Function at 0x454e00
Capabilities:
Get process heap flags
Get process heap force flags
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x600ab1
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x6ba394]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0xc
call fcn.005b1b6c
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
mov esi, dword [ebp + 8]
mov ecx, esi
push str.SELECT_URLs.RID_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_tFROM_URLs__URL_Prefix__URL_Path__URL_ExtraInfo_t_t_t_t_t_t_t_t_tWHERE_Host___Host_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_tAND_Path_LIKE__Path_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_tAND_ExtraInfo___ExtraInfo_t_t_t_t_t_t_t_t_t_t_t_t_t_tAND_URLs.Prefix_ID__URL_Prefix.RID_t_t_t_t_t_t_t_t_t_t_t_tAND_URLs.Path_ID__URL_Path.RID_t_t_t_t_t_t_t_t_t_t_t_t_tAND_URLs.ExtraInfo_ID__URL_ExtraInfo.RID
push eax
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x24], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT_Files.RID_AS_File_RID_t_t_t_t_t_t_t_t_t_t_t_t_t_t_tFROM_Files__Directories_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_tWHERE_Directories.Name___Dir_t_t_t_t_t_t_t_t_t_t_t_t_t_t_tAND_Files.Name_LIKE__FileName_t_t_t_t_t_t_t_t_t_t_t_t_t_tAND_Files.Dir_ID__Directories.RID
push eax
mov ecx, esi
mov dword [ebp - 4], 1
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x28], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT_Files.RID_AS_File_RID_t_t_t_t_t_t_t_t_t_t_t_tFROM_Files__Directories_t_t_t_t_t_t_t_t_t_t_t_t_tWHERE_Directories.Name___Dir_t_t_t_t_t_t_t_t_t_t_t_tAND_Files.Name___FileName_t_t_t_t_t_t_t_t_t_t_t_tAND_Files.Dir_ID__Directories.RID
push eax
mov ecx, esi
mov dword [ebp - 4], 2
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x2c], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT_Files.RID_AS_File_RID__Directories.Name_AS_Dir_t_t_t_t_t_t_t_t_t_tFROM_Files__Directories_t_t_t_t_t_t_t_t_t_t_t_t_t_t_tWHERE_Files.Name___FileName_t_t_t_t_t_t_t_t_t_t_t_t_tAND_Files.Dir_ID__Directories.RID
push eax
mov ecx, esi
mov dword [ebp - 4], 3
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x30], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT_Ps_ID__Time_t_t_t_t_t_t_t_t_t_t_t_t_t_t_tFROM_HttpOp_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_tWHERE_URL_ID___URL_ID_t_t_t_t_t_t_t_t_t_t_t_t_t_tAND_Time____Time_t_t_t_t_t_t_t_t_t_t_t_t_tORDER_BY_time_DESC
push eax
mov ecx, esi
mov dword [ebp - 4], 4
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x34], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT_Ps_ID__OpTime_t_t_t_t_t_t_t_t_t_t_t_t_t_tFROM_ExtensionOp_t_t_t_t_t_t_t_t_t_t_t_t_t_t_tWHERE_URL_ID___URL_ID_t_t_t_t_t_t_t_t_t_t_t_t_t_t_tAND_OpTime____Time_t_t_t_t_t_t_t_t_t_t_t_t_t_tORDER_BY_OpTime_DESC
push eax
mov ecx, esi
mov dword [ebp - 4], 5
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x38], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT_DISTINCT_Ps_ID__Files.Name_as_Name__FileOp.OpenTime_____t_t_t_t_t_t_t_t_t_t_tFROM_FileOp__Ps__Files_______________________________________t_t_t_t_t_t_t_t_t_t_tWHERE_FileOp.File_ID___File_ID______________________________t_t_t_t_t_t_t_t_t_t_t_tAND_FileOp.OpenTime____MinTime__________________________t_t_t_t_t_t_t_t_t_t_t_tAND_FileOp.OpenTime____MaxTime__________________________t_t_t_t_t_t_t_t_t_t_t_tAND_FileOp.Ps_ID__Ps.Ps_RID_____________________________t_t_t_t_t_t_t_t_t_t_t_tAND_Ps.Image_ID__Files.RID______________________________t_t_t_t_t_t_t_t_t_t_t_tAND_FileOp.OpMask___AnyReadOp___________________________t_t_t_t_t_t_t_t_t_t_tORDER_BY_OpenTime_DESC_LIMIT__limit
mov dword [ebp - 4], 6
push eax
mov ecx, esi
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x3c], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT_Ps_ID__OpenTime____________________t_t_t_t_t_t_t_t_t_t_tFROM_FileOp______________________t_t_t_t_t_t_t_t_t_t_tWHERE_File_ID___File_ID_________t_t_t_t_t_t_t_t_t_t_tAND_OpenTime____Time_____________t_t_t_t_t_t_t_t_t_t_tAND__OpMask___OpMask____________t_t_t_t_t_t_t_t_t_t_tORDER_BY_OpenTime_DESC
push eax
mov ecx, esi
mov dword [ebp - 4], 7
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x40], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT_Directories.Name_AS_Dir__Files.Name_AS_File__Ps.PID_AS_PID__Parent_Ps.Ps_RID_AS_PPsRID__Ps.CreationTime__Ps.TerminationTime__n_t_t_t_t_t_t_t_t_t_t_t_tPs.Image_ID_AS_Image_ID__Ps.Args_AS_Args__MD5__SignerInfo.Name_AS_SignerName__Owners.SID__Owners.Name_AS_OwnerName__n_t_t_t_t_t_t_t_t_t_t_t_tPs.CertificateDescription_ID__LK_CertificateDescription.Description_as_CertificateStatus___n_t_t_t_t_t_t_t_t_t_t_t_tPs.IntegrityLevel_as_IntegrityLevel__LK_IntegrityLevel.Description_as_Integrity__n_t_t_t_t_t_t_t_t_t_t_tFROM_Ps__Ps_as_Parent_Ps__Files__Directories__MD5Signature__SignerInfo__Owners__LK_CertificateDescription__LK_IntegrityLevel_n_t_t_t_t_t_t_t_t_t_t_tWHERE_Ps.Ps_RID___Ps_RID_n_t_t_t_t_t_t_t_t_t_t_tAND_Ps.Image_ID__Files.RID_n_t_t_t_t_t_t_t_t_t_t_tAND_Files.Dir_ID__Directories.RID_n_t_t_t_t_t_t_t_t_t_t_tAND_Ps.PPs_ID__Parent_Ps.Ps_RID_n_t_t_t_t_t_t_t_t_t_t_tAND_Ps.ImageSig_ID__MD5Signature.RID_n_t_t_t_t_t_t_t_t_t_t_tAND_SignerInfo.RID__MD5Signature.Signer_ID_n_t_t_t_t_t_t_t_t_t_t_tAND_Ps.CertificateDescription_ID__LK_CertificateDescription.RID_n_t_t_t_t_t_t_t_t_t_t_tAND_Ps.IntegrityLevel__LK_IntegrityLevel.Value_n_t_t_t_t_t_t_t_t_t_t_tAND_Owners.RID__Ps.Owner_ID
push eax
mov ecx, esi
mov dword [ebp - 4], 8
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x44], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT_Ps.PID__Ps.CreationTime___Directories.Name__Files.Name__as_CreatedBy_t________________________________________________FROM_FileOp__Ps__Files__Directories_t_t_t_t_t_t_t_t_t_t_t________________________________________________WHERE_FIleOp.File_ID___File_ID_t_t_t_t_t_t_t_t_t_t_t_t________________________________________________AND_FileOp.OpMask___CreateOrRename__t_t_t_t_t_t_t_t_t_t________________________________________________AND_Ps.Ps_RID__FileOp.Ps_ID_t_t_t_t_t_t_t_t_t_t_t_t________________________________________________AND_Files.RID__Ps.Image_ID_t_t_t_t_t_t_t_t_t_t_t_t_t________________________________________________AND_Directories.RID__Files.Dir_ID
push eax
