Introduction to Windows API

stdcall

stdcall is very similar to cdecl with the only exception that the function clears up the stack internally and the caller doesn’t have to care about it. At the end of the function it executes ret 8 which does two operations at once:

• by default it pops the return address into EIP
• if it is called with an operand, like 8 it cleans up the stack with ADD ESP, 8

1
FUN PROC
2
    push    ebp
3
    mov     ebp, esp
4
    mov     eax, [ebp+8]     ; a
5
    add     eax, [ebp+12]    ; + b
6
    pop     ebp
7
    ret     8               ; callee cleans 2 args (8 bytes)
8
FUN ENDP

The caller calls the function the same way as cdecl but after the call, the stack is already cleaned:

1
push b
2
push a
3
call FUN
4
; EAX = result