我反转了一个 ELF x86，我想了解为什么返回地址会再次压入堆栈？它应该已经存在于那里。

main:
lea    ecx, [esp+0x4 {argc}]
and    esp, 0xfffffff0
push   dword [ecx-0x4 {__return_addr}] {var_4}
push   ebp, {var_8}
mov    ebp, esp
push   edi {var_c}
push   ecx {argc} {var_10}
sub    esp, 0xb0
mov    eax, dword [ecx+0x4 {argv}]
mov    dword [ebp-0x9c {var_a4}], eax
mov    eax, dword [gs:0x14]
mov    dword [ebp-0xc {var_14}], eax
xor    eax, eax {0x0}
cmp    dword [ecx {argc}], 0x2
je     0x80485ae
...