mov ecx, esi
mov dword [ebp - 4], 9
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x48], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT_Files.Name_AS_Parent__Ps.CreationTime_AS_Time__Ps.PID_AS_PID______________________________________________FROM_Files__ps________________________________________________________________________________________________WHERE_ps.Ps_Rid___Ps_RID_____________________________________________________________________________________AND_Ps.Image_ID__Files.RID
push eax
mov ecx, esi
mov dword [ebp - 4], 0xa
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x9c], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT_LK_SID.Description_AS_Description__LK_SID.Name_AS_Name___________________________________________FROM_LK_SID_____________________________________________________________________________________________WHERE_LK_SID.SID___SID
push eax
mov ecx, esi
mov dword [ebp - 4], 0xb
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x118], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT_MAX_EnvVar.OpTime__AS_OpTime___n______________________________________________________EnvVarNames.Name___AS_VarName___n_t_t______________________________________________EnvVarValues.Value_AS_VarValue_n_______________________________________________FROM_EnvVar_n____________________________________________________JOIN_EnvVarNames__ON_EnvVar.Name_ID___EnvVarNames.RID_n____________________________________________________JOIN_EnvVarValues_ON_EnvVar.Value_ID__EnvVarValues.RID_n_______________________________________________WHERE__n_t_t______________________________________________EnvVarNames.Name_IN___appdata__localappdata__userprofile__temp__tmp__n_______________________________________________GROUP_BY_EnvVar.Name_ID_EnvVar.Owner_ID_n_______________________________________________ORDER_BY_length_VarValue__DESC_n
push eax
mov ecx, esi
mov dword [ebp - 4], 0xc
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x54], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.Select_Ps_RID__Ps.PID__Ps.CreationTime__Ps.TerminationTime_n_t_t_t_t_t_t_t_t_t_t_tFrom_Ps__Files_as_Image_n_t_t_t_t_t_t_t_t_t_t_tWHERE_Ps.TerminationTime_BETWEEN__TimeBegin_AND__TimeEnd_n_t_t_t_t_t_t_t_t_t_t_tAND_Image.Name___ProcessName_n_t_t_t_t_t_t_t_t_t_t_tAND_Image.RID__Ps.Image_ID_n_t_t_t_t_t_t_t_t_t_t_torder_by_Ps.TerminationTime_DESC
push eax
mov ecx, esi
mov dword [ebp - 4], 0xd
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x138], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT_Ps_RID__CreationTime_n_t_t_t_t_t_t_t_t_t_t_t_t_t_tFROM_Ps_n_t_t_t_t_t_t_t_t_t_t_t_t_t_tWHERE_Image_ID___Image_ID_n_t_t_t_t_t_t_t_t_t_t_t_t_t_tAND_CreationTime____MinTime__n_t_t_t_t_t_t_t_t_t_t_t_t_t_tORDER_BY_CreationTime_ASC
push eax
mov ecx, esi
mov dword [ebp - 4], 0xe
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x4c], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT_Ps_RID_n_t_t_t_t_t_t_t_t_t_t_t_t_t_tFROM_Ps_n_t_t_t_t_t_t_t_t_t_t_t_t_t_tWHERE_PID___PID_n_t_t_t_t_t_t_t_t_t_t_t_t_t_tAND_CreationTime___CTime
push eax
mov ecx, esi
mov dword [ebp - 4], 0xf
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x50], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT_Ps.Ps_RID_AS_Child_RID__Ps.CreationTime_____n________________________________________________FROM_Ps__Ps_as_Parent_Ps_________________________n________________________________________________WHERE_Parent_Ps.Ps_RID___PPs_RID________________n________________________________________________AND_Ps.PPs_ID__Parent_Ps.Ps_RID_n________________________________________________AND_Ps.CreationTime____MinTime
push eax
mov ecx, esi
mov dword [ebp - 4], 0x10
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x58], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str._n____________________________________________________________SELECT_Ps.Ps_RID_AS_Ps_RID__Ps.PID_AS_PID__Ps.CreationTime_AS_CreationTime_n____________________________________________________________FROM_Ps_n____________________________________________________________JOIN_WmiExecutionOp_ON_WmiExecutionOp.CreatedProcess_ID__Ps.Ps_RID_n____________________________________________________________WHERE_WmiExecutionOp.ClientProcessId___PID_n____________________________________________________________AND_WmiExecutionOp.ClientProcessCreationTime___CTime__n
push eax
mov ecx, esi
mov dword [ebp - 4], 0x11
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x5c], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT_EXISTS_SELECT_1_FROM_Ps_WHERE_Ps.Image_ID___Image_ID_LIMIT_1__as_IsExcuted
push eax
mov ecx, esi
mov dword [ebp - 4], 0x12
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x60], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT_PPs_ID_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_tFROM_Ps_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_tWHERE_Ps_RID___Ps_RID__________________________________________________________________________AND_PPs_ID___100
push eax
mov ecx, esi
mov dword [ebp - 4], 0x13
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x64], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT_Image_ID__Files.Name_AS_File_Name_t_t_t_t_t_t_t_t_t_t_t_t_t_t_tFROM_Ps__Files_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_tWHERE_Ps_RID___Ps_RID_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_tAND_Ps.Image_ID__Files.RID
push eax
mov ecx, esi
mov dword [ebp - 4], 0x14
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x6c], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT_File_ID__Files.Name_tAS_File_Name__FileOp.OpenTime____________t_t_t_t_t_t_t_t_t_t_t_t_tFROM_FileOp__Files_t_t_t_t_t_t_t_t_t_t_t_____t_t_t_t_t_t_t_t_t_t_t_t_tWHERE_FileOp.Ps_ID___Ps_ID_t_t_t_t_t_t_t_t_t_____t_t_t_t_t_t_t_t_t_t_t_t_t_tAND_FileOp.OpenTime_BETWEEN__TimeBegin_AND__TimeEnd__________t_t_t_t_t_t_t_t_t_t_t_t_t_tAND_FileOp.File_ID__Files.RID_t_t_t_t_t_t_t_____t_t_t_t_t_t_t_t_t_t_t_t_t_tAND__OpMask___FileRead______________________________________t_t_t_t_t_t_t_t_t_t_t_t_tORDER_BY_FileOp.OpenTime_DESC
push eax
mov ecx, esi
mov dword [ebp - 4], 0x15
