How do you recognize that a function is saving multiple callee-saved registers and what does it tell you?

The count of push instructions in the prologue (mirrored by pops at the end) tells you how many callee-saved registers — and thus long-lived local values — the function needs.

* A stack of prologue pushes, popped in reversed LIFO order at exit; the count is how many values the function keeps alive across calls. *

my_func:
    push %r13
    push %r12
    push %rbp
    push %rbx
    sub  $0x8, %rsp
    ...
    add  $0x8, %rsp
    pop  %rbx
    pop  %rbp
    pop  %r12
    pop  %r13
    ret

What this tells you:

• The function uses 4 callee-saved registers (%rbx, %rbp, %r12, %r13)
• It needs 4 values to survive across internal function calls
• The sub $0x8, %rsp is for 16-byte stack alignment (4 pushes = 32 bytes, + 8 from call = 40, + 8 padding = 48 = aligned)

Pop order is reversed: Stack is LIFO, so push %r13 first → pop %r13 last.

Rule of thumb:

• 0 pushes = simple leaf function (calls nothing, or doesn't need values to survive)
• 1-2 pushes = moderate function with a few calls
• 3-4+ pushes = complex function with many calls and local state

Go deeper:

• System V AMD64 calling convention — the callee-saved set (rbx, rbp, r12-r15) a prologue preserves
• Stack frame layout on x86-64 — how saved registers and locals sit in the frame