Function at 0x432135
Capabilities:
Get token membership
Reference sql statements

Disassembly:
push 0x74
mov eax, 0x4b2798
call fcn.0046c44c
mov edi, ecx
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x5c]
mov esi, dword [ebp + 8]
push str.EvaluateCondition...:
mov dword [ebp - 0x64], eax
call fcn.00402829
and dword [ebp - 4], 0
lea edx, [ebp - 0x5c]
push 0
push esi
push 2
pop ebx
mov ecx, ebx
call fcn.00414600
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
mov ecx, dword [ebp - 0x5c]
lea ecx, [ecx - 0x10]
call fcn.00402e64
push str.SELECT__FROM__Conditions__WHERE__Condition_
lea ecx, [ebp - 0x7c]
call fcn.00402829
xor eax, eax
lea ecx, [ebp - 0x7c]
inc eax
mov dword [ebp - 4], eax
mov eax, dword [esi]
push dword [eax - 0xc]
push eax
call fcn.004025c6
push 0x4f1c74
lea ecx, [ebp - 0x7c]
call fcn.0040259d
and dword [ebp - 0x6c], 0
push 3
pop eax
mov byte [ebp - 4], al
lea eax, [ebp - 0x78]
and dword [ebp - 0x78], 0
push eax
push dword [ebp - 0x7c]
push dword [edi + 4]
call dword [sym.imp.msi.dll_MsiEnumClientsA]
xor edi, edi
test eax, eax
jne 0x432697
push edi
push dword [ebp - 0x78]
call dword [sym.imp.msi.dll_MsiViewModify]
test eax, eax
jne 0x432697
cmp dword [ebp - 0x6c], edi
je 0x4321f4
push dword [ebp - 0x6c]
call dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x6c], edi
push eax
push dword [ebp - 0x78]
call dword [sym.imp.msi.dll_MsiDatabaseIsTablePersistentA]
test eax, eax
jne 0x432697
call fcn.00452601
push eax
lea ecx, [ebp - 0x60]
call fcn.00402899
push 4
pop eax
mov byte [ebp - 4], al
call fcn.00452601
push eax
lea ecx, [ebp - 0x68]
call fcn.00402899
lea eax, [ebp - 0x60]
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x6c]
mov edx, ebx
push eax
call fcn.00447843
mov esi, dword [ebp - 0x60]
mov ebx, eax
pop ecx
test ebx, ebx
je 0x43226d
push str.MGRS_Type_
lea ecx, [ebp - 0x5c]
call fcn.00402829
mov byte [ebp - 4], 6
xor ecx, ecx
lea edx, [ebp - 0x5c]
push ebx
inc ecx
call fcn.00414e00
pop ecx
jmp 0x432677
cmp dword [esi - 0xc], 0
jne 0x432289
push str.Empty_Type
lea ecx, [ebp - 0x5c]
call fcn.00402829
mov byte [ebp - 4], 7
push 0xd
pop ebx
jmp 0x43225b
mov ecx, dword [ebp - 0x6c]
lea eax, [ebp - 0x68]
push eax
push 3
pop edx
call fcn.00447843
mov ebx, eax
pop ecx
test ebx, ebx
je 0x4322b2
push str.MGRS_sKey_
lea ecx, [ebp - 0x5c]
call fcn.00402829
mov byte [ebp - 4], 8
jmp 0x43225b
mov eax, dword [ebp - 0x68]
cmp dword [eax - 0xc], 0
jne 0x4322ce
push str.Empty_Key
lea ecx, [ebp - 0x5c]
call fcn.00402829
mov byte [ebp - 4], 9
jmp 0x432284
push str.PATCH_GUID
lea ecx, [ebp - 0x60]
call fcn.0040ac4f
test eax, eax
jne 0x4322f1
mov edx, dword [ebp - 0x64]
lea eax, [ebp - 0x68]
push edx
push eax
call fcn.00432e8d
jmp 0x432472
push str.ARM_ELEVATED