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x68], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT_URL_ID__HttpOp.RID_as_HttpOpRID__HttpOp.Time_as_OpTime__HttpOp.Action_as_HttpOpAction__n________________________________________________________HttpOp.SrcSocket_ID__HttpOp.DstSocket_ID__URL_Prefix.Host_as_Domain___n_t_t_t_t_t_t_t_t_t_t_t_t_t_tLK_Protocol.Name_as_Protocol__URL_Path.Path_as_UrlPath__n_t_t_t_t_t_t_t_t_t_t_t_t_t_t_URL_Prefix.Host__URL_Path.Path__URL_ExtraInfo.ExtraInfo__as_URL__URL_Prefix.Port_____________________________________________n_t_t_t_t_t_t_t_t_t_t_t_t_tFROM_HttpOp__URLs__URL_Prefix__URL_Path__URL_ExtraInfo__LK_Protocol_t_t_________________________________n_t_t_t_t_t_t_t_t_t_t_t_t_tWHERE_HttpOp.Ps_ID___Ps_ID_t_t_t_t_t_t_t_t_t_________________________________n________________________________________________________AND_HttpOp.Time____Time__________________________________________________________________n________________________________________________________AND_HttpOp.Time____MinTime_______________________________________________________________n_t_t_t_t_t_t_t_t_t_t_t_t_t_tAND_HttpOp.URL_ID__URLs.RID_t_t_t_t_t_t_t_t_____________________________n_t_t_t_t_t_t_t_t_t_t_t_t_t_tAND_URLs.Prefix_ID__URL_Prefix.RID_t_t_t_t_t_t_________________________________n_t_t_t_t_t_t_t_t_t_t_t_t_t_tAND_URLs.Path_ID__URL_Path.RID_t_t_t_t_t_t_t_________________________________n_t_t_t_t_t_t_t_t_t_t_t_t_t_tAND_URLs.ExtraInfo_ID__URL_ExtraInfo.RID_n_t_t_t_t_t_t_t_t_t_t_t_t_t_tAND_URL_Prefix.Protocol__LK_Protocol.RID_t_t_t_________________________________n________________________________________________________ORDER_BY_OpTime_LIMIT__limit
push eax
mov ecx, esi
mov dword [ebp - 4], 0x16
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x70], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT_URL_ID__HttpOp.RID_as_HttpOpRID__HttpOp.Time_as_OpTime__HttpOp.Action_as_HttpOpAction__n________________________________________________________HttpOp.SrcSocket_ID__HttpOp.DstSocket_ID__URL_Prefix.Host_as_Domain__LK_Protocol.Name_as_Protocol__URL_Path.Path_as_UrlPath______________________________________________n_t_t_t_t_t_t_t_t_t_t_t_t_tFROM_HttpOp__URLs__URL_Prefix__URL_Path__URL_ExtraInfo__LK_Protocol_t_t_________________________________n_t_t_t_t_t_t_t_t_t_t_t_t_tWHERE_HttpOp.Ps_ID___Ps_ID_t_t_t_t_t_t_t_t_t_________________________________n________________________________________________________AND_HttpOp.Time____Time__________________________________________________________________n________________________________________________________AND_HttpOp.Time____MinTime_______________________________________________________________n_t_t_t_t_t_t_t_t_t_t_t_t_t_tAND_HttpOp.URL_ID__URLs.RID_t_t_t_t_t_t_t_t_____________________________n_t_t_t_t_t_t_t_t_t_t_t_t_t_tAND_URLs.Prefix_ID__URL_Prefix.RID_t_t_t_t_t_t_________________________________n_t_t_t_t_t_t_t_t_t_t_t_t_t_tAND_URLs.Path_ID__URL_Path.RID_t_t_t_t_t_t_t_________________________________n_t_t_t_t_t_t_t_t_t_t_t_t_t_tAND_URLs.ExtraInfo_ID__URL_ExtraInfo.RID_n_t_t_t_t_t_t_t_t_t_t_t_t_t_tAND_URL_Prefix.Protocol__LK_Protocol.RID_t_t_t_________________________________n________________________________________________________ORDER_BY_OpTime_DESC_LIMIT_1
push eax
mov ecx, esi
mov dword [ebp - 4], 0x17
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x74], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT_CreationTime__TerminationTime__SrcSocket_ID__DstSocket_ID__LK_IANAProtocol.RID_as_IANAProtocolID__DstSockAddr.IPAddress_as_IP__IsIncoming__BytesReceived__BytesSent_n________________________________________________FROM_SocketOp__LK_IANAProtocol__SockAddr_as_DstSockAddr_n________________________________________________WHERE_SocketOp.Ps_ID___Ps_ID_n_t_t_t_t_t_t_t_t_t_t_t_tAND_SocketOp.DstSocket_ID__DstSockAddr.RID_n________________________________________________AND_SocketOp.OpTime____MinTime_n________________________________________________AND_LK_IANAProtocol.RID__SocketOp.IANAProtocol_n________________________________________________ORDER_BY_OpTime
push eax
mov ecx, esi
mov dword [ebp - 4], 0x18
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0xec], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT__CreationTime__SrcSocket_ID__DstSocket_ID__LK_IANAProtocol.RID_as_IANAProtocolID___________________________________________________________FROM_SocketOp__LK_IANAProtocol______________________________________________________________________________________________________________WHERE_SocketOp.Ps_ID___Ps_ID_______________________________________________________________________________________________________________AND_SocketOp.CreationTime____Time___________________________________________________________________________________________________________AND_LK_IANAProtocol.RID__SocketOp.IANAProtocol_____________________________________________________________________________________________ORDER_BY_CreationTime_DESC_LIMIT_1
push eax
mov ecx, esi
mov dword [ebp - 4], 0x19
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0xf0], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT_OpTime__SrcSocket_ID__n________________________________________________FROM_PassiveConn_n________________________________________________WHERE_PassiveConn.Ps_ID___Ps_ID__n________________________________________________AND_PassiveConn.OpTime____MinTime_n________________________________________________ORDER_BY_OpTime
push eax
mov ecx, esi
mov dword [ebp - 4], 0x1a
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0xf8], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT_File_ID__Files.Name_AS_File_Name__FileOp.OpenTime_AS_OpTime__FileOp.RID_as_FileOpRID___n_t_t_t_t_t_t_t_t_t_t_t_t_tDirectories.Name_as_File_Directory__FileOp.OpMask_as_OpMask__FileOp.FileSize_as_FileSize___n_t_t_t_t_t_t_t_t_t_t_t_t_tMD5Signature.MD5_as_File_Hash__FileExtra.FileType_as_File_Type_n_t_t_t_t_t_t_t_t_t_t_t_t_t_tFROM_FileOp__Files__Directories_t_t_t_t_t_t_t_t_t_t_t_t_t_t_n_t_t_t_t_t_t_t_t_t_t_t_t_t_tLEFT_JOIN_FileExtra_ON_FileOp.Extra_ID__FileExtra.RID_n________________________________________________________LEFT_JOIN_MD5Signature_ON_FileExtra.MD5_ID__MD5Signature.RID_n_t_t_t_t_t_t_t_t_t_t_t_t_t_tWHERE_FileOp.Ps_ID___Ps_ID_n____________________________________________________________AND_FileOp.OpenTime____MinTime_t_t_t_t_t_t_t_t_t_t_n_t_t_t_t_t_t_t_t_t_t_t_t_t_t_tAND_FileOp.File_ID__Files.RID_______________________________________________n____________________________________________________________AND_Directories.RID__Files.Dir_ID_n_t_t_t_t_t_t_t_t_t_t_t_t_t_tORDER_BY_OpTime
