When a function returns, the %ebp and %esp registers are reset to point to the stack frame of the calling function.

So effectively, the current stack frame is popped off the stack at the return.

Where is the return value?

Typically an integer return value is placed in a register and this is usally register %eax.

That is, %eax is usually thought of as a general purpose register. But it often has this special use for a function return value.