PowerShell (pwsh): PE-Inspect-PortableExecutable-Namespace

PE-Inspect-PortableExecutable-Namespace.ps1

function Expand-Properties($Object, $Depth = 5, $Indent = 0) {
    if ($Depth -le 0 -or $null -eq $Object) { return } $prefix = " " * $Indent
    $Object | gm -m Property | % {
        $pValue = $Object.$($_.Name)
        if ($pValue -is [Enum]) { Write-Host "$prefix$($_.Name): " -F Green -N; Write-Host "$pValue" -F Blue }
        elseif ($null -eq $pValue) { Write-Host "$prefix$($_.Name): " -F Green -N; Write-Host "(null)" -F Blue }
        elseif ($pValue -is [Collections.IEnumerable] -and $pValue -isnot [string]) { Write-Host "$prefix$($_.Name): " -F Green; $pValue | % { Expand-Properties $_ ($Depth - 1) ($Indent + 4) } }
        elseif ($pValue -is [PSObject] -or $pValue.GetType().Namespace -match "^System.Reflection") { Write-Host "$prefix$($_.Name): " -F Green; Expand-Properties $pValue ($Depth - 1) ($Indent + 4) }
        else { Write-Host "$prefix$($_.Name): " -F Green -N; Write-Host "$pValue" -F Blue }}}
Expand-Properties ([Reflection.PortableExecutable.PEReader]::new([IO.File]::OpenRead([IO.Path]::GetFullPath(".\StringDecryptor_task.exe"))).PEHeaders)