Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Medium
PeID
Microsoft Visual C++ DLLMicrosoft Visual C++ v6.0
d8a498d3ed32fa33ff9c2e1a20e984da
Malicious
[Base64-Block @0x0002171C]
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.data
.rdata
.pdata
.xdata
.bss
.edata
.idata
.CRT
.tls
.reloc
4
14
29
41
55
67
80
91
102
116
[Authenticode]_b235f5e1.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rsrc
Resources
RT_ICON
ID:0002
ID:0
ID:0003
ID:0
ID:0004
ID:0
ID:0005
ID:0
ID:0006
ID:0
ID:0007
ID:0
ID:0008
ID:0
ID:0009
ID:0
ID:000A
ID:0
ID:0-preview.png
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Malicious
sumburv11.ps1
Malicious
[Base64-Block]
Malicious
[PowerShell Command]
Malicious
[Base64-Block]
[Base64-Block].deobfuscated.vbs
Malicious
[Command #0]
Malicious
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
Authenticode present at 0x79200 size 7232 bytes
Module Name
sumburv11.exe
Full Name
sumburv11.exe
EntryPoint
System.Int32 ModuleNameSpace.MainApp::Main(System.String[])
Scope Name
sumburv11.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
sumburv11
Assembly Version
7.11.2.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
88
Main Method
System.Int32 ModuleNameSpace.MainApp::Main(System.String[])
Main IL Instruction Count
534
Main IL 
ldnull <null>
stloc.s V_24
ldnull <null>
stloc.s V_25
ldnull <null>
stloc.s V_26
newobj System.Void ModuleNameSpace.MainApp/<>c__DisplayClass6::.ctor()
stloc.s V_27
newobj System.Void ModuleNameSpace.MainApp::.ctor()
stloc.0 <null>
ldc.i4.0 <null>
stloc.1 <null>
ldsfld System.String System.String::Empty
stloc.2 <null>
ldloc.s V_27
newobj System.Void ModuleNameSpace.MainModuleUI::.ctor()
stfld ModuleNameSpace.MainModuleUI ModuleNameSpace.MainApp/<>c__DisplayClass6::ui
ldloc.0 <null>
ldloc.s V_27
ldfld ModuleNameSpace.MainModuleUI ModuleNameSpace.MainApp/<>c__DisplayClass6::ui
newobj System.Void ModuleNameSpace.MainModule::.ctor(ModuleNameSpace.MainAppInterface,ModuleNameSpace.MainModuleUI)
stloc.3 <null>
ldloc.s V_27
ldc.i4.0 <null>
newobj System.Void System.Threading.ManualResetEvent::.ctor(System.Boolean)
stfld System.Threading.ManualResetEvent ModuleNameSpace.MainApp/<>c__DisplayClass6::mre
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void ModuleNameSpace.MainApp::CurrentDomain_UnhandledException(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
ldloc.3 <null>
call System.Management.Automation.Runspaces.Runspace System.Management.Automation.Runspaces.RunspaceFactory::CreateRunspace(System.Management.Automation.Host.PSHost)
stloc.s V_4
ldloc.s V_4
ldc.i4.0 <null>
callvirt System.Void System.Management.Automation.Runspaces.Runspace::set_ApartmentState(System.Threading.ApartmentState)
ldloc.s V_4
callvirt System.Void System.Management.Automation.Runspaces.Runspace::Open()
call System.Management.Automation.PowerShell System.Management.Automation.PowerShell::Create()
stloc.s V_5
ldloc.s V_5
ldloc.s V_4
callvirt System.Void System.Management.Automation.PowerShell::set_Runspace(System.Management.Automation.Runspaces.Runspace)
ldloc.s V_5
callvirt System.Management.Automation.PSDataStreams System.Management.Automation.PowerShell::get_Streams()
callvirt System.Management.Automation.PSDataCollection`1<System.Management.Automation.ErrorRecord> System.Management.Automation.PSDataStreams::get_Error()
ldloc.s V_24
brtrue.s IL_00A1: ldloc.s V_24
ldloc.s V_27
ldftn System.Void ModuleNameSpace.MainApp/<>c__DisplayClass6::<Main>b__0(System.Object,System.Management.Automation.DataAddedEventArgs)
