What's happening in the assembly main function?

Question

I'm currently inspecting a 32-bit malware executable in a WinXP VM using IDA Pro (free version). I don't understand what's happening in the main function here.

Where should I set the breakpoints (IDA Pro, OllyDbg) to see the content of the variables actually pushed onto the stack while debugging? I've previously set one breakpoint at offset 00401230(beginning main) and 004012C6(end main), but I don't really see the strings (variable values) turn up when observing the e.g. the stack pane in OllyDbg. I'm not sure what I'm doing wrong.

Opening the strings window in OllyDbg, I can see some of the strings - I assume, will be used within main's function calls, including szServerName and szPassword.

As we can see, there's three functions that are being called within main:

sub_401000 (called 7x; Pastebin)

sub_401170 (called 1x; Pastebin)

sub_401090 (called 1x; Pastebin)

Sidenote: Taking the feedback into account I've decided to post the other functions in Pastebin (see links above). Posting only the main function here, allows me to keep the post concise.

.text:00401230                   proc            _main near              ; CODE XREF: ___tmainCRTStartup+15Ap 
.text:00401230                                                           ; int __cdecl main(int argc,const char **argv,const char *envp)
.text:00401230                   argc            = dword ptr  8    
.text:00401230                   argv            = dword ptr  0Ch
.text:00401230                   envp            = dword ptr  10h
.text:00401230
.text:00401230 55                                push    ebp
.text:00401231 8B EC                             mov     ebp, esp
.text:00401233 68 C0 B9 40 00                    push    offset szServerName 
.text:00401238 68 00 A0 40 00                    push    offset unk_40A000   
.text:0040123D E8 BE FD FF FF                    call    sub_401000          
.text:00401242 83 C4 08                          add     esp, 8
.text:00401245 68 C0 B3 40 00                    push    offset szUserName  
.text:0040124A 68 00 A1 40 00                    push    offset unk_40A100  
.text:0040124F E8 AC FD FF FF                    call    sub_401000                     
.text:00401254 83 C4 08                          add     esp, 8
.text:00401257 68 C0 BF 40 00                    push    offset szPassword  
.text:0040125C 68 00 A2 40 00                    push    offset unk_40A200
.text:00401261 E8 9A FD FF FF                    call    sub_401000
.text:00401266 83 C4 08                          add     esp, 8
.text:00401269 68 C0 B7 40 00                    push    offset szLocalFile 
.text:0040126E 68 08 A3 40 00                    push    offset unk_40A308
.text:00401273 E8 88 FD FF FF                    call    sub_401000
.text:00401278 83 C4 08                          add     esp, 8
.text:0040127B 68 C0 BB 40 00                    push    offset unk_40BBC0  
.text:00401280 68 08 A4 40 00                    push    offset unk_40A408  
.text:00401285 E8 76 FD FF FF                    call    sub_401000
.text:0040128A 83 C4 08                          add     esp, 8
.text:0040128D 68 C0 BD 40 00                    push    offset unk_40BDC0
.text:00401292 68 08 A5 40 00                    push    offset unk_40A508
.text:00401297 E8 64 FD FF FF                    call    sub_401000
.text:0040129C 83 C4 08                          add     esp, 8
.text:0040129F 68 C0 C1 40 00                    push    offset szRemoteFile
.text:004012A4 68 08 A6 40 00                    push    offset unk_40A608
.text:004012A9 E8 52 FD FF FF                    call    sub_401000
.text:004012AE 83 C4 08                          add     esp, 8
.text:004012B1 68 C0 B7 40 00                    push    offset szLocalFile ; lpszLocalFile
.text:004012B6 E8 B5 FE FF FF                    call    sub_401170
.text:004012BB 83 C4 04                          add     esp, 4
.text:004012BE E8 CD FD FF FF                    call    sub_401090
.text:004012C3 33 C0                             xor     eax, eax
.text:004012C5 5D                                pop     ebp
.text:004012C6 C3                                retn
.text:004012C6                   endp            _main

I'm grateful for any pointers and explanations to help me on my way to understand the main function.

Answer 1

the disassembly You posted for sub 401000 is incomplete

this is a limited explanation
it checks the provided buffer (0x40A000 in the first call for the first null terminator )
and possibly decrypts it and memcpy() the decrypted string to szUserName

(the part is missing in your post (everything that happens after 0x401025 the jz path)

look at disassembly it says it takes two arguments arg_0 and arg_4

so the two arguments for the first call to this function are

push    offset szServerName  << this is a pointer to a string
push    offset unk_40A000    << this is some address that ida isn't sure of
call    sub_401000           << calls the functions

so inside the call

it initializes a counter (ebp+var4) or (ebp-4) to 0
it initialises eax to arg_0 or ebp+8 =>0x40A000 for first call
takes a byte form this address 0x40a000 + counter (0,1,2,3,....n...) to ecx
and checks for \x0 and loops until a \x0 is found
when a null terminator is found it jumps to 0x401025 (missing part)

Answer 2

I recommend starting from the beginning of main(), as you are, and single-stepping through each instruction. In OllyDbg, the keybinding for single-step-into is F7. Every time you press F7, the debugger will execute a single instruction, and you can look at the stack (lower-right window pane) and registers (upper-right window pane) to see how they were affected by the instruction that you just executed. Remember that the highlighted instruction in OllyDbg is the next instruction to be executed when you press F7. Also, when you want to skip over a CALL (such as an API call), use F8 to "step over" the instruction rather than into.

If you are looking for some introductory material to software reverse engineering and malware analysis, OpenSecurityTraining.info may help. Full disclosure: I contributed to that website. You can follow this progression of courses on that website:

1. Introductory Intel x86
2. (optional) Intermediate Intel x86
3. (optional) Life of Binaries
4. Introduction to Reverse Engineering Software
5. (optional) Malware Dynamic Analysis
6. Reverse Engineering Malware

If you are completely new to programming, then you should start with a good Introduction to C Programming online course, especially basic data structures and algorithms.