title: Why" sub esp, 96", "lea eax, [esp+16]" and "mov [esp+4], eax"? (asm intel syntax)
body: <p>I'm trying to learn assembly (Intel syntax) by reverse engineering assembly code created by GNU with the help of IDA. I have an extremely hard time to understand references to memory addresses in Assembly and would really appreciate if someone could comment the code below and explain what is really happening.</p>
  
  <p>It's the following C program:</p>
  
  <pre><code>#include &lt;stdio.h&gt;
  
  int main(void)
  {
      char *input[20];
  
      scanf("%s", &amp;input);
      printf("%s", input);
  
      return 0;
  }
  </code></pre>
  
  <p>Assembly with Intel syntax:</p>
  
  <pre><code>push    ebp
  mov     ebp, esp
  
  and     esp, -16
  sub     esp, 96                             ; char *input[20]
  
                                              ; scanf("%s", &amp;input)
  lea     eax, [esp+16]                       ; move the effective address of [esp+16] into EAX
  mov     [esp+4], eax                        ; &amp;input
  mov     dword ptr [esp], offset aS          ; %s
  call    _scanf
  
                                              ; printf("%s", input)
  lea     eax, [esp+10]                       ; move the effective address of [esp+10] into EAX
  mov     [esp+4], eax                        ; input
  mov     dword ptr [esp], offset aS          ; %s
  call    _printf     
  
  mov     eax, 0
  leave
  ret
  </code></pre>
  
  <p><strong>Question 1:</strong>
  Why has the compiler subtracted 96 from ESP when the variable contains 20? What are all the extra bytes for and how did the compiler end up on that number?</p>
  
  <pre><code>sub     esp, 96
  </code></pre>
  
  <p><strong>Question 2:</strong>
  Why did the compiler choose ESP+16? Why not, for example, ESP+5 or ESP+10? </p>
  
  <pre><code>lea     eax, [esp+16]
  mov     [esp+4], eax
  </code></pre>
  
  <p>Really appreciate your help.</p>