title: Unable to understand a disassembling of a function
body: <p>I've disassembled the following simple function into this And i'm failing to understand a few things. I'd be glad if people could help me out </p>
  
  <p>This is the function i'm disassembling:</p>
  
  <pre><code>int foo(int a, int b, int c){
  
      int t = 4;
      int t2 = 5;
      int t6 = 6;
  
      t = b;
      t2 = c;
  
  
      return (a *= t6);   
  }
  </code></pre>
  
  <p>I invoked it from main function with the following parameters:</p>
  
  <pre><code>foo(2,3,4);
  </code></pre>
  
  <p>And this is what the function has been disassembled into:</p>
  
  <pre><code>.text:004013BE ; _DWORD __cdecl foo(int, int, int)
  .text:004013BE                 public __Z3fooiii
  .text:004013BE __Z3fooiii      proc near               ; CODE XREF: _main+2Dp
  .text:004013BE                                         ; _main+5Cp
  .text:004013BE
  .text:004013BE var_C           = dword ptr -0Ch
  .text:004013BE var_8           = dword ptr -8
  .text:004013BE var_4           = dword ptr -4
  .text:004013BE arg_0           = dword ptr  8
  .text:004013BE arg_4           = dword ptr  0Ch
  .text:004013BE arg_8           = dword ptr  10h
  .text:004013BE
  .text:004013BE                 push    ebp
  .text:004013BF                 mov     ebp, esp
  .text:004013C1                 sub     esp, 10h
  .text:004013C4                 mov     [ebp+var_4], 4
  .text:004013CB                 mov     [ebp+var_8], 5
  .text:004013D2                 mov     [ebp+var_C], 6
  .text:004013D9                 mov     eax, [ebp+arg_4]
  .text:004013DC                 mov     [ebp+var_4], eax
  .text:004013DF                 mov     eax, [ebp+arg_8]
  .text:004013E2                 mov     [ebp+var_8], eax
  .text:004013E5                 mov     eax, [ebp+arg_0]
  .text:004013E8                 imul    eax, [ebp+var_C]
  .text:004013EC                 mov     [ebp+arg_0], eax
  .text:004013EF                 mov     eax, [ebp+arg_0]
  .text:004013F2                 leave
  .text:004013F3                 retn
  .text:004013F3 __Z3fooiii      endp
  </code></pre>
  
  <ul>
  <li>When loading the local variables of the function
  (var_c, var_8, var_4) the ESP pointer is substracted by 10h, 16 in decimal, every variable within our stack memory is <strong>four bytes</strong>, and I have three local variables - hence the ESP pointer should be substracted by 12 ( 0Ch ), why does it get substracted by 16?</li>
  </ul>
  
  <p><strong>( .text:004013C1                 sub     esp, 10h )</strong></p>
  
  <ul>
  <li>In which point the return address of the procedure is saved?, also what about the old ESP?, when is that saved?</li>
  </ul>