Trouble analyzing a ransomware

Question

I got this fake-av sample , and I want to reverse it . But the problem is that it exits after few commands . Here are the steps :

When loaded in Ollydbg it pauses at:

00401000 > $  8D9404 7713210>LEA EDX,DWORD PTR SS:[ESP+EAX+0x211377]
00401007   . /E9 CF020000    JMP setup.004012DB 

then :

004012DB   > \BA 0C000000    MOV EDX,0xC
004012E0   .  8B4C24 1C      MOV ECX,DWORD PTR SS:[ESP+0x1C]
004012E4   .  41             INC ECX
004012E5   .  09C9           OR ECX,ECX
004012E7   .  75 0C          JNZ SHORT setup.004012F5
004012E9   .  0F2ECF         UCOMISS XMM1,XMM7
004012EC   .  74 13          JE SHORT setup.00401301

and :

00401301   >  89E5           MOV EBP,ESP
00401303   .  C3             RETN

then it exits :

7C81776F    50               PUSH EAX
7C817770    E8 8349FFFF      CALL kernel32.ExitThread

What exactly happens here , I guess it has to do with the line UCOMISS XMM1,XMM7 but I have no clue what it does ?

Answer 1

the jnz at 4012e7' should be taken if 401000 is PeHeader->EntryPoint

your post indicates that it has not been taken invesitage who messed up with SEH CHAIN

esp+1c normally holds EndOfSehChain (0xffffffff) when broken on EntryPoint see SehProlog() in Kernel32!BaseProcessStart()

cdb -c "bp calc+@@c++(( (ntdll!_IMAGE_NT_HEADERS *)  @@masm(calc+by(calc+3c)))->OptionalHeader.AddressOfEntryPoint);g;!exchain;dd @esp+1c l2;q" calc

output

Breakpoint 0 hit
0007ffe0: kernel32!_except_handler3+0 (7c839ad8)
  CRT scope  0, filter: kernel32!BaseProcessStart+29 (7c8438ea)
                func:   kernel32!BaseProcessStart+3a (7c843900)
Invalid exception stack at ffffffff
0007ffe0  ffffffff 7c839ad8
quit:

debugger does not mess with this value

sample code to check (esp+1c) at EP

ucomisstest>type ucomisstest.cpp
#include <stdio.h>
char strin[] = { "hello baby\n" };
char strun[] = { "hello babie\n" };
char stron[] = { "hello barbie\n" };
int main (void)    {
    __asm {    mov ecx, dword ptr ds:[esp+1ch]
               inc ecx    or ecx,ecx
            jnz noseh
            ucomiss xmm1,xmm7
            je exit
            lea eax, strun
            push eax
            call printf
            pop eax
exit:
        lea eax, strin
            push eax
            call printf
            pop eax
noseh:
        lea eax, stron
            push eax
            call printf
            pop eax
    } return 0;    }    
\ucomisstest>cl /nologo ucomisstest.cpp
ucomisstest.cpp    
\ucomisstest>ucomisstest.exe
hello barbie