The argument (x
) is pushed onto the stack before calling the function. After this, the call
instruction will push the return address (2 bytes in this case) onto the stack, and the push bp
at the beginning of the function will push another 2 bytes onto the stack.
So by now you've pushed 2+2 == 4 more bytes onto the stack after the argument. Since the stack grows downward that means that to get the argument you have to offset the pointer by +4 bytes.