push eax
mov ecx, esi
mov dword [ebp - 4], 0x1b
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x78], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT_File_ID__FileOp.OpenTime_AS_OpTime__FileOp.RID_as_FileOpRID___n_t_t_t_t_t_t_t_t_t_t_t_t_tFileOp.FileSize_as_FileSize___n_t_t_t_t_t_t_t_t_t_t_t_t_tMD5Signature.MD5_as_File_Hash__FileExtra.FileType_as_File_Type_n_t_t_t_t_t_t_t_t_t_t_t_t_t_tFROM_FileOp_n________________________________________________________LEFT_JOIN_FileExtra_ON_FileOp.Extra_ID__FileExtra.RID_n________________________________________________________LEFT_JOIN_MD5Signature_ON_FileExtra.MD5_ID__MD5Signature.RID_n_t_t_t_t_t_t_t_t_t_t_t_t_t_tWHERE_FileOp.File_ID___File_ID_n_t_t_t_t_t_t_t_t_t_t_t_t_t_t____AND_FileOp.Extra_ID__FileExtra.RID_n_t_t_t_t_t_t_t_t_t_t_t_t_t_tORDER_BY_FileOp.OpenTime_DESC
push eax
mov ecx, esi
mov dword [ebp - 4], 0x1c
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x7c], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT_RenameFileOp.OldFile_ID_________________________________________________________________FROM_RenameFileOp___________________________________________________________________________WHERE_RenameFileOp.FileOp_ID___FileOp_ID
push eax
mov ecx, esi
mov dword [ebp - 4], 0x1d
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x80], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT_oldfile_id__FileOp_id__FileOp.File_ID_as_newfile_id__n_t_t_t_t_t_t_t_t_t_t_tFROM_RenameFileOp__FileOp_n_t_t_t_t_t_t_t_t_t_t_tWHERE_oldfile_id___SourceFile_ID_n_t_t_t_t_t_t_t_t_t_t_tAND_RenameFileOp.FileOp_ID__FileOp.RID_n_t_t_t_t_t_t_t_t_t_t_tAND_FileOp.OpenTime____MinTime_n_t_t_t_t_t_t_t_t_t_t_tAND_FileOp.OpenTime____MaxTime_n_t_t_t_t_t_t_t_t_t_t_tORDER_BY_FileOp.OpenTime_DESC
push eax
mov ecx, esi
mov dword [ebp - 4], 0x1e
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x84], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT_URLs.RID_as_URL_ID__HttpOp.Time___URL_Prefix.Host__URL_Path.Path__URL_ExtraInfo.ExtraInfo__as_URL__HttpOp.Ps_ID__n_t_t_t_t_t_t_t_t_t_t_t_tURL_Prefix.Host_as_Domain__LK_Protocol.Name_as_Protocol__URL_Path.Path_as_UrlPath__n_t_t_t_t_t_t_t_t_t_t_t_tHttpOp.SrcSocket_ID__HttpOp.DstSocket_ID_n_t_t_t_t_t_t_t_t_t_t_tFROM_HttpOp__URLs__URL_Prefix__URL_Path__URL_ExtraInfo__LK_Protocol_n_t_t_t_t_t_t_t_t_t_t_tWHERE_HttpOp.RedirectedURL_ID___RedirectedURL_ID_n_t_t_t_t_t_t_t_t_t_t_tAND_HttpOp.Time____Time_n_t_t_t_t_t_t_t_t_t_t_tAND_URLs.RID__HttpOp.URL_ID_n_t_t_t_t_t_t_t_t_t_t_tAND_URL_Prefix.RID__URLs.Prefix_ID_n_t_t_t_t_t_t_t_t_t_t_tAND_URL_Path.RID__URLs.Path_ID_n_t_t_t_t_t_t_t_t_t_t_tAND_URL_ExtraInfo.RID__URLs.ExtraInfo_ID_n_t_t_t_t_t_t_t_t_t_t_tAND_URL_Prefix.Protocol__LK_Protocol.RID_n_t_t_t_t_t_t_t_t_t_t_tORDER_BY_HttpOp.Time_DESC_LIMIT_1
push eax
mov ecx, esi
mov dword [ebp - 4], 0x1f
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x94], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT_HttpOp.Ps_ID__URLs.RID_as_RefererURL_ID__HttpOp.Time___URL_Prefix.Host__URL_Path.Path__URL_ExtraInfo.ExtraInfo__as_URL__n_t_t_t_t_t_t_t_t_t_t_t_tURL_Prefix.Host_as_Domain__LK_Protocol.Name_as_Protocol__URL_Path.Path_as_UrlPath__n_t_t_t_t_t_t_t_t_t_t_t_tHttpOp.SrcSocket_ID__HttpOp.DstSocket_ID_n_t_t_t_t_t_t_t_t_t_t_tFROM_HttpOp__URLs__URL_Prefix__URL_Path__URL_ExtraInfo__LK_Protocol_n_t_t_t_t_t_t_t_t_t_t_tWHERE_HttpOp.URL_ID___URL_ID_n_t_t_t_t_t_t_t_t_t_t_tAND_HttpOp.Time____Time_n_t_t_t_t_t_t_t_t_t_t_tAND_URLs.RID__HttpOp.RefererURL_ID_n_t_t_t_t_t_t_t_t_t_t_tAND_URL_Prefix.RID__URLs.Prefix_ID_n_t_t_t_t_t_t_t_t_t_t_tAND_URL_Path.RID__URLs.Path_ID_n_t_t_t_t_t_t_t_t_t_t_tAND_URL_ExtraInfo.RID__URLs.ExtraInfo_ID_n_t_t_t_t_t_t_t_t_t_t_tAND_URL_Prefix.Protocol__LK_Protocol.RID_n_t_t_t_t_t_t_t_t_t_t_tORDER_BY_HttpOp.Time_DESC
push eax
mov ecx, esi
mov dword [ebp - 4], 0x20
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x98], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT_RegistryOp.RID__RegistryOp.OpTime__RegistryOp.OpMask__RegistryOp.Key_ID__RegistryOp.Value_ID__LK_RegKeyRoot.Name__RegistryKeys.RegKey_as_Reg_Key__RegistryValues.Value_n_t_t_t_t_t_t_t_t_t_t_t_t_t_tFROM_RegistryOp__RegistryValues__RegistryKeys__LK_RegKeyRoot_n_t_t_t_t_t_t_t_t_t_t_t_t_tWHERE_RegistryOp.Ps_ID___Ps_ID_n_t_t_t_t_t_t_t_t_t_t_t_t_t_tAND_RegistryOp.OpTime____MinTime_n_t_t_t_t_t_t_t_t_t_t_t_t_t_tAND_RegistryOp.Value_ID__RegistryValues.RID_n_t_t_t_t_t_t_t_t_t_t_t_t_t_tAND_RegistryOp.Key_ID__RegistryKeys.RID_n_t_t_t_t_t_t_t_t_t_t_t_t_t_tAND_RegistryKeys.RootKey__LK_RegKeyRoot.RID_n_t_t_t_t_t_t_t_t_t_t_t_t_tORDER_BY_OpTime
mov dword [ebp - 4], 0x21
push eax
mov ecx, esi
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x88], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT___LK_RegKeyRoot.Name__RegistryKeys.RegKey___As_RegKey_____________________________________________________FROM_RegistryKeys__LK_RegKeyRoot________________________________________________________________________________WHERE_RegistryKeys.RID___KeyRID________________________________________________________________________________AND_LK_RegKeyRoot.RID__RegistryKeys.RootKey
push eax
mov ecx, esi
mov dword [ebp - 4], 0x22
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x8c], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT_RegNewData.Data_as_NewData__RegOldData.Data_as_OldData_n_t_t_t_t_t_t_t_t_t_t_t_t_tFROM_RegistryDataChangeOp__RegistryData_as_RegNewData__RegistryData_as_RegOldData_n_t_t_t_t_t_t_t_t_t_t_t_tWHERE_RegistryDataChangeOp.RegOp_ID___RegOp_ID_n_t_t_t_t_t_t_t_t_t_t_t_t_tAND_RegistryDataChangeOp.NewData_ID__RegNewData.RID_n_t_t_t_t_t_t_t_t_t_t_t_t_tAND_RegistryDataChangeOp.OldData_ID__RegOldData.RID
push eax
mov ecx, esi
mov dword [ebp - 4], 0x23
