.OpenTime_DESC_n_t_t_t_t_t_t_t_t_t_t_t_tLIMIT___limit_n_t_t_t_t_t_t_t_t_t_t
push eax
mov ecx, esi
mov dword [ebp - 4], 8
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x20], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT__Directories.Name__Files.Name__AS_File_Path__Files.RID_n_t_t_t_t_t_t_t_t_t_t_t_tFROM_Files__Directories__Ps__n_t_t_t_t_t_t_t_t_t_t_t_tWHERE_Ps.Image_ID__Files.RID_n_t_t_t_t_t_t_t_t_t_t_t_tAND_Files.Dir_ID__Directories.RID_n_t_t_t_t_t_t_t_t_t_t_t_tAND_Files.Name_LIKE__FileName_n_t_t_t_t_t_t_t_t_t_t_t_tAND_Directories.Name_LIKE__Dir_n_t_t_t_t_t_t_t_t_t_t_t_tGROUP_BY_Files.RID_n_t_t_t_t_t_t_t_t_t_t_t_tORDER_BY_Ps.CreationTime_DESC_n_t_t_t_t_t_t_t_t_t_t_t_tLIMIT__limit
push eax
mov ecx, esi
mov dword [ebp - 4], 9
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x24], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str._SELECT__Directories.Name__Files.Name__AS_File_Path__SignerInfo.Name_AS_Signer__Files.RID_n_t_t_t_t_t_t_t_t_t_tFROM_Ps__MD5Signature__SignerInfo__Files__Directories_n_t_t_t_t_t_t_t_t_t_tWHERE_Ps.ImageSig_ID__MD5Signature.RID_n_t_t_t_t_t_t_t_t_t_tAND_Ps.Image_ID__Files.RID_n_t_t_t_t_t_t_t_t_t_tAND_Files.Dir_ID__Directories.RID_n_t_t_t_t_t_t_t_t_t_tAND_SignerInfo.RID__MD5Signature.Signer_ID_n_t_t_t_t_t_t_t_t_t_tAND_MD5Signature.MD5___Hash_n_t_t_t_t_t_t_t_t_t_tGROUP_BY_Files.RID
push eax
mov ecx, esi
mov dword [ebp - 4], 0xa
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x28], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str._SELECT__Directories.Name__Files.Name__AS_File_Path__SignerInfo.Name_AS_Signer__Files.RID_n_t_t_t_t_t_t_t_t_t_tFROM_Ps__MD5Signature__SignerInfo__Files__Directories__SockAddr__SocketOp_n_t_t_t_t_t_t_t_t_t_tWHERE_Ps.ImageSig_ID__MD5Signature.RID_n_t_t_t_t_t_t_t_t_t_tAND_Ps.Image_ID__Files.RID_n_t_t_t_t_t_t_t_t_t_tAND_Ps.Ps_RID__SocketOp.Ps_ID_n_t_t_t_t_t_t_t_t_t_tAND_Files.Dir_ID__Directories.RID_n_t_t_t_t_t_t_t_t_t_tAND_SignerInfo.RID__MD5Signature.Signer_ID_n_t_t_t_t_t_t_t_t_t_tAND_SocketOp.DstSocket_ID__SockAddr.RID_n_t_t_t_t_t_t_t_t_t_tAND_SockAddr.IpAddress___IP_n_t_t_t_t_t_t_t_t_t_tGROUP_BY_Files.RID
push eax
mov ecx, esi
mov dword [ebp - 4], 0xb
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x2c], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str._SELECT__Directories.Name__Files.Name__AS_File_Path__Files.RID_n____________________________________________________FROM_Ps__Files__Directories_t_n________________________________________________________WHERE_Ps.PID___PID_n_t_t_t____________________________________________AND_Ps.CreationTime___CreationTime_n_t_t_t____________________________________________AND_Files.RID__Ps.Image_ID__n_t_t_t____________________________________________AND_Files.Dir_ID__Directories.RID_n
push eax
mov ecx, esi
mov dword [ebp - 4], 0xc
call fcn.0059bb88
mov dword [edi + 0x30], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4