Function at 0x4016d0
Capabilities:
Check os version
Create a process with modified i/o handles and window
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x403f38
mov eax, dword fs:[0]
push eax
sub esp, 0x3b0
mov eax, dword [0x407004]
xor eax, esp
mov dword [esp + 0x3ac], eax
push ebx
push esi
push edi
mov eax, dword [0x407004]
xor eax, esp
push eax
lea eax, [esp + 0x3c0]
mov dword fs:[0], eax
lea eax, [esp + 0xa0]
push eax
xor edi, edi
mov dword [esp + 0xa4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0xa4], 5
jne 0x40173d
cmp dword [esp + 0xa8], edi
jne 0x40173d
mov edi, 1
push 0x1000
push 0
push str..KDT_.cpp_257_:_Windows_Version:_d._d._d
call sub.MSVCR80.dll_memset
mov esi, dword [sym.imp.MSVCR80.dll_swprintf_s]
push str.Windows_Version:_d._d._d
push 0x101
push 0x40533c
push str._s__d_:__s
push 0x1000
push str..KDT_.cpp_257_:_Windows_Version:_d._d._d
call esi
mov ecx, dword [esp + 0xd0]
mov edx, dword [esp + 0xcc]
mov eax, dword [esp + 0xc8]
push ecx
push edx
push eax
push str..KDT_.cpp_257_:_Windows_Version:_d._d._d
mov ecx, 3
mov ebx, 0x4093b0
call fcn.00403090
add esp, 0x34
test edi, edi
je 0x4017ea
push 0x1000
push 0
push str..KDT_.cpp_257_:_Windows_Version:_d._d._d
call sub.MSVCR80.dll_memset
push str.Find_Windows_2000
push 0x109
push 0x40533c
push str._s__d_:__s
push 0x1000
push str..KDT_.cpp_257_:_Windows_Version:_d._d._d
call esi
push str..KDT_.cpp_257_:_Windows_Version:_d._d._d
mov ecx, 3
call fcn.00403090
add esp, 0x28
call fcn.004029f0
xor ebx, ebx
cmp eax, ebx
je 0x4019a7
push eax
push ebx
push 0x2000000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
lea ecx, [esp + 0x10]
push ecx
push 0x201eb
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4019ef
lea esi, [esp + 0x1b4]
call fcn.004014c0
push str.XTService.exe
mov edx, esi
push 0x104
push edx
call dword [sym.imp.MSVCR80.dll_wcscat_s]
add esp, 0xc
mov eax, esi
push eax
lea ecx, [esp + 0x6c]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
push ebx
push 0x405438
lea ecx, [esp + 0x70]
mov dword [esp + 0x3d0], ebx
call dword [sym.imp.MSVCP80.dll_public:_unsigned_int___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::find_first_of_wchar_t_const___unsigned_int_const]
mov ecx, dword [sym.imp.MSVCP80.dll_unsigned_int_const_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::npos]
cmp eax, dword [ecx]
je 0x4018d3
push 0x40543c
lea ecx, [esp + 0x88]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
lea edx, [esp + 0x68]
push edx
lea ecx, [esp + 0x88]
mov byte [esp + 0x3cc], 1
call dword [0x405100]
push 0x40543c
lea ecx, [esp + 0x88]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
lea eax, [esp + 0x84]
push eax
lea ecx, [esp + 0x6c]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
lea ecx, [esp + 0x84]
mov byte [esp + 0x3c8], bl
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
push 0x405440
lea ecx, [esp + 0x6c]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
push 0x44
lea ecx, [esp + 0x28]
push ebx
push ecx
call sub.MSVCR80.dll_memset
xor eax, eax
add esp, 0xc
push ebx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov word [esp + 0x58], 5
mov dword [esp + 0x30], str.Winsta0Default
mov dword [esp + 0x28], 0x44
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [esp + 0x80], 8
mov eax, dword [esp + 0x6c]
jae 0x401934
lea eax, [esp + 0x6c]
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x28]
push ecx
push ebx
push ebx
push 8
push ebx
push ebx
push ebx
push eax
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x40196b
push eax
call edi
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x401976
push eax
call edi
cmp esi, 0x522
jne 0x401983
call fcn.004015e0
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [esp + 0x68]
mov dword [esp + 0x3c8], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
xor eax, eax
jmp 0x4019f2
push 0x1000
push ebx
push str..KDT_.cpp_257_:_Windows_Version:_d._d._d
call sub.MSVCR80.dll_memset
push str.GetExplorerLogonPid:_d
push 0x144
push 0x40533c
push str._s__d_:__s
push 0x1000
push str..KDT_.cpp_257_:_Windows_Version:_d._d._d
call esi
push ebx
push str..KDT_.cpp_257_:_Windows_Version:_d._d._d
mov ecx, 3
mov ebx, 0x4093b0
call fcn.00403090
add esp, 0x2c
or eax, 0xffffffff
mov ecx, dword [esp + 0x3c0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3ac]
xor ecx, esp
call fcn.0040342c
add esp, 0x3bc
ret