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x90], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT_CodeInjectOp.PsTarget_ID__Ps.PID_AS_TargetPID__Ps.CreationTime_AS_TargetPsCreationTime__Ps.Image_ID_AS_TargetImage_ID___n____________________________________________________________CodeInjectOp.Module_ID__CodeInjectOp.OpType__CodeInjectOp.OpFlag__CodeInjectOp.Time__CodeInjectOp.HookID__CodeInjectClassification.Name_AS_Classification_n________________________________________________________FROM_CodeInjectOp__Ps__CodeInjectClassification_n________________________________________________________WHERE_Ps_ID___Ps_ID_n________________________________________________________AND_CodeInjectOp.Time____MinTime_n________________________________________________________AND_Ps.Ps_RID__CodeInjectOp.PsTarget_ID_n________________________________________________________AND_CodeInjectOp.Classification_ID__CodeInjectClassification.RID_n________________________________________________________ORDER_BY_CodeInjectOp.Time
push eax
mov ecx, esi
mov dword [ebp - 4], 0x24
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0xa0], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT_CodeInjectOp.Time_AS_InjectionTime__CodeInjectOp.OpType__CodeInjectOp.OpFlag__CodeInjectClassification.Name_AS_Classification_n________________________________________________________FROM_CodeInjectOp__CodeInjectClassification_n________________________________________________________WHERE_CodeInjectOp.PsTarget_ID___Ps_ID_n________________________________________________________AND_CodeInjectOp.Classification_ID____0_n_t_t_t_t_t_t_t_t_t_t_t_t_t_tAND_CodeInjectOp.Classification_ID__CodeInjectClassification.RID__n________________________________________________________ORDER_BY_CodeInjectOp.Time
push eax
mov ecx, esi
mov dword [ebp - 4], 0x25
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0xa4], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT_CodeInjectOp.Ps_ID__Ps.CreationTime__CodeInjectOp.Time_AS_InjectionTime__CodeInjectOp.OpType__CodeInjectOp.OpFlag__CodeInjectClassification.Name_AS_Classification_n________________________________________________________FROM_CodeInjectOp__Ps__CodeInjectClassification_n________________________________________________________WHERE_CodeInjectOp.PsTarget_ID___Ps_ID_n________________________________________________________AND_CodeInjectOp.Classification_ID____0_n_t_t_t_t_t_t_t_t_t_t_t_t_t_tAND_CodeInjectOp.Classification_ID__CodeInjectClassification.RID_n_t_t_t_t________________________________________AND_Ps.Ps_RID__CodeInjectOp.Ps_ID_n________________________________________________________ORDER_BY_CodeInjectOp.Time
push eax
mov ecx, esi
mov dword [ebp - 4], 0x26
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0xa8], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT_NamedObjectsOp.Ps_ID__NamedObjects.RID__NamedObjectsOp.Time__NamedObjects.Name__NamedObjectsOp.OpFlag__NamedObjectsOp.OpType__LK_NamedObjectsOp.Name_as_Type_n_t_t_t_t_t_t_t_t_t_t_t_t_t_tFROM_NamedObjects__NamedObjectsOp__LK_NamedObjectsOp_n________________________________________________________WHERE_NamedObjectsOp.Ps_ID___Ps_ID_n________________________________________________________AND_NamedObjectsOp.Time____MinTime_n_t_t_t_t_t_t_t_t_t_t_t_t_t_tAND_NamedObjects.RID__NamedObjectsOp.Objname_ID_n_t_t_t_t_t_t_t_t_t_t_t_t_t_tAND_NamedObjectsOp.OpType__LK_NamedObjectsOp.RID_n_t_t_t_t_t_t_t_t_t_t_t_t_t_tORDER_BY_NamedObjectsOp.Time
push eax
mov ecx, esi
mov dword [ebp - 4], 0x27
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0xac], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT_CredentialsOp.Ps_ID__Trgt.Name_AS_Target__CredOpType.Name_AS_OpType__CredentialsOp.OpFlag_AS_OpFlag__CredentialsOp.Time_AS_Time__n_t_t_t_t_t_t_t_t_t_t_t_t_tFROM_CredentialsOp__LK_CredentialsOpTarget_AS_Trgt__LK_CredentialsOpType_AS_CredOpType_n_t_t_t_t_t_t_t_t_t_t_t_t_tWHERE_CredentialsOp.Ps_ID___Ps_ID_n____________________________________________________AND_CredentialsOp.Time____MinTime_n_t_t_t_t_t_t_t_t_t_t_t_t_tAND_CredentialsOp.OpTarget__Trgt.RID_n_t_t_t_t_t_t_t_t_t_t_t_t_tAND_CredentialsOp.OpType__CredOpType.RID_n_t_t_t_t_t_t_t_t_t_t_t_t_tORDER_By_CredentialsOp.Time
push eax
mov ecx, esi
mov dword [ebp - 4], 0x28
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0xb4], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT_DnsOp.Ps_ID__DnsOp.Time__DnsOp.DnsRequest__DnsOp.DnsResponse_n_t_t_t_t_t_t_t_t_t_t_t_t_tFROM_DnsOp_n_t_t_t_t_t_t_t_t_t_t_t_t_tWHERE_DnsOp.Ps_ID___Ps_ID_n_t_t_t_t_t_t_t_t_t_t_t_t_tAND_DnsOp.Time____MinTime_n_t_t_t_t_t_t_t_t_t_t_t_t_tORDER_BY_DnsOp.Time
push eax
mov ecx, esi
mov dword [ebp - 4], 0x29
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0xb8], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT_Name__n_t_t_t_t_t_t_t_t_t_t_t_t_tFROM_NamedObjects_NamedObjectsOp___n_t_t_t_t_t_t_t_t_t_t_t_t_tWHERE_NamedObjectsOp.ObjName_ID___ObjName_ID__n_t_t_t_t_t_t_t_t_t_t_t_t_tAND_NamedObjectsOp.OpType__4_n_t_t_t_t_t_t_t_t_t_t_t_t_tAND_NamedObjects.RID__NamedObjectsOp.Objname_ID
push eax
mov ecx, esi
mov dword [ebp - 4], 0x2a
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0xb0], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT_WmiExecutionOp.OpTime__WmiExecutionOp.CreatedProcess_ID___n__________________________________________________________WmiExecutionOp.Attacker_ID__WmiExecutionOp.Victim_ID__n__________________________________________________________WmiExecutionOp.ClientProcessId___n__________________________________________________________WmiExecutionOp.ClientProcessCreationTime__n__________________________________________________________WmiExecutionOp.IsLocal_n____________________________________________________FROM_WmiExecutionOp_n____________________________________________________WHERE_WmiExecutionOp.ClientProcessId___ClientProcessId_n________________________________________________________AND_WmiExecutionOp.ClientProcessCreationTime___ClientProcessCreationTime_n
push eax
mov ecx, esi
mov dword [ebp - 4], 0x2b
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0xbc], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT_WmiExecutionOp.OpTime__WmiExecutionOp.CreatedProcess_ID___n__________________________________________________________WmiExecutionOp.Attacker_ID__WmiExecutionOp.Victim_ID__n__________________________________________________________WmiExecutionOp.ClientProcessId___n__________________________________________________________WmiExecutionOp.ClientProcessCreationTime__n__________________________________________________________WmiExecutionOp.IsLocal_n____________________________________________________FROM_WmiExecutionOp_n____________________________________________________WHERE_WmiExecutionOp.CreatedProcess_ID___CreatedProcess_ID_n____________________________________________________ORDER_BY_OpTime_n_t_t_t_t_t_t_t_t_t_t_t_t_tLIMIT_1_n
