Function at 0x10058fe0
Capabilities:
Run powershell expression

Disassembly:
push ebx
push edi
mov edi, dword [sym.imp.libDeteven.dll_stristr]
push str.WEbCLIENT
push esi
xor ebx, ebx
call edi
add esp, 8
test eax, eax
je 0x10059039
push str._SyStem.NeT.WEbReQUeSt_::DEfaUlTWEbPRoXy_
push esi
call edi
add esp, 8
test eax, eax
je 0x10059039
push str._SYSteM.NEt.CredentiaLCACHE_::DEFAultNetWorKCrEdEnTIALS_
push esi
call edi
add esp, 8
test eax, eax
je 0x10059039
push str.DoWnloAdStrINg
push esi
call edi
add esp, 8
test eax, eax
je 0x10059039
push str._BXoR
push esi
call edi
add esp, 8
test eax, eax
jne 0x100595e4
push str._System.IO.File_::ReadAllBytes
push esi
call edi
add esp, 8
test eax, eax
je 0x100590b5
push str.Remove_Item
push esi
call edi
add esp, 8
test eax, eax
je 0x100590b5
push str._System.Text.Encoding_::UTF8.GetString
push esi
call edi
add esp, 8
test eax, eax
je 0x100590b5
push str._Convert_::FromBase64String
push esi
call edi
add esp, 8
test eax, eax
je 0x100590b5
push str._System.IO.File_::WriteAllBytes
push esi
call edi
add esp, 8
test eax, eax
je 0x100590b5
push 0x100d8e60
push esi
call edi
add esp, 8
test eax, eax
je 0x100590b5
push str._ArgumentList
push esi
call edi
add esp, 8
test eax, eax
je 0x100590b5
push str._extr
push esi
call edi
add esp, 8
test eax, eax
jne 0x100595e4
push str._byte_
push esi
call edi
add esp, 8
test eax, eax
je 0x10059195
push str.FromBase64String
push esi
call edi
add esp, 8
test eax, eax
je 0x10059195
push str.Invoke_Expression
push esi
call edi
add esp, 8
test eax, eax
je 0x10059195
push str.UTF8.GetString
push esi
call edi
add esp, 8
test eax, eax
je 0x10059195
push str..Count
push esi
call edi
add esp, 8
test eax, eax
je 0x10059195
push str.Test_Path
push esi
call edi
add esp, 8
test eax, eax
je 0x10059195
push str._band
push esi
call edi
add esp, 8
test eax, eax
jne 0x100595e4
push str._bor
push esi
call edi
add esp, 8
test eax, eax
jne 0x100595e4
push 0x100d8ebc
push esi
call edi
add esp, 8
test eax, eax
jne 0x100595e4
push str._bnot
push esi
call edi
add esp, 8
test eax, eax
jne 0x100595e4
push str._shl
push esi
call edi
add esp, 8
test eax, eax
jne 0x100595e4
push str._shr
push esi
call edi
add esp, 8
test eax, eax
jne 0x100595e4
push str.SilentlyContinue
push esi
call edi
add esp, 8
test eax, eax
je 0x10059228
push str.taskeng.exe
push esi
call edi
add esp, 8
test eax, eax
je 0x10059228
push str.WindowsIdentity
push esi
call edi
add esp, 8
test eax, eax
je 0x10059228
push str.Administrator
push esi
call edi
add esp, 8
test eax, eax
je 0x10059228
push str.DownloadData
push esi
call edi
add esp, 8
test eax, eax
je 0x10059228
push str.FromBase64String
push esi
call edi
add esp, 8
test eax, eax
je 0x10059228
push 0x100d7934
push esi
call edi
add esp, 8
test eax, eax
je 0x10059228
push str.IO.Compression.DeflateStream
push esi
call edi
add esp, 8
test eax, eax
jne 0x100595e4
push str.::Decompress
push esi
call edi
add esp, 8
test eax, eax
jne 0x100595e4
push str.nEw_OBJecT
push esi
call edi
add esp, 8
test eax, eax
je 0x10059268
push str.net.wEBclIeNT
push esi
call edi
add esp, 8
test eax, eax
je 0x10059268
push str.doWnLOaDsTrINg
push esi
call edi
add esp, 8
test eax, eax
je 0x10059268
push str._gl.php_
push esi
call edi
add esp, 8
test eax, eax
jne 0x100595e4
push str.cachedGroupPolicySettings
push esi
call edi
add esp, 8
test eax, eax
je 0x100592b7
push 0x100cc56c
push esi
call edi
add esp, 8
test eax, eax
je 0x100592b7
push 0x100d8f94
push esi
call edi
add esp, 8
test eax, eax
je 0x100592b7
push str.GEtBYtEs
push esi
call edi
add esp, 8
test eax, eax
je 0x100592b7
push str._bXor
push esi
call edi
add esp, 8
test eax, eax
jne 0x100595e4
push str.kernel32.dll
push esi
call edi
add esp, 8
test eax, eax
je 0x10059306
push str.VirtualAlloc
push esi
call edi
add esp, 8
