What are the x86 instructions that affect ESP as a side effect?

Question

I know that call and ret will modify the value of esp and that push and pop have a number of variants, but are there other instructions that will affect the stack pointer ?

Answer 1

The following instructions modify the stack pointer as an implicit operand¹:

• call
• enter
• int n/into/int 3
• iret/iretd
• leave
• pop
• push
• ret/retf
• sysenter
• sysexit
• pusha
• popa
• pushf/pushfd/pushfq
• popf/popfd/popfq
• vmlaunch/vmresume
• eexit

Every instruction that can write an arbitrary general-purpose regiser (like imul reg, r/m32, imm8 or add / sub) can write ESP if you want, but it's only interesting to list one where the stack pointer is an operand even if you don't mention it explicitly. I leave to you the burden of telling primary and side effects apart.

Keep in mind that any instruction capable of generating an exception can potentially modify the stack pointer, at least the kernel stack pointer if not user-space.
I've not considered such instructions in order to avoid trivializing your question.

Those are all the instructions I can find by searching the Intel manuals at the time of creation of this answer.
While I did my best scrutinizing the manuals I wouldn't swear to that list.

---

¹ Either SP, ESP or RSP.

Answer 2

The push(a/ad/f) and pop(a/ad/f) instruction groups are modifying the stack pointer (e)sp. Interrupt calls int also modify it. The instruction call will push the return address to the stack and ret removes it. In the form of ret NUMBER additionally that number of bytes are removed from the stack to clean it.

Of course you can use (e)sp in other instructions, like mov or arithmetic instructions like add or sub. It will be represented in the REG, R/M, or BASE fields in the opcode-byte, modR/M-byte, and/or sib-byte.