> Note that <i>PUSH</i> is twice more common than <i>POP</i>. These instructions are used in pairs for preserving EBP, ESI, EDI, and EDX registers across function calls, and <i>PUSH</i> is also used for passing arguments to functions; that's why it is more frequent.<p>To expand on why PUSH being used for passing arguments to functions makes it more frequent than POP: The caller of a function will usually push one argument at a time to the stack, but then just use the ADD instruction to put the stack pointer back afterwards. (Or with __stdcall functions, the RET instruction will take an operand that does the same thing.)