newobj System.Void System.EventHandler`1<System.Management.Automation.DataAddedEventArgs>::.ctor(System.Object,System.IntPtr)
stloc.s V_24
ldloc.s V_24
callvirt System.Void System.Management.Automation.PSDataCollection`1<System.Management.Automation.ErrorRecord>::add_DataAdded(System.EventHandler`1<System.Management.Automation.DataAddedEventArgs>)
newobj System.Void System.Management.Automation.PSDataCollection`1<System.String>::.ctor()
stloc.s V_6
call System.Boolean ModuleNameSpace.Console_Info::IsInputRedirected()
brfalse.s IL_00D2: ldloc.s V_6
ldstr 
stloc.s V_7
br.s IL_00C8: call System.String System.Console::ReadLine()
ldloc.s V_6
ldloc.s V_7
callvirt System.Void System.Management.Automation.PSDataCollection`1<System.String>::Add(System.String)
call System.String System.Console::ReadLine()
dup <null>
stloc.s V_7
brtrue.s IL_00BF: ldloc.s V_6
ldloc.s V_6
callvirt System.Void System.Management.Automation.PSDataCollection`1<System.String>::Complete()
newobj System.Void System.Management.Automation.PSDataCollection`1<System.Management.Automation.PSObject>::.ctor()
stloc.s V_8
ldloc.s V_8
ldloc.s V_25
brtrue.s IL_00F5: ldloc.s V_25
ldloc.s V_27
ldftn System.Void ModuleNameSpace.MainApp/<>c__DisplayClass6::<Main>b__1(System.Object,System.Management.Automation.DataAddedEventArgs)
newobj System.Void System.EventHandler`1<System.Management.Automation.DataAddedEventArgs>::.ctor(System.Object,System.IntPtr)
stloc.s V_25
ldloc.s V_25
callvirt System.Void System.Management.Automation.PSDataCollection`1<System.Management.Automation.PSObject>::add_DataAdded(System.EventHandler`1<System.Management.Automation.DataAddedEventArgs>)
ldc.i4.0 <null>
stloc.s V_9
ldc.i4.0 <null>
stloc.s V_10
ldc.i4.0 <null>
stloc.s V_11
ldstr 
stloc.s V_12
ldarg.0 <null>
stloc.s V_29
ldc.i4.0 <null>
stloc.s V_30
br IL_0229: ldloc.s V_30
ldloc.s V_29
ldloc.s V_30
ldelem.ref <null>
stloc.s V_13
ldloc.s V_13
ldstr -wait
ldc.i4.1 <null>
call System.Int32 System.String::Compare(System.String,System.String,System.Boolean)
brtrue.s IL_0134: ldloc.s V_13
ldc.i4.1 <null>
stloc.1 <null>
br IL_021D: ldloc.s V_10
ldloc.s V_13
ldstr -extract
ldc.i4.3 <null>
callvirt System.Boolean System.String::StartsWith(System.String,System.StringComparison)
brfalse.s IL_01A4: ldloc.s V_13
ldloc.s V_13
ldc.i4.1 <null>
newarr System.String
stloc.s V_31
ldloc.s V_31
ldc.i4.0 <null>
ldstr :
stelem.ref <null>
ldloc.s V_31
ldc.i4.2 <null>
ldc.i4.1 <null>
callvirt System.String[] System.String::Split(System.String[],System.Int32,System.StringSplitOptions)
stloc.s V_14
ldloc.s V_14
ldlen <null>
conv.i4 <null>
ldc.i4.2 <null>
beq.s IL_0188: ldloc.s V_14
ldstr If you specify the -extract option you need to add a file for extraction in this way
   -extract:"<filename>"
call System.AppDomain System.AppDomain::get_CurrentDomain()
callvirt System.String System.AppDomain::get_FriendlyName()
ldc.i4.0 <null>
ldc.i4.s 16
call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon)
pop <null>
ldc.i4.1 <null>
stloc.s V_28
leave IL_05C5: ldloc.s V_28
ldloc.s V_14
ldc.i4.1 <null>
ldelem.ref <null>
ldc.i4.1 <null>
newarr System.Char
stloc.s V_32
ldloc.s V_32
ldc.i4.0 <null>
ldc.i4.s 34
stelem.i2 <null>
ldloc.s V_32
callvirt System.String System.String::Trim(System.Char[])
stloc.2 <null>
br.s IL_021D: ldloc.s V_10
ldloc.s V_13
ldstr -end
ldc.i4.1 <null>
call System.Int32 System.String::Compare(System.String,System.String,System.Boolean)
brtrue.s IL_01BB: ldloc.s V_13
ldloc.s V_10
ldc.i4.1 <null>
add <null>
stloc.s V_9
br.s IL_0234: call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
ldloc.s V_13
ldstr -?
