diff --git a/.vscode/launch.json b/.vscode/launch.json
index b438376..c265161 100644
--- a/.vscode/launch.json
+++ b/.vscode/launch.json
@@ -9,7 +9,7 @@
             "type": "cppdbg",
             "request": "launch",
             "program": "${workspaceFolder}/src/lisp/lisp",
-            "args": ["test-macros.lisp"],
+            "args": ["test-closures.lisp"],
             "stopAtEntry": false,
             "cwd": "${workspaceFolder}/src/lisp",
             "environment": [],
diff --git a/src/lisp/call_list.s b/src/lisp/call_list.s
index da0c00c..72d6277 100644
--- a/src/lisp/call_list.s
+++ b/src/lisp/call_list.s
@@ -7,12 +7,16 @@
 	;;; This function should call it's first argument with the arguments from
 	;;; the cons-list passed as its second argument.
 
-	;;; _call_list(function pointer, cons list)
+	;;; _call_list(function pointer, cons list, edi)
 _call_list:
+	;; esi and edi are callee-saved on x86, these are the only registers 
+	;; we clobber.
+	push esi
+	push edi
 	push ebp
 	mov ebp, esp
 
-	mov edi, [ebp + 12]						; Cons list
+	mov edi, [ebp + 20]						; Cons list
 	
 	push edi
 	call length								; Length of cons list in eax
@@ -49,9 +53,12 @@
 	jmp .loop
 
 .done:
-	mov ebx, [ebp + 8]						; Function pointer
+	mov ebx, [ebp + 16]						; Function pointer
+	mov edi, [ebp + 24]						; Closure data pointer
 	call ebx
 
 	mov esp, ebp
 	pop ebp
+	pop edi
+	pop esi
 	ret
diff --git a/src/lisp/compiler.dasc b/src/lisp/compiler.dasc
index 8c876d3..8d96a52 100644
--- a/src/lisp/compiler.dasc
+++ b/src/lisp/compiler.dasc
@@ -3,6 +3,7 @@
 #include "compiler.h"
 #include "lib/std.h"
 #include "plat/plat.h"
+#include "gc.h"
 
 #include <dasm_proto.h>
 #include <dasm_x86.h>
@@ -32,8 +33,6 @@
 dasm_State *d;
 unsigned int npc = 8;
 
-extern void _do_gc(unsigned int ebp, unsigned int esp);
-
 |.macro run_gc;
 | mov eax, esp;
 | push ebp;
@@ -88,8 +87,8 @@
 }
 
 struct dasm_State *compile_function(value_t args, enum namespace namespace,
-                                    struct environment *env,
-									struct local *local_out, int *nargs)
+                                    struct environment *env, struct local *local_out,
+                                    struct local *local_parent, int *nargs)
 {
 	dasm_State *d;
 	dasm_State **Dst = &d;
@@ -114,20 +113,17 @@
 	memset(local.stack_slots, 0, sizeof(bool) * 4);
 	local.num_stack_slots = 4;
 	local.num_stack_entries = 0;
+	local.num_closure_slots = 0;
+	local.parent = local_parent;
 
 	dasm_growpc(&d, local.npc);
 
 	// Generate code
 	// TODO: first pass, extract bound and free variables
 
-	value_t name = car(args);
-	args = cdr(args);
 	value_t arglist = car(args);
 	value_t body = cdr(args);
 
-	if ((name & HEAP_MASK) != SYMBOL_TAG)
-		err("function name must be a symbol");
-
 	value_t a = arglist;
 	for (int i = 0; !nilp(a); a = cdr(a), i++)
 	{
@@ -163,6 +159,9 @@
 		*nargs = length(arglist);
 
 	return d;
+
+	// TODO: local leaks memory! free variables too, not just stack slots (in
+	// two places). Add a free_local() function that does this.
 }
 
 void compile_tl(value_t val, struct environment *env)
@@ -173,8 +172,6 @@
 	value_t form = car(val);
 	value_t args = cdr(val);
 
-	printf("Compiling function %s in %s\n", (char *)(car(args) ^ SYMBOL_TAG), (char *)(form ^ SYMBOL_TAG));
-
 	if (symstreq(form, "defun") || symstreq(form, "defmacro"))
 	{
 		enum namespace namespace = NS_FUNCTION;
@@ -182,10 +179,9 @@
 		if (symstreq(form, "defmacro"))
 			namespace = NS_MACRO;
 