push eax
mov ecx, esi
mov dword [ebp - 4], 0x2c
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0xc0], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str._n_t_t_t_t_t_t_t_t_t_t_tSELECT_ExtensionOp.RID_as_RID__n_t_t_t_t_t_t_t_t_t_t_t_t___ExtensionOp.Ps_ID_as_Ps_ID__n_t_t_t_t_t_t_t_t_t_t_t_t___ExtensionOp.OpTime_as_OpTime__n_t_t_t_t_t_t_t_t_t_t_t_t___ExtensionOp.URL_ID_as_URL_ID__n_t_t_t_t_t_t_t_t_t_t_t_t___ExtensionOp.Referrer_ID_as_Referrer_ID__n_t_t_t_t_t_t_t_t_t_t_t_t___ExtensionOp.DownloadedFileName_as_DownloadedFileName_n_t_t_t_t_t_t_t_t_t_t_tFROM_ExtensionOp_n_t_t_t_t_t_t_t_t_t_t_tWHERE_ExtensionOp.DownloadedFileMD5___FileHash_n_t_t_t_t_t_t_t_t_t_t_tLIMIT_1_n_t_t_t_t_t_t_t_t_t_t
push eax
mov ecx, esi
mov dword [ebp - 4], 0x2d
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0xd0], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str._n_t_t_t_t_t_tSELECT__n_t_t_t_t_t_t_tRemoteMachineInfo.MachineName_as_SourceMachineName__n_t_t_t_t_t_t_tSourceSocketAddr.IpAddress_AS_SourceIpAddress__n_t_t_t_t_t_t_tSourceSocketAddr.Port_AS_SourcePort__n_t_t_t_t_t_t_tOwners.Name_AS_FullUserName__n_t_t_t_t_t_t_tLK_RemoteExecutionType.Description_AS_RemoteExecutionTypeDescription_n_t_t_t_t_t_tFROM_RemoteExecutionOp_n_t_t_t_t_t_tJOIN_RemoteMachineInfo_ON_RemoteExecutionOp.SourceMachine_ID__RemoteMachineInfo.RID_n_t_t_t_t_t_tJOIN_LogonIds_ON_RemoteExecutionOp.LogonId_ID__LogonIds.RID_n_t_t_t_t_t_tJOIN_SockAddr_AS_SourceSocketAddr_ON_RemoteExecutionOp.SourceSocket_ID__SourceSocketAddr.RID_n_t_t_t_t_t_tJOIN_Owners_ON_LogonIds.Owner_ID__Owners.RID_n_t_t_t_t_t_tJOIN_LK_RemoteExecutionType_ON_RemoteExecutionOp.RemoteExecutionType__LK_RemoteExecutionType.Value_n_t_t_t_t_t_tWHERE__n_t_t_t_t_t_t_tRemoteExecutionOp.Ps_ID___Ps_ID_n_t_t_t_t_t_tLIMIT_1_n_t_t_t_t_t_t_t_t_t
push eax
mov ecx, esi
mov dword [ebp - 4], 0x2e
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0xc4], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT_Files.RID_as_FilesRID__FileOp.OpenTime_as_OpTime_n_t_t_t_t_t_t_t_t_t_t_tFROM_Files__FileOp__n_t_t_t_t_t_t_t_t_t_t_tWHERE_FileOp.File_ID__Files.RID__n_t_t_t_t_t_t_t_t_t_t_tAND__FileOp.OpenTime_BETWEEN__MinTime_AND__MaxTime__n_t_t_t_t_t_t_t_t_t_t_tAND_FileOp.Ps_ID___Ps_RID__n_t_t_t_t_t_t_t_t_t_t_tAND_Files.Name___FileName_n_t_t_t_t_t_t_t_t_t_t_tAND__FileOp.OpMask___AnyReadOp__n_t_t_t_t_t_t_t_t_t_t_tORDER_BY_FileOp.OpenTime_DESC
push eax
mov ecx, esi
mov dword [ebp - 4], 0x2f
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x17c], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT_Directories.Name_as_Dir__Files.Name____________________________________________FROM_Files__Directories_____________________________________________________________WHERE_Files.RID___FileRID__________________________________________________________AND_Directories.RID__Files.Dir_ID
push eax
mov ecx, esi
mov dword [ebp - 4], 0x30
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0xd4], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT__URL_Prefix.Host__URL_Path.Path__URL_ExtraInfo.ExtraInfo__as_URL________________________________________________LK_Protocol.Name_as_Protocol__URL_Prefix.Port___________________________________________________________________FROM_URLs__URL_Prefix__URL_Path__URL_ExtraInfo__LK_Protocol_________________________________________________________WHERE_URLs.RID___URLRID____________________________________________________________________________________________AND_URL_Prefix.RID__URLs.Prefix_ID_________________________________________________________________________________AND_URL_Path.RID__URLs.Path_ID_____________________________________________________________________________________AND_URL_ExtraInfo.RID__URLs.ExtraInfo_ID___________________________________________________________________________AND_LK_Protocol.RID__URL_Prefix.Protocol
push eax
mov ecx, esi
mov dword [ebp - 4], 0x31
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0xd8], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT_RenameFileOp.OldFile_ID__FileOp.OpenTime__FileOp.Ps_ID______________________________________________FROM_FileOp__RenameFileOp_______________________________________________________________________________WHERE_FileOp.File_ID___File_ID_________________________________________________________________________AND_FileOp.OpenTime____Time_____________________________________________________________________________AND_FileOp.OpMask___FileRename_________________________________________________________________________AND_RenameFileOp.FileOp_ID__FileOp.RID_________________________________________________________________ORDER_BY_FileOp.OpenTime_DESC_LIMIT_1
push eax
mov ecx, esi
mov dword [ebp - 4], 0x32
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0xdc], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT_BootTime____________________________________________________________________________FROM_Reboots____________________________________________________________________________WHERE_BootTime_BETWEEN__timeBegin_AND__timeEnd__________________________________________ORDER_BY_BootTime_DESC
push eax
mov ecx, esi
mov dword [ebp - 4], 0x33
