Function at 0x4309f5
Capabilities:
Get token membership
Reference sql statements

Disassembly:
push 0x74
mov eax, 0x4aef28
call fcn.00468fdc
mov edi, ecx
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x5c]
mov esi, dword [ebp + 8]
push str.EvaluateCondition...:
mov dword [ebp - 0x64], eax
call fcn.00402829
and dword [ebp - 4], 0
lea edx, [ebp - 0x5c]
push 0
push esi
push 2
pop ebx
mov ecx, ebx
call fcn.004130a0
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
mov ecx, dword [ebp - 0x5c]
lea ecx, [ecx - 0x10]
call fcn.00402e64
push str.SELECT__FROM__Conditions__WHERE__Condition_
lea ecx, [ebp - 0x7c]
call fcn.00402829
xor eax, eax
lea ecx, [ebp - 0x7c]
inc eax
mov dword [ebp - 4], eax
mov eax, dword [esi]
push dword [eax - 0xc]
push eax
call fcn.004025c6
push 0x4ec9dc
lea ecx, [ebp - 0x7c]
call fcn.0040259d
and dword [ebp - 0x6c], 0
push 3
pop eax
mov byte [ebp - 4], al
lea eax, [ebp - 0x78]
and dword [ebp - 0x78], 0
push eax
push dword [ebp - 0x7c]
push dword [edi + 4]
call dword [sym.imp.msi.dll_MsiEnumClientsA]
xor edi, edi
test eax, eax
jne 0x430f57
push edi
push dword [ebp - 0x78]
call dword [sym.imp.msi.dll_MsiViewModify]
test eax, eax
jne 0x430f57
cmp dword [ebp - 0x6c], edi
je 0x430ab4
push dword [ebp - 0x6c]
call dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x6c], edi
push eax
push dword [ebp - 0x78]
call dword [sym.imp.msi.dll_MsiDatabaseIsTablePersistentA]
test eax, eax
jne 0x430f57
call fcn.0044f181
push eax
lea ecx, [ebp - 0x60]
call fcn.00402899
push 4
pop eax
mov byte [ebp - 4], al
call fcn.0044f181
push eax
lea ecx, [ebp - 0x68]
call fcn.00402899
lea eax, [ebp - 0x60]
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x6c]
mov edx, ebx
push eax
call fcn.00445ab6
mov esi, dword [ebp - 0x60]
mov ebx, eax
pop ecx
test ebx, ebx
je 0x430b2d
push str.MGRS_Type_
lea ecx, [ebp - 0x5c]
call fcn.00402829
mov byte [ebp - 4], 6
xor ecx, ecx
lea edx, [ebp - 0x5c]
push ebx
inc ecx
call fcn.00413882
pop ecx
jmp 0x430f37
cmp dword [esi - 0xc], 0
jne 0x430b49
push str.Empty_Type
lea ecx, [ebp - 0x5c]
call fcn.00402829
mov byte [ebp - 4], 7
push 0xd
pop ebx
jmp 0x430b1b
mov ecx, dword [ebp - 0x6c]
lea eax, [ebp - 0x68]
push eax
push 3
pop edx
call fcn.00445ab6
mov ebx, eax
pop ecx
test ebx, ebx
je 0x430b72
push str.MGRS_sKey_
lea ecx, [ebp - 0x5c]
call fcn.00402829
mov byte [ebp - 4], 8
jmp 0x430b1b
mov eax, dword [ebp - 0x68]
cmp dword [eax - 0xc], 0
jne 0x430b8e
push str.Empty_Key
lea ecx, [ebp - 0x5c]
call fcn.00402829
mov byte [ebp - 4], 9
jmp 0x430b44
push str.PATCH_GUID
lea ecx, [ebp - 0x60]
call fcn.0040969f
test eax, eax
jne 0x430bb1
mov edx, dword [ebp - 0x64]
lea eax, [ebp - 0x68]
push edx
push eax
call fcn.0043174d
jmp 0x430d32
push str.ARM_ELEVATED
