What does ret do? Why is ret 0xC needed here? What if it was just ret and not ret 0xC or how about 0x4?
mov eax,[esp+10] // param3
mov ecx,[esp+0C] // param2
mov edx,[esp+08] // param1
push eax
push ecx
push edx
mov ecx,esi
call File.exe+333330
pop esi
ret 000C
In short, ret 00C
cleans up the stack after call File.exe+333330
. Before the call, you pushed three 4-byte values onto the stack (the contents of eax
, ecx
, and edx
). 4 * 3 = 12 = 0xC (in hex). If you had ret
without a value, it would have returned from your subroutine, but wouldn't have cleaned up the stack at all. If you had ret 4
, it would have only cleaned up one of the values. ret 12
or ret 0xC
takes care of all three.
See here for a similar question.