Function at 0x40b392
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x2b4
mov eax, dword [0x692dfc]
xor eax, esp
mov dword [esp + 0x2b0], eax
push esi
mov esi, ecx
mov eax, dword [esi + 0x21804]
add eax, 0xfffffffc
push edi
cmp eax, 0xe
ja case.default.0x40afaa
jmp dword [eax*4 + 0x40b3fc]
pop edi
mov dword [esi + 0x2165c], 0x66719c
pop esi
mov ecx, dword [esp + 0x2b0]
xor ecx, esp
call fcn.00591137
add esp, 0x2b4
ret
pop edi
mov dword [esi + 0x2165c], 0x6671bc
pop esi
mov ecx, dword [esp + 0x2b0]
xor ecx, esp
call fcn.00591137
add esp, 0x2b4
ret
mov eax, 0x88888889
mul dword [esi + 0x217fc]
shr edx, 5
inc edx
push edx
lea eax, [esp + 0xbc]
push str.Your_account_has_been_temporarily_frozen_because_of_violation_of_the_Terms_of_Service___Paragraph_2___n_nYou_will_be_able_to_continue_to_use_the_service_in__d_hours
push eax
mov dword [esi + 0x2165c], 0x6671e4
call fcn.00406ab0
add esp, 0xc
push 0x30
push str.Login
lea ecx, [esp + 0xc0]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
mov ecx, dword [esp + 0x2b0]
xor ecx, esp
call fcn.00591137
add esp, 0x2b4
ret
push 0x30
push str.Login
push str.Too_many_failed_login_attempts__your_IP_has_been_blocked_for_one_hour
push 0
mov dword [esi + 0x2165c], 0x6672bc
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
mov ecx, dword [esp + 0x2b0]
xor ecx, esp
call fcn.00591137
add esp, 0x2b4
ret
mov dword [esi + 0x2165c], 0x667320
mov edi, 0x667344
sub edi, 0x1cc9decb
lea esi, [esp + 0x95]
call fcn.0040cf50
push eax
call fcn.00592946
add esp, 4
mov ecx, esi
call fcn.0040c210
push str.shutdown__s__f__t_1
call fcn.00592946
add esp, 4
push 0x10
push 0x66737c
push 0x667384
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
mov ecx, dword [esp + 0x2b0]
xor ecx, esp
call fcn.00591137
add esp, 0x2b4
ret
mov dword [esi + 0x2165c], str.Your_IP_has_been_banned
mov edi, 0x667344
sub edi, 0x1cc9decb
lea esi, [esp + 0x4f]
call fcn.0040cf50
push eax
call fcn.00592946
add esp, 4
mov ecx, esi
call fcn.0040c210
push str.shutdown__s__f__t_1
call fcn.00592946
add esp, 4
push 0x10
push str.Login
push str.Your_IP_has_been_banned_by_IP_Address
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
mov ecx, dword [esp + 0x2b0]
xor ecx, esp
call fcn.00591137
add esp, 0x2b4
ret
mov dword [esi + 0x2165c], str.Your_account_has_been_banned_by_Hardware_ID
mov edi, 0x667344
sub edi, 0x1cc9decb
lea esi, [esp + 9]
call fcn.0040cf50
push eax
call fcn.00592946
add esp, 4
mov ecx, esi
call fcn.0040c210
push str.shutdown__s__f__t_1
call fcn.00592946
add esp, 4
push 0x10
push str.Login
push str.Your_account_has_been_banned_by_HWID_ID
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
mov ecx, dword [esp + 0x2b0]
xor ecx, esp
call fcn.00591137
add esp, 0x2b4
ret
mov dword [esi + 0x2165c], str.Your_Account__Computer_has_been_banned
mov edi, 0x667344
sub edi, 0x1cc9decb
lea esi, [esp + 0x2c]
call fcn.0040cf50
push eax
call fcn.00592946
add esp, 4
mov ecx, esi
call fcn.0040c210
push str.shutdown__s__f__t_1
call fcn.00592946
add esp, 4
push 0x10
push str.Login
push str.Banned:_This_account_has_been_investigated_and_permanently_closed_for_violations_of_the_Terms_of_Use
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
mov ecx, dword [esp + 0x2b0]
xor ecx, esp
call fcn.00591137
add esp, 0x2b4
ret
mov dword [esi + 0x2165c], str.Your_account_has_been_banned_by_Mac_Address
mov edi, 0x667344
sub edi, 0x1cc9decb
lea esi, [esp + 0x72]
call fcn.0040cf50
push eax
call fcn.00592946
add esp, 4
mov ecx, esi
call fcn.0040c210
push str.shutdown__s__f__t_1
call fcn.00592946
add esp, 4
push 0x10
push str.Login
push str.Banned:_Your_account_has_been_banned_by_MAC_Address
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
mov ecx, dword [esp + 0x2b0]
xor ecx, esp
call fcn.00591137
add esp, 0x2b4
ret
push str.shutdown__s__f__t_1
mov dword [esi + 0x2165c], 0x667538
call fcn.00592946
add esp, 4
push 0x10
push str.Login
push str.Banned:_Your_account_has_been_banned_by_Client
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
mov ecx, dword [esp + 0x2b0]
xor ecx, esp
call fcn.00591137
add esp, 0x2b4
ret
pop edi
mov dword [esi + 0x2165c], 0x667590
mov dword [esi + 0x20dec], 4
pop esi
mov ecx, dword [esp + 0x2b0]
xor ecx, esp
call fcn.00591137
add esp, 0x2b4
ret
push 0x30
push str.Account_Deleted
push str.Your_account_was_deleted_because_your_payment_was_refunded_or_cancelled_n_nPlease_contact_your_payment_provider
push 0
mov dword [esi + 0x2165c], 0x6675b8
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
mov ecx, dword [esp + 0x2b0]
xor ecx, esp
call fcn.00591137
add esp, 0x2b4
ret
push 0x30
push str.No_game_ownership_on_Steam
push str.Youve_started_game_under_a_steam_account__but_that_account_does_not_have_The_War_Z_game_ownership
push 0
mov dword [esi + 0x2165c], 0x66608e
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
mov ecx, dword [esp + 0x2b0]
xor ecx, esp
call fcn.00591137
add esp, 0x2b4
ret
push 0x30
push str.Login
push str.Unknown_account_status__please_contact_support_extreme.co.th
push 0
mov dword [esi + 0x2165c], 0x6676cc
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
mov ecx, dword [esp + 0x2b0]
xor ecx, esp
call fcn.00591137
add esp, 0x2b4
ret
push 5
push 0
push 0x66608e
push str.https:__www.facebook.com_groups_3675765382443538
push str.open
push 0
mov dword [esi + 0x2165c], 0x66608e
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
mov dword [esi + 0x20dec], 5
pop esi
mov ecx, dword [esp + 0x2b0]
xor ecx, esp
call fcn.00591137
add esp, 0x2b4
ret
mov ecx, dword [esp + 0x2b8]
pop edi
mov dword [esi + 0x2165c], 0x667170
pop esi
xor ecx, esp
call fcn.00591137
add esp, 0x2b4
ret