test eax, eax
je 0x10059306
push str.WriteProcessMemory
push esi
call edi
add esp, 8
test eax, eax
je 0x10059306
push str.GetCurrentProcess
push esi
call edi
add esp, 8
test eax, eax
je 0x10059306
push str.FromBase64String
push esi
call edi
add esp, 8
test eax, eax
jne 0x100595e4
push str.Invoke_Expression__cmd__Stop_Process__Force__processname_cmd
push esi
call edi
add esp, 8
test eax, eax
je 0x1005934e
push str.checker_host
push esi
call edi
add esp, 8
test eax, eax
jne 0x100595e4
push str._server
push esi
call edi
add esp, 8
test eax, eax
jne 0x100595e4
push str.testServer_host
push esi
call edi
add esp, 8
test eax, eax
jne 0x100595e4
push 0x100cb9f4
push esi
call edi
add esp, 8
test eax, eax
jne 0x100595e4
push str.https:__goo.gl
push esi
call edi
add esp, 8
test eax, eax
jne 0x100595e4
push str.ddns.net
push esi
call edi
add esp, 8
test eax, eax
jne 0x100595e4
push 0x100d915c
push esi
call edi
add esp, 8
test eax, eax
jne 0x100595e4
push 0x100d916c
push esi
call edi
add esp, 8
test eax, eax
jne 0x100595e4
push str.Mimikatz
push esi
call edi
add esp, 8
test eax, eax
jne 0x100595e4
push str.Empire
push esi
call edi
add esp, 8
test eax, eax
jne 0x100595e4
push str.DllInjection
push esi
call edi
add esp, 8
test eax, eax
jne 0x100595e4
push str.ReflectivePEInjection
push esi
call edi
add esp, 8
test eax, eax
jne 0x100595e4
push str.NinjaCopy
push esi
call edi
add esp, 8
test eax, eax
jne 0x100595e4
push str.Shellcode
push esi
call edi
add esp, 8
test eax, eax
jne 0x100595e4
push str.WmiCommand
push esi
call edi
add esp, 8
test eax, eax
jne 0x100595e4
push str.PoshSec
push esi
call edi
add esp, 8
test eax, eax
jne 0x100595e4
push str.PowerSploit
push esi
call edi
add esp, 8
test eax, eax
jne 0x100595e4
push str.EternalBlue
push esi
call edi
add esp, 8
test eax, eax
jne 0x100595e4
push str.Invoke_BloodHound
push esi
call edi
add esp, 8
test eax, eax
jne 0x100595e4
push str.powercat
push esi
call edi
add esp, 8
test eax, eax
jne 0x100595e4
push str.ServicePointManager
push esi
call edi
add esp, 8
test eax, eax
je 0x100594c2
push str.ServerCertificateValidationCallback
push esi
call edi
add esp, 8
test eax, eax
je 0x100594c2
push 0x100d9258
push esi
call edi
add esp, 8
test eax, eax
jne 0x100595e4
push str.MicrosoftWindowsStart_MenuProgramsStartup
push esi
call edi
add esp, 8
test eax, eax
jne 0x100595e4
push 0x100c4dd8
push esi
call edi
add esp, 8
test eax, eax
jne 0x100595e4
push 0x100c4fa8
push esi
call edi
add esp, 8
test eax, eax
jne 0x100595e4
push str._Net.WebRequest_::GetSystemWebProxy___
push esi
call edi
add esp, 8
test eax, eax
je 0x1005954a
push str.Proxy.Credentials_Net.CredentialCache_::DefaultCredentials_
push esi
call edi
add esp, 8
test eax, eax
je 0x1005954a
push 0x100cc56c
push esi
call edi
add esp, 8
test eax, eax
je 0x1005954a
push 0x100d3bdc
push esi
call edi
add esp, 8
test eax, eax
je 0x1005954a
push str..htm
push esi
call edi
add esp, 8
test eax, eax
je 0x100595e4
push str.githubusercontent.com_FuzzySecurity
push esi
call edi
add esp, 8
test eax, eax
jne 0x100595e4
push 0x100c8924
push esi
call edi
add esp, 8
test eax, eax
jne 0x100595e4
push str..Headers.add_
push esi
call edi
add esp, 8
test eax, eax
je 0x10059599
push str.http
push esi
call edi
add esp, 8
test eax, eax
je 0x10059599
push str.updater.php_
push esi
call edi
add esp, 8
test eax, eax
jne 0x100595e4
push str.AppDataRoaming64.exe
push esi
call edi
add esp, 8
test eax, eax
jne 0x100595e4
push str.FromBase64String
push esi
call edi
add esp, 8
test eax, eax
je 0x100595e9
push str.CreateProcess
push esi
call edi
add esp, 8
test eax, eax
je 0x100595e9
push 0x100d3bb8
push esi
call edi
add esp, 8
test eax, eax
je 0x100595e9
push 0x100cc5c4
push esi
call edi
add esp, 8
test eax, eax
je 0x100595e9
mov ebx, 1
pop edi
mov eax, ebx
pop ebx
ret