title: lea operator in Assembly using three argument arithmetic with registers
body: <p>Yet again, I am having issues finding answers to the most basic of questions. This time I am working on phase 2 of a binary bomb for a class assignment. I'll post the disassembled code below.</p>
  
  <p>I am having a hard time understanding what is happening on line &lt;+107>. From what I understand so far, it is trying to load the address from the arithmetic operation of ((4 * %edx) + %eax) into the %eax register. As of now, which I could very well be wrong, this is what is located in my registers where x, y, z are the three arguments entered in the call to scanf:</p>
  
  <p>%eax: y</p>
  
  <p>%edx: z</p>
  
  <p>Thus, the program is trying to load the address of ((4*z)+y)? I don't know what this value would look like in order for it to be stored into %eax.</p>
  
  <p>My question relates to a specific application of the lea instruction within a binary bomb. I had previously read through the post here: <a href="https://stackoverflow.com/questions/1658294/whats-the-purpose-of-the-lea-instruction">What&#39;s the purpose of the LEA instruction?</a> but I still did not understand how it applied to my scenario.</p>
  
  <pre><code>   0x08048764 &lt;+0&gt;:     sub    $0x3c,%esp
     0x08048767 &lt;+3&gt;:     lea    0x2c(%esp),%eax
     0x0804876b &lt;+7&gt;:     mov    %eax,0x10(%esp)
     0x0804876f &lt;+11&gt;:    lea    0x28(%esp),%eax
     0x08048773 &lt;+15&gt;:    mov    %eax,0xc(%esp)
     0x08048777 &lt;+19&gt;:    lea    0x24(%esp),%eax
     0x0804877b &lt;+23&gt;:    mov    %eax,0x8(%esp)
     0x0804877f &lt;+27&gt;:    movl   $0x8048ba7,0x4(%esp)
     0x08048787 &lt;+35&gt;:    mov    0x804b040,%eax
     0x0804878c &lt;+40&gt;:    mov    %eax,(%esp)
     0x0804878f &lt;+43&gt;:    call   0x8048480 &lt;__isoc99_fscanf@plt&gt;
     0x08048794 &lt;+48&gt;:    cmp    $0x3,%eax
     0x08048797 &lt;+51&gt;:    je     0x80487a5 &lt;phase_2_of_5+65&gt;
     0x08048799 &lt;+53&gt;:    movl   $0x2,(%esp)
     0x080487a0 &lt;+60&gt;:    call   0x80486ef &lt;explode&gt;
     0x080487a5 &lt;+65&gt;:    mov    0x24(%esp),%edx
     0x080487a9 &lt;+69&gt;:    cmp    $0x4,%edx
     0x080487ac &lt;+72&gt;:    jg     0x80487ba &lt;phase_2_of_5+86&gt;
     0x080487ae &lt;+74&gt;:    movl   $0x2,(%esp)
     0x080487b5 &lt;+81&gt;:    call   0x80486ef &lt;explode&gt;
     0x080487ba &lt;+86&gt;:    mov    0x28(%esp),%eax
     0x080487be &lt;+90&gt;:    cmp    $0xa,%eax
     0x080487c1 &lt;+93&gt;:    jle    0x80487cf &lt;phase_2_of_5+107&gt;
     0x080487c3 &lt;+95&gt;:    movl   $0x2,(%esp)
     0x080487ca &lt;+102&gt;:   call   0x80486ef &lt;explode&gt;
     0x080487cf &lt;+107&gt;:   lea    (%eax,%edx,4),%eax
     0x080487d2 &lt;+110&gt;:   cmp    0x2c(%esp),%eax
     0x080487d6 &lt;+114&gt;:   je     0x80487e4 &lt;phase_2_of_5+128&gt;
     0x080487d8 &lt;+116&gt;:   movl   $0x2,(%esp)
     0x080487df &lt;+123&gt;:   call   0x80486ef &lt;explode&gt;
     0x080487e4 &lt;+128&gt;:   add    $0x3c,%esp
     0x080487e7 &lt;+131&gt;:   ret
  </code></pre>