If it can help better :
Code:
55 push ebp
8B EC mov ebp, esp
81 EC 00 06 00 00 sub esp, 600h
8B 4D 10 mov ecx, [ebp+Format]
53 push ebx
56 push esi
8D 45 14 lea eax, [ebp+Args]
57 push edi
50 push eax
51 push ecx
- Blue -> You keep always the first byte, and if there is only one ignore what you see after. (like 'ebp' in the first line)
- Green -> When you see e*x is used, you can keep the byte
Others = could be changed.
__________________