lea ecx, [ebp - 0x60]
call fcn.0040ac4f
test eax, eax
jne 0x432349
lea eax, [ebp - 0x80]
mov dword [0x5160e0], 0x284
push eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x5c], edi
push eax
push edi
push 0x1a
mov dword [ebp - 0x80], 0x44
call dword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
je 0x43233e
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x58]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x432344
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [ebp - 0x5c]
jmp 0x432369
push 0x4f3938
lea ecx, [ebp - 0x60]
call fcn.0040ac4f
test eax, eax
jne 0x432370
mov eax, dword [0x51ae3c]
mov dword [0x5160e0], 0x286
mov edx, dword [ebp - 0x64]
mov dword [edx], eax
jmp 0x4323c4
push str.USER_ADMIN
lea ecx, [ebp - 0x60]
call fcn.0040ac4f
test eax, eax
jne 0x4323cb
mov edx, dword [ebp - 0x64]
mov eax, dword [0x51ae30]
mov dword [0x5160e0], 0x282
mov dword [edx], eax
cmp eax, edi
je 0x4323c4
push str.Condition_met
lea ecx, [ebp - 0x5c]
call fcn.00402829
push edi
push 2
pop ebx
lea edx, [ebp - 0x5c]
mov byte [ebp - 4], 0xa
mov ecx, ebx
call fcn.00414d4f
pop ecx
mov ecx, dword [ebp - 0x5c]
lea ecx, [ecx - 0x10]
call fcn.00402e64
mov ebx, edi
jmp 0x432682
push str.MODE
lea ecx, [ebp - 0x60]
call fcn.0040ac4f
test eax, eax
jne 0x432454
mov eax, dword [0x51ae58]
xor edi, edi
push 4
pop edx
cmp eax, edx
mov dword [0x5160e0], 0x272
push 2
cmove edi, edx
pop ebx
cmp eax, ebx
push 3
pop ecx
push dword [ebp - 0x68]
cmove edi, ecx
cmp eax, ecx
cmove edi, ebx
xor ecx, ecx
inc ecx
cmp eax, ecx
cmove edi, ecx
call fcn.0048cb1c
mov edx, dword [ebp - 0x64]
pop ecx
xor ecx, ecx
cmp eax, edi
sete cl
mov dword [edx], ecx
jne 0x43244d
push str.Condition_met
lea ecx, [ebp - 0x5c]
call fcn.00402829
push 0
lea edx, [ebp - 0x5c]
mov byte [ebp - 4], 0xb
mov ecx, ebx
call fcn.00414d4f
pop ecx
mov ecx, dword [ebp - 0x5c]
lea ecx, [ecx - 0x10]
call fcn.00402e64
xor ebx, ebx
jmp 0x432682
push str.TRANSFORMED
lea ecx, [ebp - 0x60]
call fcn.0040ac4f
test eax, eax
jne 0x432479
mov edx, dword [ebp - 0x64]
lea eax, [ebp - 0x68]
push edx
push eax
call fcn.0043373c
mov ebx, eax
jmp 0x432682
call fcn.00452601
push eax
lea ecx, [ebp - 0x5c]
call fcn.00402899
mov byte [ebp - 4], 0xc
call fcn.00452601
push eax
lea ecx, [ebp - 0x74]
call fcn.00402899
push 0xd
pop ebx
mov byte [ebp - 4], bl
call fcn.00452601
push eax
lea ecx, [ebp - 0x70]
call fcn.00402899
lea eax, [ebp - 0x5c]
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0x6c]
push eax
push 4
pop edx
call fcn.00447843
mov edi, eax
pop ecx
test edi, edi
je 0x4324f7
push str.MGRS_sName_
lea ecx, [ebp - 0x64]
call fcn.00402829
xor ecx, ecx
mov byte [ebp - 4], 0xf
push edi
lea edx, [ebp - 0x64]
inc ecx
call fcn.00414e00
pop ecx
