high addresses
  --------
  ...
  ret_to_func_3
|>fake_ebp3
| ...
| func_2_arg_1
| func_2_arg_0
| ret_to_func_3
|-fake_ebp2<----|
  ...           |
  func_1_arg_1  |
  func_1_arg_0  |
  ret_to_func_2 |
|>fake_ebp1-----|
| ret_to_func_1
|-fake_ebp0
  fillup
  --------
low addresses