I agree with Jason that your code is the biggest issue here. That being said your indexes are kind of all over the place too. This is a catch all type query and the way you receive code as a parameter and then execute renders your code vulnerable to sql injection. You should probably take a look at Gail's blog post about catch all queries here. http://sqlinthewild.co.za/index.php/2009/03/19/catch-all-queries/[/url]

This could really use some divide and conquer type techniques as well so you don't keep running the same sub query over and over and over. Some properly formatted and parameterized dynamic sql along with liberal usage of some temp tables would help whip this into shape fairly quickly.