mov ecx, dword [ebp - 0x64]
lea ecx, [ecx - 0x10]
call fcn.00402e64
mov ebx, edi
jmp 0x432661
mov ecx, dword [ebp - 0x6c]
lea eax, [ebp - 0x74]
push eax
push 5
pop edx
call fcn.00447843
pop ecx
mov ecx, dword [ebp - 0x6c]
lea eax, [ebp - 0x70]
push eax
push 6
pop edx
call fcn.00447843
lea ecx, [ebp - 0x60]
mov dword [esp], str.FILE
call fcn.0040ac4f
test eax, eax
jne 0x432547
mov edx, dword [ebp - 0x64]
lea eax, [ebp - 0x70]
push edx
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x68]
push eax
call fcn.00432b02
jmp 0x43265f
push str.REG_STR
lea ecx, [ebp - 0x60]
call fcn.0040ac4f
test eax, eax
je 0x432642
push str.REG_DWORD
lea ecx, [ebp - 0x60]
call fcn.0040ac4f
test eax, eax
je 0x432642
push 0x4f39e0
lea ecx, [ebp - 0x60]
call fcn.0040ac4f
test eax, eax
jne 0x4325a0
mov edx, dword [ebp - 0x64]
lea eax, [ebp - 0x70]
push edx
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x68]
push eax
call fcn.004326cc
jmp 0x43265f
push str.MSI_PRODUCT
lea ecx, [ebp - 0x60]
call fcn.0040ac4f
test eax, eax
jne 0x4325cf
mov edx, dword [ebp - 0x64]
lea eax, [ebp - 0x70]
push edx
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x68]
push eax
call fcn.0043315d
jmp 0x43265f
push str.DATE
lea ecx, [ebp - 0x60]
call fcn.0040ac4f
test eax, eax
jne 0x4325f3
mov edx, dword [ebp - 0x64]
lea eax, [ebp - 0x70]
push edx
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.004333aa
jmp 0x43265f
push str.PLUGINS_COUNT
lea ecx, [ebp - 0x60]
call fcn.0040ac4f
test eax, eax
jne 0x432617
mov edx, dword [ebp - 0x64]
lea eax, [ebp - 0x5c]
push edx
push eax
lea eax, [ebp - 0x68]
push eax
call fcn.0043352c
jmp 0x43265f
push str.Not_supported_condition_type_in_Manifest
lea ecx, [ebp - 0x80]
call fcn.00402829
xor ecx, ecx
mov byte [ebp - 4], 0x10
push ebx
lea edx, [ebp - 0x80]
inc ecx
call fcn.00414e00
pop ecx
mov ecx, dword [ebp - 0x80]
lea ecx, [ecx - 0x10]
call fcn.00402e64
jmp 0x432661
mov edx, dword [ebp - 0x64]
lea eax, [ebp - 0x70]
push edx
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.00432763
mov ebx, eax
mov ecx, dword [ebp - 0x70]
lea ecx, [ecx - 0x10]
call fcn.00402e64
mov ecx, dword [ebp - 0x74]
lea ecx, [ecx - 0x10]
call fcn.00402e64
mov ecx, dword [ebp - 0x5c]
lea ecx, [ecx - 0x10]
call fcn.00402e64
mov ecx, dword [ebp - 0x68]
lea ecx, [ecx - 0x10]
call fcn.00402e64
lea ecx, [esi - 0x10]
call fcn.00402e64
jmp 0x432699
mov ebx, edi
cmp dword [ebp - 0x6c], 0
je 0x4326a8
push dword [ebp - 0x6c]
call dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
cmp dword [ebp - 0x78], 0
je 0x4326b7
push dword [ebp - 0x78]
call dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
mov ecx, dword [ebp - 0x7c]
add ecx, 0xfffffff0
call fcn.00402e64
mov eax, ebx
call fcn.0046c3f6
ret 8