本地变量arg2存储在哪个内存地址?

我正在处理此代码的过程调用问题,其中最初%ebp=0x800060,%esp=0x800040。我正在查找arg2存储在哪个内存地址。

C代码:

int caller()
{
      int arg1 = 534;
      int arg2 = 1057;
      int sum = swap_add(&arg1, &arg2);
      int diff = arg1 - arg2;
      return sum * diff;
}

程序集代码:

caller:
     pushl %ebp
     movl %esp, %ebp
     subl $24, %esp
     movl $534, -4(%ebp)
     movl $1057, -8(%ebp)
     leal -8(%ebp), %eax
     movl %eax, 4(%esp)
     leal -4(%ebp), %eax
     movl %eax, (%esp)
     call swap_add

以下是可能的答案选择:

1. 0x80003C
2. 0x800040
3. 0x800038
4. 0x800034
5. 0x800024

我一直遵循代码,发现arg2存储在0x800028,这不在上面的答案中。我将通过下面的评论展示我的数学:

caller:
     pushl %ebp  /* ebp pushed onto stack, esp decrease counter by 4, becomes: 0x80003C */
     movl %esp, %ebp /* copies value to ebp, ebp & esp = 0x80003C */
     subl $24, %esp /* 24 is 0x18, esp= 0x800024 */
     movl $534, -4(%ebp) /* arg1 stored at address 0x800038 */
     movl $1057, -8(%ebp) /* arg2 stored at address 0x800034 */
     leal -8(%ebp), %eax /* store arg2 at eax */
     movl %eax, 4(%esp) /* copy arg2 to esp increased by counter of 4, esp + 0x4 = 0x800024 +
     0x4 = 0x800028, so arg2 is stored at 0x800028 */
     leal -4(%ebp), %eax /*same process but arg 1 is copied to esp*/
     movl %eax, (%esp)
     call swap_add

所以你可以看到,我最终得到了0x800028。我确信我的数学有些地方错了,但我还是一个组装初学者,所以我不知道在哪里。任何帮助都将不胜感激。