-
 		struct local local;
 		int nargs;
-		dasm_State *d = compile_function(args, namespace, env, &local, &nargs);
+		dasm_State *d = compile_function(cdr(args), namespace, env, &local, NULL, &nargs);
 
 		add_function(env, (char *)(car(args) ^ SYMBOL_TAG), link(&d),
 		             nargs, namespace);
@@ -209,7 +205,7 @@
 		value_t expr = cdr(args);
 		for (; !nilp(expr); expr = cdr(expr))
 		{
-			walk_and_alloc(local, expr);
+			walk_and_alloc(local, car(expr));
 		}
 
 		local_free(local, slot);
@@ -241,7 +237,6 @@
 
 	while (read1(is, &val))
 	{
-		printval(val, 0);
 		compile_tl(val, &env);
 	}
 
@@ -278,6 +273,25 @@
 	}
 }
 
+void compile_variable(struct variable *v, dasm_State *Dst)
+{
+	switch (v->type)
+	{
+	case V_ARGUMENT:
+		| mov eax, dword [ebp + (value_size * (v->number + 2))];
+		break;
+	case V_BOUND:
+		| mov eax, dword [ebp - ((v->number + 1) * value_size)];
+		break;
+	case V_FREE:
+		// edi is the closure context pointer
+		| mov eax, dword [edi + (v->number * value_size)];
+		break;
+	default:
+		err("Sorry, can only access V_ARGUMENT, V_FREE and V_BOUND variables for now :(");
+	}
+}
+
 void compile_expression(struct environment *env, struct local *local,
                         value_t val, dasm_State **Dst)
 {
@@ -401,6 +415,55 @@
 
 			| pop eax;
 		}
+		else if (symstreq(fsym, "lambda"))
+		{
+			// Compile the function with this as the parent scope
+			struct local new_local;
+			int nargs_out;
+			dasm_State *d = compile_function(args, NS_ANONYMOUS, env, &new_local, local, &nargs_out);
+
+			// Link the function
+			void *func_ptr = link(&d);
+
+			// Create a closure object with the correct number of captures at
+			// runtime
+			| mov ebx, (create_closure);
+			| push (new_local.num_closure_slots);
+			| push (nargs_out);
+			| push (func_ptr);
+			| call ebx;
+			| add esp, 12;
+
+			// Walk the generated local scope for V_FREE variables, since each
+			// of these exists in our scope (or higher), evaluate it and set it
+			// as a member of the lambda capture.
+
+			for (struct variable *var = new_local.first; var; var = var->prev)
+			{
+				if (var->type == V_FREE)
+				{
+					// Closure in eax
+					| push eax;
+					// Variable now in eax
+					compile_variable(find_variable(local, var->name), Dst);
+					| push eax;
+
+					| mov ebx, (set_closure_capture_variable);
+					// The capture offset
+					| push (var->number);
+					| call ebx;
+					// Skip the value and index
+					| add esp, 8;
+					// Pop the closure back in to eax
+					| pop eax;
+				}
+			}
+
+			// Closure is still in eax
+
+			dasm_free(&d);
+			free(new_local.stack_slots);
+		}
 		else
 		{
 			struct function *func =
@@ -432,16 +495,12 @@
 			{
 				value_t expanded_to = call_list(func, args);
 
-				printf("Macro expanded to:\n");
-				printval(expanded_to, 2);
-
 				compile_expression(env, local, expanded_to, Dst);
 			}
 		}
 	}
 	else if (symbolp(val))
 	{
-		// For now ignore global variables, only search locally
 		struct variable *v = find_variable(local, (char *)(val ^ SYMBOL_TAG));
 
 		if (!v)
@@ -450,17 +509,7 @@
 			err("Variable unbound");
 		}
 
-		switch (v->type)
-		{
-		case V_ARGUMENT:
-			| mov eax, dword [ebp + (value_size * (v->number + 2))];
-			break;
-		case V_BOUND:
-			| mov eax, dword [ebp - ((v->number + 1) * value_size)];
-			break;
-		default:
-			err("Sorry, can only access V_ARGUMENT and V_BOUND variables for now :(");
-		}
+		compile_variable(v, Dst);
 	}
 }
 
@@ -508,12 +557,30 @@
 	for (; v && strcmp(v->name, name) != 0; v = v->prev)
 	{}
 
+	if (!v)
+	{
+		if (local->parent)
+		{
+			v = find_variable(local->parent, name);
+
+			if (v)
+			{
+				// We found this in a parent scope, add it as a V_FREE variable to skip the search.
+				v = add_variable(local, V_FREE, name, local->num_closure_slots++);
+			}
+		}
+	}
 	return v;
 }
 
