I got this fake-av sample , and I want to reverse it . But the problem is that it exits after few commands . Here are the steps :
When loaded in Ollydbg it pauses at:
00401000 > $ 8D9404 7713210>LEA EDX,DWORD PTR SS:[ESP+EAX+0x211377]
00401007 . /E9 CF020000 JMP setup.004012DB
then :
004012DB > \BA 0C000000 MOV EDX,0xC
004012E0 . 8B4C24 1C MOV ECX,DWORD PTR SS:[ESP+0x1C]
004012E4 . 41 INC ECX
004012E5 . 09C9 OR ECX,ECX
004012E7 . 75 0C JNZ SHORT setup.004012F5
004012E9 . 0F2ECF UCOMISS XMM1,XMM7
004012EC . 74 13 JE SHORT setup.00401301
and :
00401301 > 89E5 MOV EBP,ESP
00401303 . C3 RETN
then it exits :
7C81776F 50 PUSH EAX
7C817770 E8 8349FFFF CALL kernel32.ExitThread
What exactly happens here , I guess it has to do with the line UCOMISS XMM1,XMM7
but I have no clue what it does ?
UCOMISS
-- Unordered Compare Scalar Single-Precision Floating-Point Values and Set EFLAGS. A better question would be what values are in XMM registers at that point and why.