Unable to properly analyze a very simple C-compiled program

Question

I'm a RE beginner and I decided to start writing my own simple code for practice.

I wrote a simple code which uses a winAPI function called CreateProcess to start a calc.exe, I've wrote it in C and compiled it using with the official Microsoft SDK with visual studio 2019 as a Release version.

The exe file works with Windows 7 and Windows 10 without any issue.

I searched through IDA and went to the start function which should point where the main user code is, so here are my problems:

1. The start function's analysis has failed and I have failed to find where the code redirects to the CreateProcess function which I used in the code, this is how it looks:

2. When I look up "calc.exe", I find it in a different section, where I'm not used to see it (as compared to the Practical Malware Analysis book examples). This is how it looks:

I have IDA pro 6.8 installed.

This is how the original code looks, the main function only contains a call to the Create() function:

void Create()
{
    STARTUPINFO si;
    PROCESS_INFORMATION pi;

    SecureZeroMemory(&si, sizeof(si));
    si.cb = sizeof(si);
    SecureZeroMemory(&pi, sizeof(pi));

    if (!CreateProcess(L"C:\\Windows\\system32\\calc.exe", NULL, NULL, NULL, FALSE, 0, NULL, NULL, &si, &pi))
    {
        printf("failed, error: %d", GetLastError());
    }
    else {
        printf("Process successfuly started!");
    }
}

EDIT:

I added to linked PDB file that was in the Release folder and IDA works great and it immediately detects the main function!

But I say to myself, if I'm a malware analyst, I will get the EXE file without any PDB file, so what am I to do?

Answer 1

Eventually, I analyzed how the program looks with all the symbols from the PDB file so that I'll know the actual Main function address.

After finding that out, I just searched the file without the PDB to understand what path do I need to take in order to get to the main function from the start function that the MSVC creates.

This solves my problem for future programs compiled with the MSVC aswell.