We understand the call principle, first return address onto the stack and then execute the call.
Thus, in the beginning of a function, esp esp still a stack frame at this time point to the return address esp.
This means using mov ebx, esp, the return address after [ebx] is the current function.
We should be aware, SystemCall is to get to zero by this ring, the ring before entering zero will mov ebx, esp.
Thus, when entering the ring zero, _KTRAP_FRAME.ebx esp address is preserved, so [ _KTRAP_FRAME.ebx ] R3 ring is the return value.
This concept you should be clear.