Function at 0x431365
Capabilities:
Get token membership
Reference sql statements

Disassembly:
push 0x74
mov eax, 0x4b10a8
call fcn.0046afbc
mov edi, ecx
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x5c]
mov esi, dword [ebp + 8]
push str.EvaluateCondition...:
mov dword [ebp - 0x64], eax
call fcn.00402829
and dword [ebp - 4], 0
lea edx, [ebp - 0x5c]
push 0
push esi
push 2
pop ebx
mov ecx, ebx
call fcn.00413940
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
mov ecx, dword [ebp - 0x5c]
lea ecx, [ecx - 0x10]
call fcn.00402e64
push str.SELECT__FROM__Conditions__WHERE__Condition_
lea ecx, [ebp - 0x7c]
call fcn.00402829
xor eax, eax
lea ecx, [ebp - 0x7c]
inc eax
mov dword [ebp - 4], eax
mov eax, dword [esi]
push dword [eax - 0xc]
push eax
call fcn.004025c6
push 0x4f0134
lea ecx, [ebp - 0x7c]
call fcn.0040259d
and dword [ebp - 0x6c], 0
push 3
pop eax
mov byte [ebp - 4], al
lea eax, [ebp - 0x78]
and dword [ebp - 0x78], 0
push eax
push dword [ebp - 0x7c]
push dword [edi + 4]
call dword [sym.imp.msi.dll_MsiEnumClientsA]
xor edi, edi
test eax, eax
jne 0x4318c7
push edi
push dword [ebp - 0x78]
call dword [sym.imp.msi.dll_MsiViewModify]
test eax, eax
jne 0x4318c7
cmp dword [ebp - 0x6c], edi
je 0x431424
push dword [ebp - 0x6c]
call dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x6c], edi
push eax
push dword [ebp - 0x78]
call dword [sym.imp.msi.dll_MsiDatabaseIsTablePersistentA]
test eax, eax
jne 0x4318c7
call fcn.00451171
push eax
lea ecx, [ebp - 0x60]
call fcn.00402899
push 4
pop eax
mov byte [ebp - 4], al
call fcn.00451171
push eax
lea ecx, [ebp - 0x68]
call fcn.00402899
lea eax, [ebp - 0x60]
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x6c]
mov edx, ebx
push eax
call fcn.004464ad
mov esi, dword [ebp - 0x60]
mov ebx, eax
pop ecx
test ebx, ebx
je 0x43149d
push str.MGRS_Type_
lea ecx, [ebp - 0x5c]
call fcn.00402829
mov byte [ebp - 4], 6
xor ecx, ecx
lea edx, [ebp - 0x5c]
push ebx
inc ecx
call fcn.00414122
pop ecx
jmp 0x4318a7
cmp dword [esi - 0xc], 0
jne 0x4314b9
push str.Empty_Type
lea ecx, [ebp - 0x5c]
call fcn.00402829
mov byte [ebp - 4], 7
push 0xd
pop ebx
jmp 0x43148b
mov ecx, dword [ebp - 0x6c]
lea eax, [ebp - 0x68]
push eax
push 3
pop edx
call fcn.004464ad
mov ebx, eax
pop ecx
test ebx, ebx
je 0x4314e2
push str.MGRS_sKey_
lea ecx, [ebp - 0x5c]
call fcn.00402829
mov byte [ebp - 4], 8
jmp 0x43148b
mov eax, dword [ebp - 0x68]
cmp dword [eax - 0xc], 0
jne 0x4314fe
push str.Empty_Key
lea ecx, [ebp - 0x5c]
call fcn.00402829
mov byte [ebp - 4], 9
jmp 0x4314b4
push str.PATCH_GUID
lea ecx, [ebp - 0x60]
call fcn.00409edf
test eax, eax
jne 0x431521
mov edx, dword [ebp - 0x64]
lea eax, [ebp - 0x68]
push edx
push eax
call fcn.004320bd
jmp 0x4316a2
push str.ARM_ELEVATED