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0xe0], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str._n_t_t_t_t_t_t_t_t_t_t_t_tSELECT_LogonOp.OpTime_AS_LogonTime___n_t_t_t_t_t_t_t_t_t_t_t_t_t_t__Owners.Name_As_UserName___n_t_t_t_t_t_t_t_t_t_t_t_t_t_t__LogonIds.Owner_ID_AS_OwnerRID__n_t_t_t_t_t_t_t_t_t_t_t_t_t______Owners.SID_AS_SID__n_t_t_t_t_t_t_t_t_t_t_t_t_t______RemoteMachineInfo.IpAddress_AS_IpAddress__n__________________________________________________________RemoteMachineInfo.MachineName_AS_MachineName__n_t_t_t_t_t_t_t_t_t_t_t_t_t______LogonOp.IsRemote_AS_Remote_n_t_t_t_t_t_t_t_t_t_t_t_tFROM_LogonOp__LogonIds__Owners__RemoteMachineInfo_n_t_t_t_t_t_t_t_t_t_t_t_tWHERE__n_t_t_t_t_t_t_t_t_t_t_t_t_LogonOp.LogonType__0_OR_n_t_t_t_t_t_t_t_t_t_t_t_t_LogonOp.LogonType__2_OR__n_t_t_t_t_t_t_t_t_t_t_t_____LogonOp.LogonType__7_OR_n_t_t_t_t_t_t_t_t_t_t_t_t_LogonOp.LogonType__10_OR_n_t_t_t_t_t_t_t_t_t_t_t_t_LogonOp.LogonType__11__n_t_t_t_t_t_t_t_t_t_t_t_tAND_LogonOp.EventId__4624_n_t_t_t_t_t_t_t_t_t_t_t_tAND_Owners.SID___S_1_5_32_544_n_t_t_t_t_t_t_t_t_t_t_t_tAND_LogonOp.OpTime____RootTime_n_t_t_t_t_t_t_t_t_t_t_t____AND_LogonOp.LogonId_ID__LogonIds.RID_n________________________________________________AND_LogonIds.Owner_ID__Owners.RID_n_t_t_t_t_t_t_t_t_t_t_t____AND_LogonOp.RemoteMachine_ID__RemoteMachineInfo.RID_n_t_t_t_t_t_t_t_t_t_t_t_tORDER_By_LogonTime_desc_n_t_t_t_t_t_t_t_t_t_t_t_tLIMIT_1
push eax
mov ecx, esi
mov dword [ebp - 4], 0x34
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0xe4], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT_RemoteMachineInfo.MachineName_AS_MachineName__RemoteMachineInfo.IpAddress_AS_IpAddress__LogonOp.OpTime_AS_OpTime__LogonOp.LogonType_AS_LogonType_n_t_t_t_t_t_t_t_t_t_t_t_tFROM_LogonOp__RemoteMachineInfo__LogonIds_n_t_t_t_t_t_t_t_t_t_t_t_tWHERE_LogonOp.RemoteMachine_ID__RemoteMachineInfo.RID_n_t_t_t_t_t_t_t_t_t_t_t_tAND_LogonOp.EventId__4624_n_t_t_t_t_t_t_t_t_t_t_t_tAND__LogonOp.LogonType__7_OR_LogonOp.LogonType__10__n_t_t_t_t_t_t_t_t_t_t_t_tAND_LogonOp.LogonId_ID__LogonIds.RID_n_t_t_t_t_t_t_t_t_t_t_t_tAND_LogonIds.Owner_ID___OwnerID_n_t_t_t_t_t_t_t_t_t_t_t_tAND_LogonOp.OpTime____LogonTime_n_t_t_t_t_t_t_t_t_t_t_t_tAND_LogonOp.IsRemote__1_n_t_t_t_t_t_t_t_t_t_t_t_tORDER_by_OpTime_desc_n_t_t_t_t_t_t_t_t_t_t_t_tLIMIT_1
push eax
mov ecx, esi
mov dword [ebp - 4], 0x35
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0xe8], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT_IpAddress__Port______________________________________________________________FROM_SockAddr____________________________________________________________________WHERE_SockAddr.RID___SockRID
push eax
mov ecx, esi
mov dword [ebp - 4], 0x36
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0xf4], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT_Name__Description_______________________________________________________________________FROM_LK_IANAProtocol________________________________________________________________________WHERE_LK_IANAProtocol.RID___IANAProtocolID
push eax
mov ecx, esi
mov dword [ebp - 4], 0x37
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x114], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT_SockAddr.RID_AS_SA_RID___________________________________________________________________________________________FROM_SocketOp_JOIN_SockAddr_ON_SocketOp.DstSocket_ID__SockAddr.RID_____________________________________________________WHERE_SocketOp.CreationTime____Time_______________________________________________________________________________________AND_SockAddr.IpAddress___IPAddress__________________________________________________________________________________ORDER_BY_SocketOp.CreationTime_DESC
push eax
mov ecx, esi
mov dword [ebp - 4], 0x38
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0xfc], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT_SockAddr.RID_AS_SA_RID_FROM_SockAddr_WHERE_SockAddr.IpAddress___IPAddress_AND_SockAddr.Port___Port
push eax
mov ecx, esi
mov dword [ebp - 4], 0x39
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x100], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT_DISTINCT_SocketOp.Ps_ID_AS_Ps_ID__SocketOp.CreationTime_AS_Time__FROM_SocketOp_______________________________________________WHERE_SocketOp.DstSocket_ID___Sock_Addr_RID________________________________________________________________AND_SocketOp.CreationTime____Time____________________________________________________________________ORDER_BY_SocketOp.CreationTime_DESC
push eax
mov ecx, esi
mov dword [ebp - 4], 0x3a
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x104], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT_Ps.Ps_RID_AS_Ps_RID__Ps.CreationTime_AS_CreationTime_____________________________________________________FROM_Ps_JOIN_MD5Signature_ON_Ps.ImageSig_ID__MD5Signature.RID___________________________________________WHERE_MD5Signature.MD5___MD5_________________________________________________AND_Ps.CreationTime____Time____________________________________________ORDER_BY_CreationTime_DESC
push eax
mov ecx, esi
mov dword [ebp - 4], 0x3b
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x108], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str._SELECT_Ps.Ps_RID_AS_Ps_RID__Ps.CreationTime_AS_CreationTime_n____________________________________________________FROM_Ps__Files__Directories_t_n____________________________________________________WHERE_Ps.PID___PID_n_t_t_t________________________________________AND_Ps.CreationTime___CreationTime_n
mov dword [ebp - 4], 0x3c
push eax
mov ecx, esi
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x10c], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT_Ps.Ps_RID_as_PsRID__Ps.CreationTime_as_CreationTime__Ps.Args_as_Arguments_n____________________________________________________FROM_Ps_n____________________________________________________WHERE_Ps.Args_LIKE__PsArgs_AND_Ps.CreationTime____PsMinimalTime
push eax
mov ecx, esi
mov dword [ebp - 4], 0x3d
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0xc8], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT_Amsi.Hash_AS_Hash__Amsi.Source_AS_Source_n____________________________________________________FROM_Amsi_t_n____________________________________________________WHERE_Amsi.Ps_RID___Ps_RID_ORDER_BY_OpTime_ASC_n
push eax
mov ecx, esi
mov dword [ebp - 4], 0x3e
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0xcc], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT_Ps.PID_AS_PID__Ps.CreationTime_AS_CreationTime_From_Ps_t_t_t_t_t_t_t_t_t_t_t_tJOIN_Files_On_Ps.Image_ID__Files.RID_t_t_t_t_t_t_t_t_t_t_t_tWHERE_Files.Name___PsName_t_t_t_t_t_t_t_t_t_t_t_t_t_t_tAND_Ps.CreationTime____Time_t_t_t_t_t_t_t_t_t_t_t_t_t_tAND_Ps.TerminationTime__0
push eax
mov ecx, esi
mov dword [ebp - 4], 0x3f
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x11c], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT_MAX_Reboots.BootTime__AS_LastBoot_FROM_Reboots
