Function at 0x4277a0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x564
mov eax, dword [0x4c506c]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.00421970
cmp eax, 1
jg 0x4277f6
mov ecx, dword [ebp + 0x10]
call fcn.00404610
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00404610
push eax
mov ecx, dword [ebp + 8]
call fcn.00404610
push eax
push str.kill_process_in__s__except_exe:_s__except_path:_s.
push 1
push 0x4bc50c
push 0x11a
push 0x4bc528
call fcn.00421d50
add esp, 0x20
mov ecx, dword [ebp + 8]
call fcn.004056c0
movzx eax, al
test eax, eax
je 0x42780a
jmp 0x427a28
push 0x104
push 0
lea ecx, [ebp - 0x108]
push ecx
call fcn.00477ee0
add esp, 0xc
mov ecx, dword [ebp + 8]
call fcn.00404610
push eax
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCanonicalizeA]
push 0x104
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.00477ee0
add esp, 0xc
mov ecx, dword [ebp + 0x10]
call fcn.00404610
push eax
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathCanonicalizeA]
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x55c], eax
cmp dword [ebp - 0x55c], 0xffffffff
jne 0x427880
jmp 0x427a28
push 0x128
push 0
lea edx, [ebp - 0x558]
push edx
call fcn.00477ee0
add esp, 0xc
mov dword [ebp - 0x558], 0x128
lea eax, [ebp - 0x558]
push eax
mov ecx, dword [ebp - 0x55c]
push ecx
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
jne 0x4278ca
mov edx, dword [ebp - 0x55c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x427a28
mov eax, dword [ebp - 0x550]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x564], eax
cmp dword [ebp - 0x564], 0xffffffff
jne 0x4278ed
jmp 0x4279ff
mov dword [ebp - 0x430], 0x224
lea ecx, [ebp - 0x430]
push ecx
mov edx, dword [ebp - 0x564]
push edx
call dword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x4279f2
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x310]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x4279f2
mov ecx, dword [ebp + 0xc]
call fcn.004056c0
movzx edx, al
test edx, edx
jne 0x42795c
mov ecx, dword [ebp + 0xc]
call fcn.00404610
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x4279f2
mov ecx, dword [ebp + 0x10]
call fcn.004056c0
movzx ecx, al
test ecx, ecx
jne 0x427983
lea edx, [ebp - 0x20c]
push edx
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x4279f2
mov ecx, dword [ebp - 0x550]
push ecx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x560], eax
cmp dword [ebp - 0x560], 0
je 0x4279f2
push 0
mov edx, dword [ebp - 0x560]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x4279e5
call fcn.00421970
cmp eax, 3
jg 0x4279e5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Terminate_Process_Failed.__d
push 3
push str.TeminateAllProcessInPath
push 0x145
push 0x4bc594
call fcn.00421d50
add esp, 0x18
mov eax, dword [ebp - 0x560]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x564]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [ebp - 0x558]
push edx
mov eax, dword [ebp - 0x55c]
push eax
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x4278ca
mov ecx, dword [ebp - 0x55c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00475c6f
mov esp, ebp
pop ebp
ret