> Note that
PUSH is twice more common than
POP. These instructions are used in pairs for preserving EBP, ESI, EDI, and EDX registers across function calls, and
PUSH is also used for passing arguments to functions; that's why it is more frequent.
To expand on why PUSH being used for passing arguments to functions makes it more frequent than POP: The caller of a function will usually push one argument at a time to the stack, but then just use the ADD instruction to put the stack pointer back afterwards. (Or with __stdcall functions, the RET instruction will take an operand that does the same thing.)