push eax
mov ecx, esi
mov dword [ebp - 4], 0x40
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x120], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT_Ps.PID_AS_PID__Ps.CreationTime_AS_CreationTime__Ps.Args_as_Args_n_t_t_t_t_t_t_t_t_t_t_t_tFrom_Ps__Files_n_t_t_t_t_t_t_t_t_t_t_t_tWHERE_Ps.Image_ID__Files.RID_n_t_t_t_t_t_t_t_t_t_t_t_tAND_Files.Name___PsName
push eax
mov ecx, esi
mov dword [ebp - 4], 0x41
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x124], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT_Name_FROM_Owners_WHERE_SID_SID
push eax
mov ecx, esi
mov dword [ebp - 4], 0x42
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x128], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT_RegistryOp.RID_AS_RegRID__RegKey_FROM_RegistryKeys__RegistryOp_t_t_t_t_t_t_t_t_t_t_tWHERE_RegistryOp.Key_ID__RegistryKeys.RID_t_t_t_t_t_t_t_t_t_t_t_t_t_tAND_RegistryOp.Ps_ID___ps_id_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_tAND_RegistryOp.OpMask___op__t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_tAND_RegKey_like__key_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_tAND_OpTime____startTime
push eax
mov ecx, esi
mov dword [ebp - 4], 0x43
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x12c], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT_RegistryData.Data_AS_OldValue_FROM_RegistryData_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_tJOIN_RegistryDataChangeOp_ON_RegistryData.RID__RegistryDataChangeOp.OldData_ID_t_t_t_t_t_t_t_t_t_t_t_tWHERE_RegistryDataChangeOp.RegOp_ID___op_id
push eax
mov ecx, esi
mov dword [ebp - 4], 0x44
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x130], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT_Description_FROM_LK_CertificateDescription_WHERE_RID___RID
push eax
mov ecx, esi
mov dword [ebp - 4], 0x45
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x134], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str._n____________________________________________________SELECT_RemoteMachineInfo.IpAddress_AS_IpAddress__RemoteMachineInfo.MachineName_AS_MachineName_n____________________________________________________FROM_RemoteMachineInfo_n____________________________________________________WHERE_RemoteMachineInfo.RID___Machine_RID_n
push eax
mov ecx, esi
mov dword [ebp - 4], 0x46
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x13c], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT__Directories.Name__Files.Name__AS_TargetFullPath__LnkFileOp.TargetFile_ID_AS_TargetFileRID__LnkFileOp.Args_AS_LnkFileArgs_t_t_t_t_t_t_t_t_t_tFROM_LnkFileOp_t_t_t_t_t_t_________________________________________________________t_t____________________________JOIN_Files__t_t____ON_LnkFileOp.TargetFile_ID__Files.RID______________________________________________________________________JOIN_Directories_tON_Files.Dir_ID__Directories.RID___________________________________________________________________________WHERE_LnkFileOp.LnkFile_ID___FileRID_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_tORDER_BY_LnkFileOp.RID
push eax
mov ecx, esi
mov dword [ebp - 4], 0x47
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x140], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT_LnkFileOp.RID_AS_RID__LnkFileOp.LnkFile_ID_as_LnkFile_ID_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_tFROM_LnkFileOp_t_t_t_t_t_t____________________________________________________________________________________________WHERE_LnkFileOp.TargetFile_ID___TargetRID_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_tAND_LnkFileOp.Args___Args_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_tORDER_BY_LnkFileOp.RID_DESC
push eax
mov ecx, esi
mov dword [ebp - 4], 0x48
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x144], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT_FileSize_n_t_t_t_t_t_t_t_t_t_t_t_t_tFROM_FileOp_n_t_t_t_t_t_t_t_t_t_t_t_t_tWHERE_FileOp.File_ID___FileRID_n_t_t_t_t_t_t_t_t_t_t_t_t_tAND_FileOp.OpenTime____MaxTime__n_t_t_t_t_t_t_t_t_t_t_t_t_tORDER_BY_OpenTime_desc
push eax
mov ecx, esi
mov dword [ebp - 4], 0x49
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x148], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT_COUNT_RID__as_OpCount__n_t_t_t_t_t_t_t_t_t_t_t_t_tFROM_FileOp_n_t_t_t_t_t_t_t_t_t_t_t_t_tWHERE_FileOp.Ps_ID___Ps_ID_n_t_t_t_t_t_t_t_t_t_t_t_t_tAND_FileOp.OpenTime____MinTime
push eax
mov ecx, esi
mov dword [ebp - 4], 0x4a
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x14c], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT_COUNT_RegistryOp.RID__as_OpCount_n_t_t_t_t_t_t_t_t_t_t_t_t_tFROM_RegistryOp_n_t_t_t_t_t_t_t_t_t_t_t_t_tWHERE_RegistryOp.Ps_ID___Ps_ID_n_t_t_t_t_t_t_t_t_t_t_t_t_t_tAND_RegistryOp.OpTime____MinTime
push eax
mov ecx, esi
mov dword [ebp - 4], 0x4b
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x150], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT_COUNT_HttpOp.RID__as_OpCount_n_t_t_t_t_t_t_t_t_t_t_t_t_t_tFROM_HttpOp_n_t_t_t_t_t_t_t_t_t_t_t_t_t_tWHERE_HttpOp.Ps_ID___Ps_ID_t_t_t_t_t_t_t_t_t_________________________________n________________________________________________________AND_HttpOp.Time____MinTime
push eax
mov ecx, esi
mov dword [ebp - 4], 0x4c
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x154], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT_COUNT_RID__as_OpCount_n________________________________________________FROM_SocketOp_n________________________________________________WHERE_SocketOp.Ps_ID___Ps_ID_n________________________________________________AND_SocketOp.OpTime____MinTime
push eax
mov ecx, esi
mov dword [ebp - 4], 0x4d
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
push 0xc
mov dword [edi + 0x158], eax
call fcn.005b1b6c
add esp, 4
mov dword [ebp + 8], eax
push str.SELECT_COUNT_RID__as_OpCount_n_t_t_t_t_t_t_t_t_t_t_t_t_tFROM_DnsOp_n_t_t_t_t_t_t_t_t_t_t_t_t_tWHERE_DnsOp.Ps_ID___Ps_ID_n_t_t_t_t_t_t_t_t_t_t_t_t_tAND_DnsOp.Time____MinTime
push eax
mov ecx, esi
mov dword [ebp - 4], 0x4e
call fcn.0059bb88
mov dword [ebp - 4], 0xffffffff
lea ecx, [edi + 0x160]
push esi
mov dword [edi + 0x15c], eax
call fcn.00453840
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4