23 mov [0 + ebx],edi ; buf->edi == 0(ebx) == EDI
\r
24 mov [4 + ebx],esi ; buf->esi == 4(ebx) == ESI
\r
25 mov [8 + ebx],ebp ; buf->ebp == 8(ebx) == EBP
\r
27 mov [20 + ebx],edx ; buf->edx == 20(ebx) == EDX
\r
28 mov [24 + ebx],ecx ; buf->ecx == 24(ebx) == ECX
\r
29 mov [28 + ebx],eax ; buf->eax == 28(ebx) == EAX
\r
31 ; use EBX value saved on stack; not the current value
\r
33 mov [16 + ebx],eax ; buf->ebx == 16(ebx) == EBX
\r
35 ; use ESP value after RET; not the current value
\r
37 mov [12 + ebx],eax ; buf->esp == 32(ebx) == ESP
\r
39 ; use return address of this routine (EIP value saved on stack);
\r
40 ; not the current value
\r
42 mov [32 + ebx],eax ; buf->eip == 36(ebx) == EIP
\r
44 ; none of the PUSH or MOV instructions changed EFLAGS!
\r
46 pop dword [36 + ebx] ; buf->eflags == 40(ebx) == EFLAGS
\r