A security analyst is reviewing a suspicious PowerShell script that was found on a compromised host. The analyst wants to understand the script's functionality without executing it. Which of the following techniques should the analyst use?