title: Understanding a recursive IA32 assembly call
body: <p>I'm trying to do some practice to get more comfortable with IA32 assembly, and am struggling a bit on translating this recursive snippet of assembly code to understandable C code. They gave us a hint that all functions in the code give only one argument, but my understanding of the IA32 stack is still a bit poor.</p>
  
  <pre><code>.globl bar
  .type bar, @function
  bar:
  pushl %ebp
  movl %esp, %ebp
  movl 8(%ebp), %eax
  addl $10, %eax
  popl %ebp
  ret
  
  .globl foo
  .type foo, @function
  foo:
  pushl %ebp
  movl %esp, %ebp
  subl $24, %esp
  movl %ebx, -8(%ebp)
  movl %esi, -4(%ebp)
  movl 8(%ebp), %ebx
  movl $1, %eax
  cmpl $1, %ebx
  jle .L5
  movl %ebx, (%esp)
  call bar
  movl %eax, %esi
  subl $1, %ebx
  movl %ebx, (%esp)
  call foo
  imull %esi, %eax
  
  .L5:
  movl -8(%ebp), %ebx
  movl -4(%ebp), %esi
  movl %ebp, %esp
  popl %ebp
  ret
  </code></pre>
  
  <p>The bar function seems easy enough - it adds 10 to the argument and returns. The "foo" function is where I'm getting lost. I understand subl $24, esp reserves 24 bytes of space, but from there I start to lose myself. We seem to recursively call "foo" and decrement the argument (let's call it x)each time until it reaches 1, and then multiply the result of bar(x) by the result of bar(x-1) but everything else that's going on I don't seem to get.</p>
  
  <p>Specifically, what do these two commands do? They come right after subl $24, %esp and I think that's the key to understanding the whole thing.
  movl %ebx, -8(%ebp)
  movl %esi, -4(%ebp)</p>