ldc.i4.1 <null>
call System.Int32 System.String::Compare(System.String,System.String,System.Boolean)
brtrue.s IL_01CF: ldloc.s V_11
ldc.i4.1 <null>
stloc.s V_11
br.s IL_021D: ldloc.s V_10
ldloc.s V_11
brfalse.s IL_0206: ldloc.s V_13
ldloc.s V_13
ldstr -detailed
ldc.i4.1 <null>
call System.Int32 System.String::Compare(System.String,System.String,System.Boolean)
brfalse.s IL_0200: ldloc.s V_13
ldloc.s V_13
ldstr -examples
ldc.i4.1 <null>
call System.Int32 System.String::Compare(System.String,System.String,System.Boolean)
brfalse.s IL_0200: ldloc.s V_13
ldloc.s V_13
ldstr -full
ldc.i4.1 <null>
call System.Int32 System.String::Compare(System.String,System.String,System.Boolean)
brtrue.s IL_021D: ldloc.s V_10
ldloc.s V_13
stloc.s V_12
br.s IL_021D: ldloc.s V_10
ldloc.s V_13
ldstr -debug
ldc.i4.1 <null>
call System.Int32 System.String::Compare(System.String,System.String,System.Boolean)
brtrue.s IL_021D: ldloc.s V_10
call System.Boolean System.Diagnostics.Debugger::Launch()
pop <null>
br.s IL_0234: call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
ldloc.s V_10
ldc.i4.1 <null>
add <null>
stloc.s V_10
ldloc.s V_30
ldc.i4.1 <null>
add <null>
stloc.s V_30
ldloc.s V_30
ldloc.s V_29
ldlen <null>
conv.i4 <null>
blt IL_0117: ldloc.s V_29
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
stloc.s V_15
ldloc.s V_15
ldstr sumburv11.ps1
callvirt System.IO.Stream System.Reflection.Assembly::GetManifestResourceStream(System.String)
stloc.s V_16
ldloc.s V_16
call System.Text.Encoding System.Text.Encoding::get_UTF8()
newobj System.Void System.IO.StreamReader::.ctor(System.IO.Stream,System.Text.Encoding)
stloc.s V_17
ldloc.s V_17
callvirt System.String System.IO.TextReader::ReadToEnd()
stloc.s V_18
ldloc.2 <null>
call System.Boolean System.String::IsNullOrEmpty(System.String)
brtrue.s IL_0278: ldloc.s V_11
ldloc.2 <null>
ldloc.s V_18
call System.Void System.IO.File::WriteAllText(System.String,System.String)
ldc.i4.0 <null>
stloc.s V_28
leave IL_05C5: ldloc.s V_28
ldloc.s V_11
brfalse.s IL_02EB: ldloc.s V_5
ldloc.s V_5
ldc.i4.s 9
newarr System.String
stloc.s V_33
ldloc.s V_33
ldc.i4.0 <null>
ldstr function 
stelem.ref <null>
ldloc.s V_33
ldc.i4.1 <null>
call System.AppDomain System.AppDomain::get_CurrentDomain()
callvirt System.String System.AppDomain::get_FriendlyName()
stelem.ref <null>
ldloc.s V_33
ldc.i4.2 <null>
ldstr {
stelem.ref <null>
ldloc.s V_33
ldc.i4.3 <null>
ldloc.s V_18
stelem.ref <null>
ldloc.s V_33
ldc.i4.4 <null>
ldstr }; Get-Help 
stelem.ref <null>
ldloc.s V_33
ldc.i4.5 <null>
call System.AppDomain System.AppDomain::get_CurrentDomain()
callvirt System.String System.AppDomain::get_FriendlyName()
stelem.ref <null>
ldloc.s V_33
ldc.i4.6 <null>
ldstr  
stelem.ref <null>
ldloc.s V_33
ldc.i4.7 <null>
ldloc.s V_12
stelem.ref <null>
ldloc.s V_33
ldc.i4.8 <null>
ldstr  | Out-String
stelem.ref <null>
ldloc.s V_33
call System.String System.String::Concat(System.String[])
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddScript(System.String)
pop <null>
br.s IL_02F5: leave.s IL_0303
ldloc.s V_5
ldloc.s V_18
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddScript(System.String)
pop <null>
leave.s IL_0303: leave.s IL_0311
ldloc.s V_17
brfalse.s IL_0302: endfinally
ldloc.s V_17
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
leave.s IL_0311: ldloc.s V_11
ldloc.s V_16
brfalse.s IL_0310: endfinally
ldloc.s V_16
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldloc.s V_11
brtrue IL_0510: ldloc.s V_5
ldnull <null>
stloc.s V_19
ldstr ^-([^: ]+)[ :]?([^:]*)$
newobj System.Void System.Text.RegularExpressions.Regex::.ctor(System.String)
stloc.s V_20
ldloc.s V_9
stloc.s V_21
br IL_04DE: ldloc.s V_21
ldloc.s V_20
ldarg.0 <null>
ldloc.s V_21
ldelem.ref <null>
callvirt System.Text.RegularExpressions.Match System.Text.RegularExpressions.Regex::Match(System.String)
stloc.s V_22
ldloc.s V_22
