title: What Does Windows Do Before Main() is Called?
body: <p>Windows must do something to parse the PE header, load the executable in memory, and pass command line arguments to <code>main()</code>. </p>
  
  <p>Using OllyDbg I have set the debugger to break on main() so I could view the call stack:
  <a href="https://i.stack.imgur.com/LdIfG.png" rel="noreferrer"><img src="https://i.stack.imgur.com/LdIfG.png" alt="http://puu.sh/t5vxB/3d52089d22.png"></a></p>
  
  <p>It seems as if symbols are missing so we can't get the function name, just its memory address as seen. However we can see the caller of main is <code>kernel32.767262C4</code>, which is the callee of <code>ntdll.77A90FD9</code>. Towards the bottom of the stack we see RETURN to <code>ntdll.77A90FA4</code> which I assume to be the first function to ever be called to run an executable. It seems like the notable arguments passed to that function are the Windows' Structured Exception Handler address and the entry point of the executable.</p>
  
  <p>So how exactly do these functions end up in loading the program into memory and getting it ready for the entry point to execute? Is what the debugger shows the entire process executed by the OS before <code>main()</code>?</p>