-extern value_t _call_list(void *addr, value_t list);
+extern value_t _call_list(void *addr, value_t list, value_t *edi);
 
 value_t call_list(struct function *func, value_t list)
 {
-	return _call_list(func->code_ptr, list);
+	return _call_list(func->code_ptr, list, NULL);
+}
+
+value_t call_list_closure(struct closure *c, value_t list)
+{
+	return _call_list(c->function, list, c->data);
 }
diff --git a/src/lisp/compiler.h b/src/lisp/compiler.h
index 0b61c14..07928d2 100644
--- a/src/lisp/compiler.h
+++ b/src/lisp/compiler.h
@@ -7,8 +7,12 @@
 
 enum namespace
 {
+	/// A function
 	NS_FUNCTION,
+	/// A macro
 	NS_MACRO,
+	/// An anonymous function (a lambda/closure)
+	NS_ANONYMOUS,
 };
 
 struct function
@@ -63,13 +67,39 @@
 	int npc;
 	int nextpc;
 	bool *stack_slots;
-	int num_stack_slots, num_stack_entries;
+	/// Number of slots allocated in `stack_slots`
+	int num_stack_slots;
+	/// Number of entries used in `stack_slots`
+	int num_stack_entries;
+	/// Number of closure slots total (allocated as V_FREE variables)
+	int num_closure_slots;
 };
 
 void compile_expression(struct environment *env, struct local *local,
                         value_t val, dasm_State **Dst);
 
 /**
+ * Compile a function
+ * @param args The function args and body, e.g. `((b c) d)`
+ * @param namespace The function namespace.
+ * @param env The environment.
+ * @param local_out The local environment generated for this function will be
+ * returned here. NULL if you do not care about it being returned (you probably
+ * should since you need to free the stack slot allocation map).
+ * @param local_parent Parent local environment, only needed for closures. NULL
+ * if no parent.
+ * @param nargs The number of arguments for this function will be returned here.
+ * NULL if you don't care about it.
+ * @returns The compiled function state. You should probably give this to
+ * `add_function` or something similar.
+ */
+struct dasm_State *compile_function(value_t args, enum namespace namespace,
+                                    struct environment *env, struct local *local_out,
+                                    struct local *local_parent, int *nargs);
+
+void compile_variable(struct variable *v, dasm_State *Dst);
+
+/**
  * Compile a backquoted expression
  */
 void compile_backquote(struct environment *env, struct local *local,
@@ -94,11 +124,17 @@
 struct function *find_function(struct environment *env, char *name);
 struct variable *add_variable(struct local *local, enum var_type type,
                               char *name, int number);
-// Might return null
+
+/**
+ * Find a variable in `local` with name `name`.
+ * @returns The variable, NULL if not found.
+ */
 struct variable *find_variable(struct local *local, char *name);
+
 void destroy_local(struct local *local);
 
 /**
  * Like `apply` in lisp, calls func with list args and returns the result.
  */
 value_t call_list(struct function *func, value_t list);
+value_t call_list_closure(struct closure *c, value_t list);
diff --git a/src/lisp/gc.c b/src/lisp/gc.c
index 16ec471..8820ef5 100644
--- a/src/lisp/gc.c
+++ b/src/lisp/gc.c
@@ -39,6 +39,16 @@
 				_mark(cons->cons.cdr, marked);
 				break;
 			}
+			case CLOSURE_TAG: {
+				struct closure_alloc *closure = (void *)alloc;
+
+				for (int i = 0; i < closure->closure.num_captured; i++)
+				{
+					_mark(closure->closure.data[i], marked);
+				}
+
+				break;
+			}
 			}
 		}
 	}
diff --git a/src/lisp/lib/std.c b/src/lisp/lib/std.c
index 485bf49..028dd3d 100644
--- a/src/lisp/lib/std.c
+++ b/src/lisp/lib/std.c
@@ -39,6 +39,17 @@
 	return nil;
 }
 