callvirt System.Boolean System.Text.RegularExpressions.Group::get_Success()
brfalse IL_04B5: ldloc.s V_19
ldloc.s V_22
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
callvirt System.Int32 System.Text.RegularExpressions.GroupCollection::get_Count()
ldc.i4.3 <null>
bne.un IL_04B5: ldloc.s V_19
ldarg.0 <null>
ldloc.s V_21
ldelem.ref <null>
ldloca.s V_23
call System.Boolean System.Double::TryParse(System.String,System.Double&)
brtrue IL_04B5: ldloc.s V_19
ldloc.s V_19
brfalse.s IL_0379: ldloc.s V_22
ldloc.s V_5
ldloc.s V_19
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddParameter(System.String)
pop <null>
ldloc.s V_22
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
ldc.i4.2 <null>
callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32)
callvirt System.String System.Text.RegularExpressions.Capture::get_Value()
callvirt System.String System.String::Trim()
ldstr 
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_03B5: ldloc.s V_22
ldloc.s V_22
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
ldc.i4.1 <null>
callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32)
callvirt System.String System.Text.RegularExpressions.Capture::get_Value()
stloc.s V_19
br IL_04D8: ldloc.s V_21
ldloc.s V_22
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
ldc.i4.2 <null>
callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32)
callvirt System.String System.Text.RegularExpressions.Capture::get_Value()
ldstr True
call System.Boolean System.String::op_Equality(System.String,System.String)
brtrue.s IL_03F6: ldloc.s V_5
ldloc.s V_22
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
ldc.i4.2 <null>
callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32)
callvirt System.String System.Text.RegularExpressions.Capture::get_Value()
callvirt System.String System.String::ToUpper()
ldstr $TRUE
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_041E: ldloc.s V_22
ldloc.s V_5
ldloc.s V_22
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
ldc.i4.1 <null>
callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32)
callvirt System.String System.Text.RegularExpressions.Capture::get_Value()
ldc.i4.1 <null>
box System.Boolean
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddParameter(System.String,System.Object)
pop <null>
ldnull <null>
stloc.s V_19
br IL_04D8: ldloc.s V_21
ldloc.s V_22
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
ldc.i4.2 <null>
callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32)
callvirt System.String System.Text.RegularExpressions.Capture::get_Value()
ldstr False
call System.Boolean System.String::op_Equality(System.String,System.String)
brtrue.s IL_045F: ldloc.s V_5
ldloc.s V_22
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
ldc.i4.2 <null>
callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32)
callvirt System.String System.Text.RegularExpressions.Capture::get_Value()
callvirt System.String System.String::ToUpper()
ldstr $FALSE
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_0484: ldloc.s V_5
ldloc.s V_5
ldloc.s V_22
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
ldc.i4.1 <null>
callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32)
callvirt System.String System.Text.RegularExpressions.Capture::get_Value()
ldc.i4.0 <null>
box System.Boolean
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddParameter(System.String,System.Object)
pop <null>
ldnull <null>
stloc.s V_19
br.s IL_04D8: ldloc.s V_21
ldloc.s V_5
ldloc.s V_22
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
ldc.i4.1 <null>
callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32)
callvirt System.String System.Text.RegularExpressions.Capture::get_Value()
ldloc.s V_22
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
ldc.i4.2 <null>
callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32)
callvirt System.String System.Text.RegularExpressions.Capture::get_Value()
