title: "lea" command in bomb lab phase 4
body: <p>This is my first month of doing assembly and I've been tasked with solving the infamous bomb lab. I've gotten some heavy progress done today but for the life of me I can't figure out exactly what's going on in phase 4. I can tell that it wants an input of two integers (I believe the second one is supposed to be 35?) but I can't figure out some parts of the recursive function it calls. I've commented every line to the best of my ability. </p>
  
  <p>Here's the assembly for the 4th phase:</p>
  
  <pre><code>000000000040103f &lt;phase_4&gt;:
    40103f:   48 83 ec 18             sub    $0x18,%rsp                //INPUT 2 INTEGERS     //ANSWER = 
    401043:   48 8d 4c 24 08          lea    0x8(%rsp),%rcx
    401048:   48 8d 54 24 0c          lea    0xc(%rsp),%rdx
    40104d:   be 0d 28 40 00          mov    $0x40280d,%esi        //This is our numbers, they get put into %esi
    401052:   b8 00 00 00 00          mov    $0x0,%eax            //%eax = 0
    401057:   e8 d4 fb ff ff          callq  400c30 &lt;__isoc99_sscanf@plt&gt;     //scan in the input
    40105c:   83 f8 02                cmp    $0x2,%eax            //make sure there are two integers
    40105f:   75 07                   jne    401068 &lt;phase_4+0x29&gt;        //if there are not 2 integers, jump to bomb
    401061:   83 7c 24 0c 0e          cmpl   $0xe,0xc(%rsp)           // 0xc(%rsp) == 12? (x/s $rsp gives "h\342\377\377\377\177")
    401066:   76 05                   jbe    40106d &lt;phase_4+0x2e&gt; //jump past the detonation
    401068:   e8 17 05 00 00          callq  401584 &lt;explode_bomb&gt;    //BOOM
    40106d:   ba 0e 00 00 00          mov    $0xe,%edx            //%edx = 0xe (14)
    401072:   be 00 00 00 00          mov    $0x0,%esi            //%esi = 0
    401077:   8b 7c 24 0c             mov    0xc(%rsp),%edi           //%edi = 0xc(%rsp)
    40107b:   e8 8c ff ff ff          callq  40100c &lt;func4&gt;           //call fun4
    401080:   83 f8 23                cmp    $0x23,%eax           //%eax == 35?
    401083:   75 07                   jne    40108c &lt;phase_4+0x4d&gt;        //if %eax != 35, jump to detonation
    401085:   83 7c 24 08 23          cmpl   $0x23,0x8(%rsp)              //0x8(%rsp) == 35?
    40108a:   74 05                   je     401091 &lt;phase_4+0x52&gt;        //if so, jump past the detonation
    40108c:   e8 f3 04 00 00          callq  401584 &lt;explode_bomb&gt;        //BOOM
    401091:   48 83 c4 18             add    $0x18,%rsp           //%rsp = 18
    401095:   c3                      retq                    //phase 4 disarmed
  </code></pre>
  
  <p>and here's the assembly for func4, the recursive math function that does some shenanigans:</p>
  
  <pre><code>000000000040100c &lt;func4&gt;:
    40100c:   53                      push   %rbx
    40100d:   89 d0                   mov    %edx,%eax            //%eax = %edx
    40100f:   29 f0                   sub    %esi,%eax            //%eax -= %esi
    401011:   89 c3                   mov    %eax,%ebx            //%ebx = eax
    401013:   c1 eb 1f                shr    $0x1f,%ebx           //shift %ebx right by 0x1f (31)
    401016:   01 d8                   add    %ebx,%eax            //%eax += %ebx
    401018:   d1 f8                   sar    %eax                 //shift %eax right by 1
    40101a:   8d 1c 30                lea    (%rax,%rsi,1),%ebx   //???
    40101d:   39 fb                   cmp    %edi,%ebx          //compare %edi and %ebx
    40101f:   7e 0c                   jle    40102d &lt;func4+0x21&gt;  //if %edi &lt; %ebx, jump to 40102d
    401021:   8d 53 ff                lea    -0x1(%rbx),%edx      //???
    401024:   e8 e3 ff ff ff          callq  40100c &lt;func4&gt;       //RECURSE
    401029:   01 d8                   add    %ebx,%eax            //%eax += %ebx
    40102b:   eb 10                   jmp    40103d &lt;func4+0x31&gt;  //jump to 40103d (done)
    40102d:   89 d8                   mov    %ebx,%eax            //%eax = %ebx
    40102f:   39 fb                   cmp    %edi,%ebx          //compare %edi and %ebx
    401031:   7d 0a                   jge    40103d &lt;func4+0x31&gt;  //if %edi &gt; %ebx, jump to 40103d (done)
    401033:   8d 73 01                lea    0x1(%rbx),%esi       //???
    401036:   e8 d1 ff ff ff          callq  40100c &lt;func4&gt;       //RECURSE
    40103b:   01 d8                   add    %ebx,%eax            //%eax += %ebx
    40103d:   5b                      pop    %rbx                 //done.
    40103e:   c3                      retq   
  </code></pre>
  
  <p>I see the gist of what's going on here (a bunch of math in a recursive function.) But I really don't understand what the lea command  (such as lea    (%rax,%rsi,1),%ebx)  is doing in this instance. I know it's called "load effective address" and what it does <em>in general</em>, but not what it does here.</p>