lea ecx, [ebp - 0x60]
call fcn.00409edf
test eax, eax
jne 0x431579
lea eax, [ebp - 0x80]
mov dword [0x5140e0], 0x284
push eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x5c], edi
push eax
push edi
push 0x1a
mov dword [ebp - 0x80], 0x44
call dword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
je 0x43156e
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x58]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x431574
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [ebp - 0x5c]
jmp 0x431599
push 0x4f1df8
lea ecx, [ebp - 0x60]
call fcn.00409edf
test eax, eax
jne 0x4315a0
mov eax, dword [0x518e34]
mov dword [0x5140e0], 0x286
mov edx, dword [ebp - 0x64]
mov dword [edx], eax
jmp 0x4315f4
push str.USER_ADMIN
lea ecx, [ebp - 0x60]
call fcn.00409edf
test eax, eax
jne 0x4315fb
mov edx, dword [ebp - 0x64]
mov eax, dword [0x518e28]
mov dword [0x5140e0], 0x282
mov dword [edx], eax
cmp eax, edi
je 0x4315f4
push str.Condition_met
lea ecx, [ebp - 0x5c]
call fcn.00402829
push edi
push 2
pop ebx
lea edx, [ebp - 0x5c]
mov byte [ebp - 4], 0xa
mov ecx, ebx
call fcn.00414071
pop ecx
mov ecx, dword [ebp - 0x5c]
lea ecx, [ecx - 0x10]
call fcn.00402e64
mov ebx, edi
jmp 0x4318b2
push str.MODE
lea ecx, [ebp - 0x60]
call fcn.00409edf
test eax, eax
jne 0x431684
mov eax, dword [0x518e50]
xor edi, edi
push 4
pop edx
cmp eax, edx
mov dword [0x5140e0], 0x272
push 2
cmove edi, edx
pop ebx
cmp eax, ebx
push 3
pop ecx
push dword [ebp - 0x68]
cmove edi, ecx
cmp eax, ecx
cmove edi, ebx
xor ecx, ecx
inc ecx
cmp eax, ecx
cmove edi, ecx
call fcn.0048b68c
mov edx, dword [ebp - 0x64]
pop ecx
xor ecx, ecx
cmp eax, edi
sete cl
mov dword [edx], ecx
jne 0x43167d
push str.Condition_met
lea ecx, [ebp - 0x5c]
call fcn.00402829
push 0
lea edx, [ebp - 0x5c]
mov byte [ebp - 4], 0xb
mov ecx, ebx
call fcn.00414071
pop ecx
mov ecx, dword [ebp - 0x5c]
lea ecx, [ecx - 0x10]
call fcn.00402e64
xor ebx, ebx
jmp 0x4318b2
push str.TRANSFORMED
lea ecx, [ebp - 0x60]
call fcn.00409edf
test eax, eax
jne 0x4316a9
mov edx, dword [ebp - 0x64]
lea eax, [ebp - 0x68]
push edx
push eax
call fcn.0043296c
mov ebx, eax
jmp 0x4318b2
call fcn.00451171
push eax
lea ecx, [ebp - 0x5c]
call fcn.00402899
mov byte [ebp - 4], 0xc
call fcn.00451171
push eax
lea ecx, [ebp - 0x74]
call fcn.00402899
push 0xd
pop ebx
mov byte [ebp - 4], bl
call fcn.00451171
push eax
lea ecx, [ebp - 0x70]
call fcn.00402899
lea eax, [ebp - 0x5c]
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0x6c]
push eax
push 4
pop edx
call fcn.004464ad
mov edi, eax
pop ecx
test edi, edi
je 0x431727
push str.MGRS_sName_
lea ecx, [ebp - 0x64]
call fcn.00402829
xor ecx, ecx
mov byte [ebp - 4], 0xf
push edi
lea edx, [ebp - 0x64]
inc ecx
call fcn.00414122
pop ecx
