What do API functions have to do with esp register?

[iaNac]

I'm learning masm32 and used Quick Editor to generate a template that displays a small window.  I've been studying the code and there's a GotoXY procedure that centers the new window on the screen based on the screen ht and wid and the new window ht and wid.  There are mov opcodes that involve esp, such as mov eax, [esp+8].  Question: I thought data was passed to/from API calls using variables.  Is it routine to use esp or other registers?  If so, where do I get the info I need to do this?

Thanks in advance

ps. I can give more code details if necessary but I'm really just looking for a concept answer.

[hutch--]

iaNac,

Welcome on board. If its the one I am thinking of its a procedure with the stack frame removed which involves the memory addresses being handled directly in ESP rather than with EBP in a normal stack frame procedure.

ESP is used as the pointer to the current location of stack memory which is used to pass argumnets to procedures in the normal manner. When you use code like,

Code Select Expand


mov eax, [esp+4]
mov ecx, [esp+8]


You are dereferencing the address stored in ESP and writing the VALUE contained at that address to the two respective registers.

[Hjortur]

Hi iaNac, and welcome aboard!

Parameters are not passed to API functions with variables but rather with the stack.  So if you are calling a function with three parameters
they will be pushed on the stack in reverse order.
e.g.

Code Select Expand

invoke Somefunc, param1,param2,param3
is equal to:

Code Select Expand

push param3
push param2
push param1
call Somefunc


Then these parameters are accesed by esp + offset.  If all parameters are DWORDs the first parameter is at memory address [esp],
param2 is at [esp+4] and param3 at [esp+8]. 
Just remember that the stack grows downward in memory, took a while for me to get it.

Hope that cleared it up!


....And I forgot values from APIs are usually (if not always?) returned in the eax register

[sinsi]

the first parameter is at memory address [esp]

The parameter at [esp] is the return address from the CALL, so param1 is at [esp+4]

[Hjortur]

the first parameter is at memory address [esp]

The parameter at [esp] is the return address from the CALL, so param1 is at [esp+4]

Very sorry I just forgot about that! 
Thanks for correcting me