lea ecx, [ebp - 0x60]
call fcn.0040969f
test eax, eax
jne 0x430c09
lea eax, [ebp - 0x80]
mov dword [0x5100e0], 0x284
push eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x5c], edi
push eax
push edi
push 0x1a
mov dword [ebp - 0x80], 0x44
call dword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
je 0x430bfe
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x58]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x430c04
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [ebp - 0x5c]
jmp 0x430c29
push 0x4ee6a0
lea ecx, [ebp - 0x60]
call fcn.0040969f
test eax, eax
jne 0x430c30
mov eax, dword [0x514e34]
mov dword [0x5100e0], 0x286
mov edx, dword [ebp - 0x64]
mov dword [edx], eax
jmp 0x430c84
push str.USER_ADMIN
lea ecx, [ebp - 0x60]
call fcn.0040969f
test eax, eax
jne 0x430c8b
mov edx, dword [ebp - 0x64]
mov eax, dword [0x514e28]
mov dword [0x5100e0], 0x282
mov dword [edx], eax
cmp eax, edi
je 0x430c84
push str.Condition_met
lea ecx, [ebp - 0x5c]
call fcn.00402829
push edi
push 2
pop ebx
lea edx, [ebp - 0x5c]
mov byte [ebp - 4], 0xa
mov ecx, ebx
call fcn.004137d1
pop ecx
mov ecx, dword [ebp - 0x5c]
lea ecx, [ecx - 0x10]
call fcn.00402e64
mov ebx, edi
jmp 0x430f42
push str.MODE
lea ecx, [ebp - 0x60]
call fcn.0040969f
test eax, eax
jne 0x430d14
mov eax, dword [0x514e50]
xor edi, edi
push 4
pop edx
cmp eax, edx
mov dword [0x5100e0], 0x272
push 2
cmove edi, edx
pop ebx
cmp eax, ebx
push 3
pop ecx
push dword [ebp - 0x68]
cmove edi, ecx
cmp eax, ecx
cmove edi, ebx
xor ecx, ecx
inc ecx
cmp eax, ecx
cmove edi, ecx
call fcn.004896ac
mov edx, dword [ebp - 0x64]
pop ecx
xor ecx, ecx
cmp eax, edi
sete cl
mov dword [edx], ecx
jne 0x430d0d
push str.Condition_met
lea ecx, [ebp - 0x5c]
call fcn.00402829
push 0
lea edx, [ebp - 0x5c]
mov byte [ebp - 4], 0xb
mov ecx, ebx
call fcn.004137d1
pop ecx
mov ecx, dword [ebp - 0x5c]
lea ecx, [ecx - 0x10]
call fcn.00402e64
xor ebx, ebx
jmp 0x430f42
push str.TRANSFORMED
lea ecx, [ebp - 0x60]
call fcn.0040969f
test eax, eax
jne 0x430d39
mov edx, dword [ebp - 0x64]
lea eax, [ebp - 0x68]
push edx
push eax
call fcn.00431ffc
mov ebx, eax
jmp 0x430f42
call fcn.0044f181
push eax
lea ecx, [ebp - 0x5c]
call fcn.00402899
mov byte [ebp - 4], 0xc
call fcn.0044f181
push eax
lea ecx, [ebp - 0x74]
call fcn.00402899
push 0xd
pop ebx
mov byte [ebp - 4], bl
call fcn.0044f181
push eax
lea ecx, [ebp - 0x70]
call fcn.00402899
lea eax, [ebp - 0x5c]
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0x6c]
push eax
push 4
pop edx
call fcn.00445ab6
mov edi, eax
pop ecx
test edi, edi
je 0x430db7
push str.MGRS_sName_
lea ecx, [ebp - 0x64]
call fcn.00402829
xor ecx, ecx
mov byte [ebp - 4], 0xf
push edi
lea edx, [ebp - 0x64]
inc ecx
call fcn.00413882
pop ecx
