Function at 0x10056600
Capabilities:
Run powershell expression

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, eax
mov al, byte [esi + 1]
xor ebx, ebx
mov dword [ebp - 4], ebx
test al, al
jne 0x10056619
cmp byte [esi + 3], bl
je 0x10056622
cmp byte [esi], 0xff
jne 0x1005664d
cmp al, 0xfe
jne 0x1005664d
cmp byte [esi], 0xff
jne 0x1005662e
cmp al, 0xfe
jne 0x1005662e
add esi, 2
push esi
call dword [sym.imp.psklutil.dll_Ordinal_301]
mov esi, eax
add esp, 4
cmp esi, ebx
jne 0x10056646
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 1
push edi
mov edi, dword [sym.imp.libDeteven.dll_stristr]
push str.WEbCLIENT
push esi
call edi
add esp, 8
test eax, eax
je 0x100566a3
push str._SyStem.NeT.WEbReQUeSt_::DEfaUlTWEbPRoXy_
push esi
call edi
add esp, 8
test eax, eax
je 0x100566a3
push str._SYSteM.NEt.CredentiaLCACHE_::DEFAultNetWorKCrEdEnTIALS_
push esi
call edi
add esp, 8
test eax, eax
je 0x100566a3
push str.DoWnloAdStrINg
push esi
call edi
add esp, 8
test eax, eax
je 0x100566a3
push str._BXoR
push esi
call edi
add esp, 8
test eax, eax
jne 0x10056a15
push str._System.IO.File_::ReadAllBytes
push esi
call edi
add esp, 8
test eax, eax
je 0x1005671f
push str.Remove_Item
push esi
call edi
add esp, 8
test eax, eax
je 0x1005671f
push str._System.Text.Encoding_::UTF8.GetString
push esi
call edi
add esp, 8
test eax, eax
je 0x1005671f
push str._Convert_::FromBase64String
push esi
call edi
add esp, 8
test eax, eax
je 0x1005671f
push str._System.IO.File_::WriteAllBytes
push esi
call edi
add esp, 8
test eax, eax
je 0x1005671f
push 0x100d8e60
push esi
call edi
add esp, 8
test eax, eax
je 0x1005671f
push str._ArgumentList
push esi
call edi
add esp, 8
test eax, eax
je 0x1005671f
push str._extr
push esi
call edi
add esp, 8
test eax, eax
jne 0x10056a15
push str._byte_
push esi
call edi
add esp, 8
test eax, eax
je 0x100567ff
push str.FromBase64String
push esi
call edi
add esp, 8
test eax, eax
je 0x100567ff
push str.Invoke_Expression
push esi
call edi
add esp, 8
test eax, eax
je 0x100567ff
push str.UTF8.GetString
push esi
call edi
add esp, 8
test eax, eax
je 0x100567ff
push str..Count
push esi
call edi
add esp, 8
test eax, eax
je 0x100567ff
push str.Test_Path
push esi
call edi
add esp, 8
test eax, eax
je 0x100567ff
push str._band
push esi
call edi
add esp, 8
test eax, eax
jne 0x10056a15
push str._bor
push esi
call edi
add esp, 8
test eax, eax
jne 0x10056a15
push 0x100d8ebc
push esi
call edi
add esp, 8
test eax, eax
jne 0x10056a15
push str._bnot
push esi
call edi
add esp, 8
test eax, eax
jne 0x10056a15
push str._shl
push esi
call edi
add esp, 8
test eax, eax
jne 0x10056a15
push str._shr
push esi
call edi
add esp, 8
test eax, eax
jne 0x10056a15
push str.SilentlyContinue
push esi
call edi
add esp, 8
test eax, eax
je 0x10056892
push str.taskeng.exe
push esi
call edi
add esp, 8
test eax, eax
je 0x10056892
push str.WindowsIdentity
push esi
call edi
add esp, 8
test eax, eax
je 0x10056892
push str.Administrator
push esi
call edi
add esp, 8
test eax, eax
je 0x10056892
push str.DownloadData
push esi
call edi
add esp, 8
test eax, eax
je 0x10056892
push str.FromBase64String
push esi
call edi
add esp, 8
test eax, eax
je 0x10056892
push 0x100d7934
push esi
call edi
add esp, 8
test eax, eax
je 0x10056892
push str.IO.Compression.DeflateStream
push esi
call edi
add esp, 8
test eax, eax
jne 0x10056a15
push str.::Decompress
push esi
call edi
add esp, 8
test eax, eax
jne 0x10056a15
push str.nEw_OBJecT
push esi
call edi
add esp, 8
test eax, eax
je 0x100568d2
push str.net.wEBclIeNT
push esi
call edi
add esp, 8
test eax, eax
je 0x100568d2
push str.doWnLOaDsTrINg
push esi
call edi
add esp, 8
test eax, eax
je 0x100568d2
push str._gl.php_
push esi
call edi
add esp, 8
test eax, eax
jne 0x10056a15
push str.cachedGroupPolicySettings
push esi
call edi
add esp, 8
test eax, eax
je 0x10056921
push 0x100cc56c
push esi
call edi
add esp, 8
test eax, eax
je 0x10056921
push 0x100d8f94
push esi
call edi
add esp, 8
test eax, eax
je 0x10056921
push str.GEtBYtEs
push esi
call edi
add esp, 8
test eax, eax
je 0x10056921
push str._bXor
push esi
call edi
add esp, 8
test eax, eax
jne 0x10056a15
push str.kernel32.dll
push esi
call edi
add esp, 8
test eax, eax
je 0x10056970
push str.VirtualAlloc
push esi
call edi
add esp, 8
test eax, eax
je 0x10056970
push str.WriteProcessMemory
push esi
call edi
add esp, 8
test eax, eax
je 0x10056970
push str.GetCurrentProcess
push esi
call edi
add esp, 8
test eax, eax
je 0x10056970
push str.FromBase64String
push esi
call edi
add esp, 8
test eax, eax
jne 0x10056a15
push str.AsseMBlY.GETTypE
push esi
call edi
add esp, 8
test eax, eax
je 0x100569ac
push str.AmsiUtils
push esi
call edi
add esp, 8
test eax, eax
je 0x100569ac
push 0x100d9004
push esi
call edi
add esp, 8
test eax, eax
je 0x100569ac
push str.SEtValue__NUll__TRUE_
push esi
call edi
add esp, 8
test eax, eax
jne 0x10056a15
push str.GetBYtES
push esi
call edi
add esp, 8
test eax, eax
je 0x10056a1a
push str.0..255
push esi
call edi
add esp, 8
test eax, eax
je 0x10056a1a
push str..COUNT
push esi
call edi
add esp, 8
test eax, eax
je 0x10056a1a
push str._Bxor
push esi
call edi
add esp, 8
test eax, eax
je 0x10056a1a
push str.DOWNlOaD
push esi
call edi
add esp, 8
test eax, eax
je 0x10056a1a
push 0x100cc56c
push esi
call edi
add esp, 8
test eax, eax
je 0x10056a1a
push str._256
push esi
call edi
add esp, 8
test eax, eax
je 0x10056a1a
mov ebx, 1
cmp dword [ebp - 4], 0
pop edi
je 0x10056a2b
push esi
call dword [sym.imp.pskalloc.dll_Pfree]
add esp, 4
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret