wusa.exe - Windows Update Standalone Installer

info
MZ
PE
resources
imports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	wusa.exe
size	305664 (0x4aa00)
md5	c46be74bd433dd95952142967e3f1f9a

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xe8

Rich Header

lib id	version	times used
147	30729	2
259	26715	4
260	26715	22
261	26715	8
257	26715	27
1	0	276
265	26715	21
255	26715	1
258	26715	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	5
TimeDateStamp	0x6b684334
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x102
Magic	0x10b
LinkerVersion	14.15
SizeOfCode	0x2f000
SizeOfInitializedData	0x1ba00
SizeOfUninitializedData	0
AddressOfEntryPoint	0x2f7a0
BaseOfCode	0x1000
BaseOfData	0x30000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	10.0
ImageVersion	10.0
SubsystemVersion	10.0
Reserved1	0
SizeOfImage	0x4e000
SizeOfHeaders	0x400
CheckSum	0x4d80e
Subsystem	2
DllCharacteristics	0xc140
SizeOfStackReserve	0x40000
SizeOfStackCommit	0x2000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x2ef24	0x2f000	R-X CODE
.data	0x30000	0x51c	0x200	RW- IDATA
.idata	0x31000	0x1474	0x1600	R-- IDATA
.rsrc	0x33000	0x15480	0x15600	R-- IDATA
.reloc	0x49000	0x460c	0x4800	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x3131c	0x118
RESOURCE	0x33000	0x15480
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x49000	0x460c
DEBUG	0x1be80	0x54
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0x10cc	0x18
LOAD_CONFIG	0x1028	0xa4
Bound_IAT	0	0
IAT	0x31000	0x318
Delay_IAT	0	0
CLR_Header	0	0

TLS

raw start	raw end	index	callbks	zero fill	flags
0x42fe58	0x42fe60	0x430414	0x40110c	0	0x300000

show previews

type	name	size
MUI	#1	248
WEVT_TEMPLATE	#1	2634
ICON	#1	1640
ICON	#2	744
ICON	#3	296
ICON	#4	3752
ICON	#5	2216
ICON	#6	1384
ICON	#7	55762
ICON	#8	9640
ICON	#9	4264
ICON	#10	1128
GROUP_ICON	#101	146
VERSION	#1	940
MANIFEST	#1	1421

module_name	hint	ord	function_name
ADVAPI32.dll	612		RegCreateKeyExW
ADVAPI32.dll	681		RegSetValueExW
ADVAPI32.dll	603		RegCloseKey
ADVAPI32.dll	405		InitiateSystemShutdownExW
ADVAPI32.dll	139		CreateProcessAsUserW
ADVAPI32.dll	652		RegOpenKeyExW
ADVAPI32.dll	123		ConvertSidToStringSidW
ADVAPI32.dll	627		RegDeleteValueW
ADVAPI32.dll	635		RegEnumKeyW
ADVAPI32.dll	665		RegQueryValueExW
ADVAPI32.dll	623		RegDeleteKeyW
ADVAPI32.dll	32		AllocateAndInitializeSid
ADVAPI32.dll	95		CheckTokenMembership
ADVAPI32.dll	308		FreeSid
ADVAPI32.dll	431		LookupPrivilegeValueW
ADVAPI32.dll	533		OpenProcessToken
ADVAPI32.dll	31		AdjustTokenPrivileges
ADVAPI32.dll	368		GetTokenInformation
ADVAPI32.dll	133		CopySid
ADVAPI32.dll	622		RegDeleteKeyValueW
ADVAPI32.dll	765		StartTraceW
ADVAPI32.dll	263		EnableTrace
ADVAPI32.dll	110		ControlTraceW
ADVAPI32.dll	103		CloseTrace
ADVAPI32.dll	414		IsValidSid
ADVAPI32.dll	331		GetLengthSid
ADVAPI32.dll	399		InitializeSecurityDescriptor
ADVAPI32.dll	398		InitializeAcl
ADVAPI32.dll	16		AddAccessAllowedAce
ADVAPI32.dll	744		SetSecurityDescriptorDacl
ADVAPI32.dll	194		CryptAcquireContextW
ADVAPI32.dll	210		CryptGenRandom
ADVAPI32.dll	233		DecryptFileA
ADVAPI32.dll	220		CryptReleaseContext
ADVAPI32.dll	289		EventRegister
ADVAPI32.dll	291		EventUnregister
ADVAPI32.dll	287		EventEnabled
ADVAPI32.dll	292		EventWrite
KERNEL32.dll	735		GetSystemDirectoryA
KERNEL32.dll	1584		lstrcmpW
KERNEL32.dll	277		DeleteFileW
KERNEL32.dll	1000		MoveFileExW
KERNEL32.dll	1209		RemoveDirectoryW
KERNEL32.dll	1049		OutputDebugStringW
KERNEL32.dll	581		GetFileAttributesW
KERNEL32.dll	576		GetFileAttributesA
KERNEL32.dll	181		CreateDirectoryA
KERNEL32.dll	957		LeaveCriticalSection
KERNEL32.dll	305		EnterCriticalSection
KERNEL32.dll	1302		SetEvent
KERNEL32.dll	272		DeleteCriticalSection
KERNEL32.dll	863		InitializeCriticalSectionAndSpinCount
KERNEL32.dll	191		CreateEventW
KERNEL32.dll	535		GetCurrentProcess
KERNEL32.dll	1007		MultiByteToWideChar
KERNEL32.dll	471		GetCommandLineW
KERNEL32.dll	609		GetLastError
KERNEL32.dll	975		LocalFree
KERNEL32.dll	243		CreateThread
KERNEL32.dll	384		FindFirstFileW
KERNEL32.dll	1587		lstrcmpiW
KERNEL32.dll	396		FindNextFileW
KERNEL32.dll	373		FindClose
KERNEL32.dll	573		GetExitCodeThread
KERNEL32.dll	134		CloseHandle
KERNEL32.dll	749		GetSystemWindowsDirectoryW
KERNEL32.dll	964		LoadLibraryW
KERNEL32.dll	423		FormatMessageW
KERNEL32.dll	686		GetProcAddress
KERNEL32.dll	427		FreeLibrary
KERNEL32.dll	736		GetSystemDirectoryW
KERNEL32.dll	1495		WaitForSingleObject
KERNEL32.dll	572		GetExitCodeProcess
KERNEL32.dll	1071		ProcessIdToSessionId
KERNEL32.dll	536		GetCurrentProcessId
KERNEL32.dll	1405		Sleep
KERNEL32.dll	720		GetStartupInfoW
KERNEL32.dll	601		GetFullPathNameW
KERNEL32.dll	203		CreateFileW
KERNEL32.dll	632		GetModuleHandleW
KERNEL32.dll	1389		SetUnhandledExceptionFilter
KERNEL32.dll	1101		QueryPerformanceCounter
KERNEL32.dll	540		GetCurrentThreadId
KERNEL32.dll	745		GetSystemTimeAsFileTime
KERNEL32.dll	775		GetTickCount
KERNEL32.dll	1453		UnhandledExceptionFilter
KERNEL32.dll	1420		TerminateProcess
KERNEL32.dll	1048		OutputDebugStringA
KERNEL32.dll	262		DebugBreak
GDI32.dll	380		DeleteDC
GDI32.dll	697		GetStockObject
GDI32.dll	630		GetDeviceCaps
GDI32.dll	860		SelectObject
GDI32.dll	49		CreateCompatibleDC
GDI32.dll	383		DeleteObject
GDI32.dll	67		CreateFontIndirectW
GDI32.dll	714		GetTextExtentPoint32W
USER32.dll	244		EndPaint
USER32.dll	653		MsgWaitForMultipleObjects
USER32.dll	677		PeekMessageW
USER32.dll	186		DialogBoxParamW
USER32.dll	242		EndDialog
USER32.dll	954		UpdateWindow
USER32.dll	594		LoadCursorW
USER32.dll	596		LoadIconW
USER32.dll	877		SetWindowLongW
USER32.dll	239		EnableWindow
USER32.dll	811		SetDlgItemTextW
USER32.dll	330		GetDlgItem
USER32.dll	814		SetFocus
USER32.dll	173		DestroyAcceleratorTable
USER32.dll	272		FillRect
USER32.dll	17		BeginPaint
USER32.dll	757		ReleaseDC
USER32.dll	320		GetDC
USER32.dll	776		SendDlgItemMessageW
USER32.dll	785		SendMessageW
USER32.dll	848		SetRect
USER32.dll	305		GetClientRect
USER32.dll	896		ShowWindow
USER32.dll	912		SystemParametersInfoW
USER32.dll	681		PostMessageW
USER32.dll	926		TranslateAcceleratorW
USER32.dll	94		CreateAcceleratorTableW
USER32.dll	181		DestroyWindow
USER32.dll	899		ShutdownBlockReasonDestroy
USER32.dll	898		ShutdownBlockReasonCreate
USER32.dll	118		CreateWindowExW
USER32.dll	727		RegisterClassExW
USER32.dll	167		DefWindowProcW
USER32.dll	189		DispatchMessageW
USER32.dll	928		TranslateMessage
msvcrt.dll	423		_ftol2_sse
msvcrt.dll	1289		memcpy
msvcrt.dll	1291		memmove
msvcrt.dll	311		_controlfp
msvcrt.dll	362		_except_handler4_common
msvcrt.dll	777		_onexit
msvcrt.dll	157		__dllonexit
msvcrt.dll	964		_unlock
msvcrt.dll	608		_lock
msvcrt.dll	1029		_wcmdln
msvcrt.dll	53		void __cdecl terminate(void) ?terminate@@YAXXZ
msvcrt.dll	228		__setusermatherr
msvcrt.dll	206		__p__fmode
msvcrt.dll	292		_cexit
msvcrt.dll	371		_exit
msvcrt.dll	1198		exit
msvcrt.dll	226		__set_app_type
msvcrt.dll	241		__wgetmainargs
msvcrt.dll	273		_amsg_exit
msvcrt.dll	201		__p__commode
msvcrt.dll	1221		free
msvcrt.dll	290		_callnewh
msvcrt.dll	1277		malloc
msvcrt.dll	998		_vsnprintf
msvcrt.dll	1392		wcschr
msvcrt.dll	1260		iswdigit
msvcrt.dll	1047		_wcsnicmp
msvcrt.dll	1037		_wcsicmp
msvcrt.dll	488		_initterm
msvcrt.dll	1004		_vsnwprintf
msvcrt.dll	1407		wcsrchr
msvcrt.dll	111		_XcptFilter
msvcrt.dll	1293		memset
OLEAUT32.dll		8
OLEAUT32.dll		2
OLEAUT32.dll		6
SHELL32.dll	7		CommandLineToArgvW
SHELL32.dll	438		ShellExecuteExW
SHELL32.dll		730
SHLWAPI.dll	343		StrToIntExW
ntdll.dll	1675		WinSqmEndSession
ntdll.dll	1684		WinSqmSetDWORD
ntdll.dll	1689		WinSqmSetString
ntdll.dll	1690		WinSqmStartSession
dpx.dll	5		DpxNewJob
WTSAPI32.dll	41		WTSQueryUserToken
COMCTL32.dll	123		InitCommonControlsEx
COMCTL32.dll		344
api-ms-win-core-com-l1-1-0.dll	65		CoTaskMemFree
api-ms-win-core-com-l1-1-0.dll	41		CoInitializeSecurity
api-ms-win-core-com-l1-1-0.dll	68		CoUninitialize
api-ms-win-core-com-l1-1-0.dll	40		CoInitializeEx
api-ms-win-core-com-l1-1-0.dll	9		CoCreateInstance

StringTable 040904B0

CompanyName	Microsoft Corporation
FileDescription	Windows Update Standalone Installer
FileVersion	10.0.18362.1 (WinBuild.160101.0800)
InternalName	wusa.exe
LegalCopyright	© Microsoft Corporation. All rights reserved.
OriginalFilename	wusa.exe
ProductName	Microsoft® Windows® Operating System
ProductVersion	10.0.18362.1

VS_FIXEDFILEINFO

FileVersion	10.0.18362.1
ProductVersion	10.0.18362.1
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	0x40004
FileType	1
FileSubtype	0

show previews

offset	size	type	comment
0	305664	EXE	02/07/2027 10:11:00	#
15c1	15	HTM		#
34a60	55762	PNG	(256 x 256)	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] ignoring invalid PEdump::BITMAPINFOHEADER

[?] can't find file_offset of VA 0x30414

wusa.exe-

MZ Header

Rich Header

DOS stub

PE Header

Packer / Compiler

Sections

Data Directory

TLS

StringTable 040904B0

VS_FIXEDFILEINFO

wusa.exe
-