Function at 0x4489a0
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70c
mov eax, dword [0x48602c]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x70c], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x428], 0
xor eax, eax
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x478], 0
push 0x40
push 0
lea ecx, [ebp - 0x474]
push ecx
call sub.MSVCR80.dll_memset
add esp, 0xc
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0x414], 0xffffffff
mov dword [ebp - 0x418], 0xffffffff
mov dword [ebp - 4], 1
mov word [ebp - 0x680], 0
push 0x206
push 0
lea edx, [ebp - 0x67e]
push edx
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x200
lea eax, [ebp - 0x680]
push eax
push 0
call fcn.0044ecf0
add esp, 0xc
mov word [ebp - 0x410], 0
push 0x3fe
push 0
lea ecx, [ebp - 0x40e]
push ecx
call sub.MSVCR80.dll_memset
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x70c]
add eax, 0x1334
push eax
lea ecx, [ebp - 0x680]
push ecx
push str._s_sqlcmd_sSqlBackup.exe__s
lea edx, [ebp - 0x410]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
lea eax, [ebp - 0x410]
push eax
push str.exec:_s
call fcn.00448130
add esp, 8
call fcn.0044fef0
test eax, eax
je 0x448ce0
call fcn.0044ffb0
test eax, eax
je 0x448ce0
mov dword [ebp - 0x698], 0
mov dword [ebp - 0x688], 0
mov dword [ebp - 0x6a4], 0
xor ecx, ecx
mov dword [ebp - 0x6a0], ecx
mov dword [ebp - 0x69c], ecx
mov dword [ebp - 0x694], 0
xor edx, edx
mov dword [ebp - 0x690], edx
mov dword [ebp - 0x68c], edx
mov dword [ebp - 0x684], 0
push 0x473d94
call fcn.0044fd00
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x448b4b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetCurrentProcess_Fial:_d
call fcn.00448130
add esp, 8
jmp 0x448e05
lea eax, [ebp - 0x414]
push eax
push 0xf01ff
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x448b7e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x473de4
call fcn.00448130
add esp, 8
jmp 0x448e05
lea edx, [ebp - 0x698]
push edx
push 4
lea eax, [ebp - 0x688]
push eax
push 0x13
mov ecx, dword [ebp - 0x414]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x448bba
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetTokenInformation_Fial:_d
call fcn.00448130
add esp, 8
jmp 0x448e05
mov edx, dword [ebp - 0x688]
mov dword [ebp - 0x418], edx
push 0
mov eax, dword [ebp - 0x418]
push eax
lea ecx, [ebp - 0x684]
push ecx
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
jne 0x448bf8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateEnvironmentBlock_Fial:_d
call fcn.00448130
add esp, 8
jmp 0x448e05
mov dword [ebp - 0x6a4], 0xc
mov dword [ebp - 0x694], 0xc
mov dword [ebp - 0x478], 0x44
mov dword [ebp - 0x470], 0x473e90
mov dword [ebp - 0x44c], 0x41
mov word [ebp - 0x448], 0
lea edx, [ebp - 0x428]
push edx
lea eax, [ebp - 0x478]
push eax
push 0
mov ecx, dword [ebp - 0x684]
push ecx
push 0x400
push 0
lea edx, [ebp - 0x694]
push edx
lea eax, [ebp - 0x6a4]
push eax
lea ecx, [ebp - 0x410]
push ecx
push 0
mov edx, dword [ebp - 0x418]
push edx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov dword [ebp - 0x42c], eax
cmp dword [ebp - 0x42c], 0
jne 0x448c9d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenProcessToken_Fial:_d
call fcn.00448130
add esp, 8
jmp 0x448e05
mov eax, dword [ebp - 0x684]
push eax
call sub.USERENV.dll_DestroyEnvironmentBlock
test eax, eax
jne 0x448cc6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.DestroyEnvironmentBlock_Fial:_d
call fcn.00448130
add esp, 8
jmp 0x448e05
push 0x10
lea ecx, [ebp - 0x428]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call sub.MSVCR80.dll_memcpy
add esp, 0xc
jmp 0x448dfd
mov dword [ebp - 0x6c0], 0
xor eax, eax
mov dword [ebp - 0x6bc], eax
mov dword [ebp - 0x6b8], eax
mov dword [ebp - 0x6b4], 0
xor ecx, ecx
mov dword [ebp - 0x6b0], ecx
mov dword [ebp - 0x6ac], ecx
mov dword [ebp - 0x6a8], ecx
mov dword [ebp - 0x708], 0
push 0x40
push 0
lea edx, [ebp - 0x704]
push edx
call sub.MSVCR80.dll_memset
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x414]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.WTSAPI32.dll_WTSQueryUserToken
mov edx, dword [ebp - 4]
push edx
push str.SessionId:__d
call fcn.00448130
add esp, 8
mov dword [ebp - 0x6c0], 0xc
lea eax, [ebp - 0x418]
push eax
push 1
push 2
lea ecx, [ebp - 0x6c0]
push ecx
push 0x2000000
mov edx, dword [ebp - 0x414]
push edx
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov dword [ebp - 0x708], 0x44
mov dword [ebp - 0x700], 0x473f44
mov dword [ebp - 0x6dc], 0x41
mov word [ebp - 0x6d8], 0
lea eax, [ebp - 0x6b4]
push eax
lea ecx, [ebp - 0x708]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x410]
push edx
push 0
mov eax, dword [ebp - 0x418]
push eax
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov dword [ebp - 0x42c], eax
push 0x10
lea ecx, [ebp - 0x6b4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call sub.MSVCR80.dll_memcpy
add esp, 0xc
xor eax, eax
jne 0x448ab4
cmp dword [ebp - 0x418], 0xffffffff
je 0x448e1b
mov ecx, dword [ebp - 0x418]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x414], 0xffffffff
je 0x448e31
mov edx, dword [ebp - 0x414]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 8], 0xffffffff
je 0x448e41
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x42c]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0043ad38
mov esp, ebp
pop ebp
ret 8