I dont understand how does the function take the argument without pushing
mov ebp, esp
and esp, 0FFFFFFF0h
sub esp, 20h
mov [esp+20h+var_20], offset aEnterX ; "Enter X:"
var_20 is likely defined as -20h, so the
mov instruction is actually accessing
[esp]. This puts the argument at the expected location for the called function, but does not change the
esp itself. This approach of argument passing is used by GCC since many years ago. Supposedly this used to be somewhat faster than pushing in some cases, and also changing
esp one time in the prolog makes the stack management easier for the compiler.