Function at 0x4092dc
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
mov eax, dword [ebp + 8]
and byte [ebp - 1], 0
push ebx
push esi
and byte [eax], 0
lea eax, [ebp - 8]
push edi
push eax
mov esi, ecx
xor edi, edi
push 0x43ea7c
push 0x43e270
mov dword [ebp - 0x1c], esi
mov dword [ebp - 8], edi
mov dword [ebp - 0x20], edi
call fcn.00429940
add esp, 0xc
cmp dword [ebp - 8], edi
je 0x409590
push 0x43e254
push 0x444fe0
call fcn.004292ba
pop ecx
cmp eax, edi
pop ecx
mov dword [ebp - 0x14], eax
je 0x409590
push dword [ebp - 8]
call fcn.0042895d
push dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
push dword [ebp - 8]
push 1
push eax
call fcn.0042a4b7
add esp, 0x14
cmp eax, dword [ebp - 8]
jne 0x4093f8
lea eax, [ebp - 0x24]
mov dword [ebp - 0x10], edi
push eax
push str._08lx
push 0x43e304
mov dword [ebp - 0x24], edi
call fcn.00429940
add esp, 0xc
cmp dword [ebp - 8], edi
jle 0x4093f0
mov esi, dword [ebp - 0x18]
push 0x10
pop ebx
push 8
push str.GEBATAD_00307200
push esi
call fcn.0042a690
add esp, 0xc
test eax, eax
jne 0x4093a0
add edi, ebx
add esi, ebx
jmp 0x4093e4
push 8
push str.EMANGIRO360_SANA_ElSalihCamii_DisAvlu_1.exe
push esi
call fcn.0042a690
add esp, 0xc
test eax, eax
jne 0x4093bc
add edi, 0x7f
add esi, 0x7f
jmp 0x4093e4
push 8
push str.BMUSKHC_8e3ae67c
push esi
call fcn.0042a690
add esp, 0xc
test eax, eax
je 0x40939a
mov al, byte [esi]
mov ecx, edi
and ecx, 3
and eax, 0xff
shl ecx, 3
shl eax, cl
xor dword [ebp - 0x10], eax
inc edi
inc esi
cmp edi, dword [ebp - 8]
jl 0x409386
mov esi, dword [ebp - 0x1c]
xor edi, edi
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x24]
je 0x4093fc
mov byte [ebp - 1], 1
push dword [ebp - 0x18]
call fcn.00428730
cmp byte [ebp - 1], 0
pop ecx
jne 0x40952c
push dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], edi
push 1
push 4
push eax
call fcn.0042a4b7
add esp, 0x10
cmp eax, 1
jne 0x409587
mov eax, dword [ebp - 0x10]
cmp eax, 1
jl 0x409587
cmp eax, 0x3e8
jg 0x409587
shl eax, 2
push eax
call fcn.0042895d
push dword [ebp - 0x14]
mov ebx, eax
mov dword [ebp - 0x18], ebx
push dword [ebp - 0x10]
push 4
push ebx
call fcn.0042a4b7
add esp, 0x14
cmp eax, dword [ebp - 0x10]
je 0x409472
mov byte [ebp - 1], 1
jmp 0x40950d
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
imul eax, eax, 0x108
and byte [ebp - 9], 0
cmp dword [ebp - 0x10], edi
lea eax, [ecx + eax + 4]
mov dword [ebp - 8], eax
jle 0x40950d
mov esi, 0x104
push dword [ebp - 0x14]
lea eax, [ebp - 0x150]
push 1
push esi
push eax
call fcn.0042a4b7
add esp, 0x10
cmp eax, 1
jne 0x409504
xor eax, eax
xor byte [ebp + eax - 0x150], 0x55
inc eax
cmp eax, esi
jl 0x4094af
cmp byte [ebp - 9], 0
jne 0x4094f4
lea eax, [ebp - 0x150]
push str..360
push eax
call fcn.0042a100
pop ecx
test eax, eax
pop ecx
je 0x4094f4
lea eax, [ebp - 0x150]
push eax
push dword [ebp + 8]
call fcn.00429850
mov eax, dword [ebp - 8]
pop ecx
pop ecx
mov dword [ebp - 0x20], eax
mov byte [ebp - 9], 1
mov eax, dword [ebx]
add ebx, 4
add dword [ebp - 8], eax
inc edi
cmp edi, dword [ebp - 0x10]
jl 0x409493
jmp 0x409508
mov byte [ebp - 1], 1
mov esi, dword [ebp - 0x1c]
xor edi, edi
push 2
push edi
push dword [ebp - 0x14]
call fcn.0042a5ce
add esp, 0xc
test eax, eax
je 0x409523
mov byte [ebp - 1], 1
push dword [ebp - 0x18]
call fcn.00428730
pop ecx
mov eax, dword [esi + 0x2a24]
push 1
mov dword [ebp - 0x44], eax
mov ax, word [esi + 0x42]
pop ebx
xor ecx, ecx
cmp ax, bx
mov dword [ebp - 0x4c], 0x28
sete cl
cmp byte [ebp - 1], 0
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x3c], 0x43e6e8
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], ecx
jne 0x4095b8
push dword [ebp - 0x14]
call fcn.004296cc
cmp eax, dword [ebp - 8]
pop ecx
jge 0x40959e
cmp word [esi + 0x42], bx
jne 0x409595
mov dword [ebp - 0x40], 0x43ea24
jmp 0x4095cb
push dword [ebp - 0x14]
call fcn.004290d3
pop ecx
or eax, 0xffffffff
jmp 0x4095fb
mov dword [ebp - 0x40], str.HATALI_DOSYA_BOYUTU__nDosyan
jmp 0x4095cb
jle 0x4095ef
cmp word [esi + 0x42], bx
jne 0x4095af
mov dword [ebp - 0x40], 0x43e974
jmp 0x4095cb
mov dword [ebp - 0x40], str.HATALI_DOSYA_BOYUTU__nDosya_olmas
jmp 0x4095cb
cmp ax, bx
mov dword [ebp - 0x40], 0x43e8ec
je 0x4095cb
mov dword [ebp - 0x40], str.HATALI_DOSYA__n_nERROR_IN_FILE_
mov ecx, esi
call fcn.0040cc06
push edi
push dword [esi + 0x2f18]
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_MessageBoxIndirectA]
push ebx
call fcn.0042ab9c
push dword [ebp - 0x14]
call fcn.004290d3
mov eax, dword [ebp - 0x20]
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4