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddParameter(System.String,System.Object)
pop <null>
ldnull <null>
stloc.s V_19
br.s IL_04D8: ldloc.s V_21
ldloc.s V_19
brfalse.s IL_04CC: ldloc.s V_5
ldloc.s V_5
ldloc.s V_19
ldarg.0 <null>
ldloc.s V_21
ldelem.ref <null>
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddParameter(System.String,System.Object)
pop <null>
ldnull <null>
stloc.s V_19
br.s IL_04D8: ldloc.s V_21
ldloc.s V_5
ldarg.0 <null>
ldloc.s V_21
ldelem.ref <null>
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddArgument(System.Object)
pop <null>
ldloc.s V_21
ldc.i4.1 <null>
add <null>
stloc.s V_21
ldloc.s V_21
ldarg.0 <null>
ldlen <null>
conv.i4 <null>
blt IL_0330: ldloc.s V_20
ldloc.s V_19
brfalse.s IL_04F6: ldloc.s V_5
ldloc.s V_5
ldloc.s V_19
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddParameter(System.String)
pop <null>
ldloc.s V_5
ldstr Out-String
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddCommand(System.String)
pop <null>
ldloc.s V_5
ldstr Stream
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddParameter(System.String)
pop <null>
ldloc.s V_5
ldloc.s V_6
ldloc.s V_8
ldnull <null>
ldloc.s V_26
brtrue.s IL_052A: ldloc.s V_26
ldloc.s V_27
ldftn System.Void ModuleNameSpace.MainApp/<>c__DisplayClass6::<Main>b__2(System.IAsyncResult)
newobj System.Void System.AsyncCallback::.ctor(System.Object,System.IntPtr)
stloc.s V_26
ldloc.s V_26
ldnull <null>
callvirt System.IAsyncResult System.Management.Automation.PowerShell::BeginInvoke<System.String,System.Management.Automation.PSObject>(System.Management.Automation.PSDataCollection`1<System.String>,System.Management.Automation.PSDataCollection`1<System.Management.Automation.PSObject>,System.Management.Automation.PSInvocationSettings,System.AsyncCallback,System.Object)
pop <null>
ldloc.0 <null>
callvirt System.Boolean ModuleNameSpace.MainApp::get_ShouldExit()
brtrue.s IL_054B: ldloc.s V_5
ldloc.s V_27
ldfld System.Threading.ManualResetEvent ModuleNameSpace.MainApp/<>c__DisplayClass6::mre
ldc.i4.s 100
callvirt System.Boolean System.Threading.WaitHandle::WaitOne(System.Int32)
brfalse.s IL_0533: ldloc.0
ldloc.s V_5
callvirt System.Void System.Management.Automation.PowerShell::Stop()
ldloc.s V_5
callvirt System.Management.Automation.PSInvocationStateInfo System.Management.Automation.PowerShell::get_InvocationStateInfo()
callvirt System.Management.Automation.PSInvocationState System.Management.Automation.PSInvocationStateInfo::get_State()
ldc.i4.5 <null>
bne.un.s IL_057E: leave.s IL_058C
ldloc.s V_27
ldfld ModuleNameSpace.MainModuleUI ModuleNameSpace.MainApp/<>c__DisplayClass6::ui
ldloc.s V_5
callvirt System.Management.Automation.PSInvocationStateInfo System.Management.Automation.PowerShell::get_InvocationStateInfo()
callvirt System.Exception System.Management.Automation.PSInvocationStateInfo::get_Reason()
callvirt System.String System.Exception::get_Message()
callvirt System.Void System.Management.Automation.Host.PSHostUserInterface::WriteErrorLine(System.String)
leave.s IL_058C: ldloc.s V_4
ldloc.s V_5
brfalse.s IL_058B: endfinally
ldloc.s V_5
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldloc.s V_4
callvirt System.Void System.Management.Automation.Runspaces.Runspace::Close()
leave.s IL_05A1: leave.s IL_05A6
ldloc.s V_4
brfalse.s IL_05A0: endfinally
ldloc.s V_4
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
leave.s IL_05A6: ldloc.1
pop <null>
leave.s IL_05A6: ldloc.1
ldloc.1 <null>
brfalse.s IL_05BE: ldloc.0
ldstr Click OK to exit...
call System.AppDomain System.AppDomain::get_CurrentDomain()
callvirt System.String System.AppDomain::get_FriendlyName()
call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String)
pop <null>
ldloc.0 <null>
callvirt System.Int32 ModuleNameSpace.MainApp::get_ExitCode()
ret <null>
ldloc.s V_28
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