mov ecx, dword [ebp - 0x64]
lea ecx, [ecx - 0x10]
call fcn.00402e64
mov ebx, edi
jmp 0x431891
mov ecx, dword [ebp - 0x6c]
lea eax, [ebp - 0x74]
push eax
push 5
pop edx
call fcn.004464ad
pop ecx
mov ecx, dword [ebp - 0x6c]
lea eax, [ebp - 0x70]
push eax
push 6
pop edx
call fcn.004464ad
lea ecx, [ebp - 0x60]
mov dword [esp], str.FILE
call fcn.00409edf
test eax, eax
jne 0x431777
mov edx, dword [ebp - 0x64]
lea eax, [ebp - 0x70]
push edx
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x68]
push eax
call fcn.00431d32
jmp 0x43188f
push str.REG_STR
lea ecx, [ebp - 0x60]
call fcn.00409edf
test eax, eax
je 0x431872
push str.REG_DWORD
lea ecx, [ebp - 0x60]
call fcn.00409edf
test eax, eax
je 0x431872
push 0x4f1ea0
lea ecx, [ebp - 0x60]
call fcn.00409edf
test eax, eax
jne 0x4317d0
mov edx, dword [ebp - 0x64]
lea eax, [ebp - 0x70]
push edx
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x68]
push eax
call fcn.004318fc
jmp 0x43188f
push str.MSI_PRODUCT
lea ecx, [ebp - 0x60]
call fcn.00409edf
test eax, eax
jne 0x4317ff
mov edx, dword [ebp - 0x64]
lea eax, [ebp - 0x70]
push edx
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x68]
push eax
call fcn.0043238d
jmp 0x43188f
push str.DATE
lea ecx, [ebp - 0x60]
call fcn.00409edf
test eax, eax
jne 0x431823
mov edx, dword [ebp - 0x64]
lea eax, [ebp - 0x70]
push edx
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.004325da
jmp 0x43188f
push str.PLUGINS_COUNT
lea ecx, [ebp - 0x60]
call fcn.00409edf
test eax, eax
jne 0x431847
mov edx, dword [ebp - 0x64]
lea eax, [ebp - 0x5c]
push edx
push eax
lea eax, [ebp - 0x68]
push eax
call fcn.0043275c
jmp 0x43188f
push str.Not_supported_condition_type_in_Manifest
lea ecx, [ebp - 0x80]
call fcn.00402829
xor ecx, ecx
mov byte [ebp - 4], 0x10
push ebx
lea edx, [ebp - 0x80]
inc ecx
call fcn.00414122
pop ecx
mov ecx, dword [ebp - 0x80]
lea ecx, [ecx - 0x10]
call fcn.00402e64
jmp 0x431891
mov edx, dword [ebp - 0x64]
lea eax, [ebp - 0x70]
push edx
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.00431993
mov ebx, eax
mov ecx, dword [ebp - 0x70]
lea ecx, [ecx - 0x10]
call fcn.00402e64
mov ecx, dword [ebp - 0x74]
lea ecx, [ecx - 0x10]
call fcn.00402e64
mov ecx, dword [ebp - 0x5c]
lea ecx, [ecx - 0x10]
call fcn.00402e64
mov ecx, dword [ebp - 0x68]
lea ecx, [ecx - 0x10]
call fcn.00402e64
lea ecx, [esi - 0x10]
call fcn.00402e64
jmp 0x4318c9
mov ebx, edi
cmp dword [ebp - 0x6c], 0
je 0x4318d8
push dword [ebp - 0x6c]
call dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
cmp dword [ebp - 0x78], 0
je 0x4318e7
push dword [ebp - 0x78]
call dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
mov ecx, dword [ebp - 0x7c]
add ecx, 0xfffffff0
call fcn.00402e64
mov eax, ebx
call fcn.0046af66
ret 8