mov ecx, dword [ebp - 0x64]
lea ecx, [ecx - 0x10]
call fcn.00402e64
mov ebx, edi
jmp 0x430f21
mov ecx, dword [ebp - 0x6c]
lea eax, [ebp - 0x74]
push eax
push 5
pop edx
call fcn.00445ab6
pop ecx
mov ecx, dword [ebp - 0x6c]
lea eax, [ebp - 0x70]
push eax
push 6
pop edx
call fcn.00445ab6
lea ecx, [ebp - 0x60]
mov dword [esp], str.FILE
call fcn.0040969f
test eax, eax
jne 0x430e07
mov edx, dword [ebp - 0x64]
lea eax, [ebp - 0x70]
push edx
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x68]
push eax
call fcn.004313c2
jmp 0x430f1f
push str.REG_STR
lea ecx, [ebp - 0x60]
call fcn.0040969f
test eax, eax
je 0x430f02
push str.REG_DWORD
lea ecx, [ebp - 0x60]
call fcn.0040969f
test eax, eax
je 0x430f02
push 0x4ee748
lea ecx, [ebp - 0x60]
call fcn.0040969f
test eax, eax
jne 0x430e60
mov edx, dword [ebp - 0x64]
lea eax, [ebp - 0x70]
push edx
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x68]
push eax
call fcn.00430f8c
jmp 0x430f1f
push str.MSI_PRODUCT
lea ecx, [ebp - 0x60]
call fcn.0040969f
test eax, eax
jne 0x430e8f
mov edx, dword [ebp - 0x64]
lea eax, [ebp - 0x70]
push edx
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x68]
push eax
call fcn.00431a1d
jmp 0x430f1f
push str.DATE
lea ecx, [ebp - 0x60]
call fcn.0040969f
test eax, eax
jne 0x430eb3
mov edx, dword [ebp - 0x64]
lea eax, [ebp - 0x70]
push edx
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.00431c6a
jmp 0x430f1f
push str.PLUGINS_COUNT
lea ecx, [ebp - 0x60]
call fcn.0040969f
test eax, eax
jne 0x430ed7
mov edx, dword [ebp - 0x64]
lea eax, [ebp - 0x5c]
push edx
push eax
lea eax, [ebp - 0x68]
push eax
call fcn.00431dec
jmp 0x430f1f
push str.Not_supported_condition_type_in_Manifest
lea ecx, [ebp - 0x80]
call fcn.00402829
xor ecx, ecx
mov byte [ebp - 4], 0x10
push ebx
lea edx, [ebp - 0x80]
inc ecx
call fcn.00413882
pop ecx
mov ecx, dword [ebp - 0x80]
lea ecx, [ecx - 0x10]
call fcn.00402e64
jmp 0x430f21
mov edx, dword [ebp - 0x64]
lea eax, [ebp - 0x70]
push edx
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.00431023
mov ebx, eax
mov ecx, dword [ebp - 0x70]
lea ecx, [ecx - 0x10]
call fcn.00402e64
mov ecx, dword [ebp - 0x74]
lea ecx, [ecx - 0x10]
call fcn.00402e64
mov ecx, dword [ebp - 0x5c]
lea ecx, [ecx - 0x10]
call fcn.00402e64
mov ecx, dword [ebp - 0x68]
lea ecx, [ecx - 0x10]
call fcn.00402e64
lea ecx, [esi - 0x10]
call fcn.00402e64
jmp 0x430f59
mov ebx, edi
cmp dword [ebp - 0x6c], 0
je 0x430f68
push dword [ebp - 0x6c]
call dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
cmp dword [ebp - 0x78], 0
je 0x430f77
push dword [ebp - 0x78]
call dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
mov ecx, dword [ebp - 0x7c]
add ecx, 0xfffffff0
call fcn.00402e64
mov eax, ebx
call fcn.00468f86
ret 8