+value_t l_apply(value_t func, value_t args)
+{
+	if (!closurep(func))
+		return nil;
+
+	if (!listp(args))
+		return nil;
+
+	return call_list_closure((struct closure *)(func ^ CLOSURE_TAG), args);
+}
+
 void add_function(struct environment *env, char *name, void *func, int nargs, enum namespace ns)
 {
 	struct function *last, *new = malloc(sizeof(struct function));
@@ -65,4 +76,6 @@
 	add_function(env, "cons", cons, 2, NS_FUNCTION);
 
 	add_function(env, "print", l_printval, 1, NS_FUNCTION);
+
+	add_function(env, "apply", l_apply, 2, NS_FUNCTION);
 }
diff --git a/src/lisp/lib/std.h b/src/lisp/lib/std.h
index 5162bab..9070de8 100644
--- a/src/lisp/lib/std.h
+++ b/src/lisp/lib/std.h
@@ -4,6 +4,7 @@
 #include "../lisp.h"
 
 value_t l_plus(value_t a, value_t b);
+value_t l_printval(value_t val);
 
 void add_function(struct environment *env, char *name, void *func, int nargs, enum namespace ns);
 void load_std(struct environment *env);
diff --git a/src/lisp/lisp.c b/src/lisp/lisp.c
index 1056db7..b619033 100644
--- a/src/lisp/lisp.c
+++ b/src/lisp/lisp.c
@@ -73,7 +73,8 @@
 	if (is->peek(is) == ';')
 	{
 		while (is->get(is) != '\n')
-		{}
+		{
+		}
 
 		// Only time I ever use labels is for stuff like this. Compiler would
 		// probably optimize this if I used recursion but I don't want to
@@ -234,6 +235,12 @@
 	{
 		printf("nil\n");
 	}
+	else if (closurep(v))
+	{
+		struct closure *c = (void *)(v ^ CLOSURE_TAG);
+		printf("closure %p taking %d argument(s) and capturing %d value(s)\n",
+		       c->function, c->num_args, c->num_captured);
+	}
 	else
 	{
 		printf("<unknown %d>\n", v);
@@ -452,7 +459,12 @@
 
 bool heapp(value_t v)
 {
-	return consp(v) || stringp(v) || symbolp(v);
+	return consp(v) || stringp(v) || symbolp(v) || closurep(v);
+}
+
+bool closurep(value_t v)
+{
+	return (v & HEAP_MASK) == CLOSURE_TAG;
 }
 
 bool listp(value_t v)
@@ -575,3 +587,27 @@
 
 	return c->name;
 }
+
+value_t create_closure(void *code, int nargs, int ncaptures)
+{
+	struct closure_alloc *ca = malloc_aligned(sizeof(struct closure_alloc) +
+	                                          ncaptures * sizeof(value_t));
+
+	ca->closure.function = code;
+	ca->closure.num_args = nargs;
+	ca->closure.num_captured = ncaptures;
+
+	add_this_alloc(&ca->alloc, CLOSURE_TAG);
+
+	return (value_t)(&ca->closure) | CLOSURE_TAG;
+}
+
+void set_closure_capture_variable(int index, value_t value, value_t closure)
+{
+	if (!closurep(closure))
+		return;
+
+	struct closure *c = (void *)(closure ^ CLOSURE_TAG);
+
+	c->data[index] = value;
+}
diff --git a/src/lisp/lisp.h b/src/lisp/lisp.h
index 675cc96..7c0e571 100644
--- a/src/lisp/lisp.h
+++ b/src/lisp/lisp.h
@@ -41,7 +41,11 @@
 
 struct closure
 {
+	/// How many arguments does this closure take
 	int num_args;
+	/// How many free variables does it capture (i.e. length of `data`)
+	int num_captured;
+	/// The function pointer itself
 	void *function;
 
 	/// This will be passed in edi.
@@ -153,6 +157,7 @@
 bool listp(value_t v);
 bool nilp(value_t v);
 bool heapp(value_t v);
+bool closurep(value_t v);
 int length(value_t v);
 value_t elt(value_t v, int index);
 
@@ -162,5 +167,13 @@
 
 bool symstreq(value_t sym, char *str);
 
+value_t create_closure(void *code, int nargs, int ncaptures);
+
+/**
+ * Set the `index`th capture variable of `closure`. This should really only be
+ * called when creating a new closure.
+ */
+void set_closure_capture_variable(int index, value_t value, value_t closure);
+
 extern value_t nil;
 extern value_t t;
diff --git a/src/lisp/test-closures.lisp b/src/lisp/test-closures.lisp
new file mode 100644
index 0000000..1311a98
--- /dev/null
+++ b/src/lisp/test-closures.lisp
@@ -0,0 +1,5 @@
+(defun main ()
+  (let1 (number 3)
+    (let1 (adds-3 (lambda (n)
+                    (+ n number)))
+      (print (apply adds-3 '(4))))))