Function at 0x4bfa4b
Capabilities:
Access peb ldr_data
Get process heap flags
Resolve function by parsing pe exports
Terminate process

Disassembly:
sub esp, 0x18
mov edx, dword fs:[0x30]
mov eax, dword [edx + 0xc]
add eax, 0xc
mov eax, dword [eax]
cmp dword [eax + 0x30], 0
je 0x4bfa5b
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov ebp, dword [0x523324]
mov edx, dword [edx + 0xc]
add edx, 0xc
mov edx, dword [edx]
mov ebx, dword [edx + 0x30]
test ebx, ebx
je 0x4bfa75
test ebp, ebp
je 0x4bfabe
movzx eax, word [ebx]
xor ecx, ecx
test eax, eax
je 0x4bfaae
xor eax, eax
movzx edi, word [ebx + eax*2]
cmp edi, 0x41
jl 0x4bfaa0
cmp edi, 0x5a
lea esi, [edi + 0x20]
jg 0x4bfaa0
mov edi, esi
inc eax
movzx esi, di
add ecx, esi
movzx edi, word [ebx + eax*2]
test edi, edi
jne 0x4bfa8d
lea esi, [esi]
lea edi, [edi]
cmp ebp, ecx
jne 0x4bfa75
mov ebx, dword [edx + 0x18]
mov eax, dword [0x52333c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
add byte [ecx - 0x74fbdbbc], cl
sub eax, 0x52330c
test ebx, ebx
je 0x4bfb45
invalid
mov eax, dword [ebx + 0x3c]
mov ecx, dword [eax + ebx + 0x78]
mov eax, dword [ecx + ebx + 0x20]
mov edi, dword [ecx + ebx + 0x18]
add eax, ebx
test edi, edi
jbe 0x4bfb45
mov dl, byte [ebp]
xor esi, esi
mov dword [esp + 8], ecx
mov dword [esp + 0x14], ebp
mov ebp, ebx
add ebp, dword [eax + esi*4]
cmp dl, byte [ebp]
jne 0x4bfb40
mov dword [esp + 0x10], edi
xor ecx, ecx
mov dword [esp + 0xc], eax
mov edi, dword [esp + 0x14]
cmp byte [ecx + ebp], 0
je 0x4bfd23
cmp byte [ecx + edi], 0
je 0x4bfd23
inc ecx
mov al, byte [ecx + ebp]
cmp al, byte [ecx + edi]
je 0x4bfb17
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
inc esi
cmp esi, edi
jb 0x4bfaff
xor eax, eax
push 0x104
push dword [esp + 8]
push 0
call eax
xor edx, edx
mov ebp, dword [esp + 4]
xor eax, eax
movzx ecx, word [ebp + edx*2]
cmp ecx, 0x5c
je 0x4bfd1c
test ecx, ecx
je 0x4bfb71
inc edx
jmp 0x4bfb5c
mov ebp, dword [0x523338]
mov edx, dword [esp + 4]
cmp dword [ebp], 0
lea esi, [edx + eax*2 + 2]
je 0x4bfbc5
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
movzx eax, al
cmp al, byte [ebp]
je 0x4bfb9d
cmp al, byte [ebp + 1]
jne 0x4bfc6b
movzx edx, word [esi]
xor eax, eax
test edx, edx
je 0x4bfbb7
xor edx, edx
movzx ecx, word [esi + edx*2]
inc edx
add eax, ecx
movzx edi, word [esi + edx*2]
test edi, edi
jne 0x4bfba8
cmp eax, dword [ebp + 4]
je 0x4bfbc5
cmp eax, dword [ebp + 8]
jne 0x4bfc6b
mov eax, dword [0x52333c]
mov dword [esp + 4], 0
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
mov eax, dword [0x523310]
test eax, eax
jbe 0x4bfc07
xor eax, eax
mov edx, dword [0x523330]
mov ecx, dword [edx + eax]
mov dword [ebp + eax], ecx
mov esi, dword [0x523334]
add eax, esi
mov edi, dword [0x523310]
cmp eax, edi
jb 0x4bfbe8
test ebx, ebx
je 0x4bfc6b
mov eax, dword [ebx + 0x3c]
mov ecx, dword [eax + ebx + 0x78]
mov eax, dword [ecx + ebx + 0x20]
mov edi, dword [ecx + ebx + 0x18]
add eax, ebx
test edi, edi
jbe 0x4bfc6b
mov dl, byte [ebp]
xor esi, esi
mov dword [esp + 8], ecx
mov dword [esp + 0x14], ebp
mov ebp, ebx
add ebp, dword [eax + esi*4]
cmp dl, byte [ebp]
jne 0x4bfc66
mov dword [esp + 0x10], edi
xor ecx, ecx
mov dword [esp + 0xc], eax
mov edi, dword [esp + 0x14]
cmp byte [ecx + ebp], 0
je 0x4bfc73
cmp byte [ecx + edi], 0
je 0x4bfc73
inc ecx
mov al, byte [ecx + ebp]
cmp al, byte [ecx + edi]
je 0x4bfc45
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
inc esi
cmp esi, edi
jb 0x4bfc2d
mov ecx, dword [esp + 8]
mov eax, dword [ecx + ebx + 0x1c]
mov eax, edx
jmp 0x4bfb6e
mov ecx, dword [esp + 8]
mov eax, dword [ecx + ebx + 0x1c]
mov ecx, dword [ecx + ebx + 0x24]
add eax, ebx
add ecx, ebx
movzx edx, word [ecx + esi*2]
mov eax, dword [eax + edx*4]
add eax, ebx
jmp 0x4bfb47