Function at 0x6513d29a
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x1d8
mov eax, dword [0x6516c6d0]
xor eax, esp
mov dword [esp + 0x1d4], eax
push esi
push 0x90
lea eax, [esp + 0x48]
push 0
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
lea ecx, [esp + 0x40]
push ecx
mov dword [esp + 0x44], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x44], 6
mov esi, 0x6515db58
jge 0x6513d0ed
mov esi, 0x6515db60
lea edx, [esp + 0xd4]
push edx
push 0x6515db68
call fcn.65140210
add esp, 8
test al, al
je 0x6513d362
lea eax, [esp + 0xd4]
push eax
call fcn.651401f0
add esp, 4
test al, al
je 0x6513d362
mov eax, dword [esp + 0x1e0]
cmp eax, 6
ja case.default.0x6513d132
jmp dword [eax*4 + 0x6513d37c]
push 5
push 0
push str._FROM_QQ__TAB_HOME__ACT_NONE
lea ecx, [esp + 0xe0]
push ecx
push esi
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov al, 1
pop esi
mov ecx, dword [esp + 0x1d4]
xor ecx, esp
call fcn.6514af96
add esp, 0x1d8
ret
push 5
push 0
push str._FROM_QQ__TAB_VUL__ACT_START
lea edx, [esp + 0xe0]
push edx
push esi
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov al, 1
pop esi
mov ecx, dword [esp + 0x1d4]
xor ecx, esp
call fcn.6514af96
add esp, 0x1d8
ret
push 5
push 0
push str._FROM_QQ__TAB_TROJAN__ACT_START
lea eax, [esp + 0xe0]
push eax
push esi
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov al, 1
pop esi
mov ecx, dword [esp + 0x1d4]
xor ecx, esp
call fcn.6514af96
add esp, 0x1d8
ret
lea ecx, [esp + 0xd4]
push ecx
push 0x6515dbd4
call fcn.65140210
add esp, 8
test al, al
je 0x6513d362
push 0xd
push 0x6515dbe0
lea edx, [esp + 0xdc]
push 0x104
push edx
call dword [sym.imp.MSVCR80.dll_strncat_s]
lea eax, [esp + 0xe4]
push eax
call fcn.651401f0
add esp, 0x14
test al, al
je 0x6513d362
push 0x38
lea ecx, [esp + 0xc]
push 0
push ecx
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [esp + 4]
lea edx, [esp + 0xd4]
push eax
mov dword [esp + 8], 0x3c
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], 0x6515dbf0
mov dword [esp + 0x24], 1
mov dword [esp + 0xc], 0x40
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov eax, dword [esp + 0x3c]
push 0x1f4
push eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop esi
mov ecx, dword [esp + 0x1d4]
xor ecx, esp
call fcn.6514af96
add esp, 0x1d8
ret
push 5
push 0
push str._FROM_QQ__TAB_RTP__ACT_START
lea ecx, [esp + 0xe0]
push ecx
push esi
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov al, 1
pop esi
mov ecx, dword [esp + 0x1d4]
xor ecx, esp
call fcn.6514af96
add esp, 0x1d8
ret
push 5
push 0
push str.parentQQ2010
lea edx, [esp + 0xe0]
push edx
push esi
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov al, 1
pop esi
mov ecx, dword [esp + 0x1d4]
xor ecx, esp
call fcn.6514af96
add esp, 0x1d8
ret
push 5
push 0
push str.parentQQ2010pageupgrade
lea eax, [esp + 0xe0]
push eax
push esi
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov al, 1
pop esi
mov ecx, dword [esp + 0x1d4]
xor ecx, esp
call fcn.6514af96
add esp, 0x1d8
ret
push 5
push 0
push str._FROM_QQ
lea ecx, [esp + 0xe0]
push ecx
push esi
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov al, 1
pop esi
mov ecx, dword [esp + 0x1d4]
xor ecx, esp
call fcn.6514af96
add esp, 0x1d8
ret
mov ecx, dword [esp + 0x1d8]
pop esi
xor ecx, esp
xor al, al
call fcn.6514af96
add esp, 0x1d8
ret