What registers get 'clobered' by windows functions? For sure, eax, ecx, and edx do, but what about ebx? Also I know that esi and edi have to be preserved in a winproc proceedure and it should be safe to assume ebp is preserved.

eax...clobered
ebx...??&?
ecx...clobered
edx...clobered
edi...save and restore in winproc otherwise safe?
esi...save and restore in winproc otherwise safe?
ebp...safe

surely someone has an answer for ebx, edi and esi?...johnfound?

ebx, edi and esi are protected by 99% of windows functions (IE pushed before and pop'd after if used)

mov esi, 99h
mov ebx, 99h
mov edi, 99h
call [WINDOWS API]
;ESI = EDI = EBX

thanks r22...do you have any links on this subject? Or actually any links you think may be of use? Thanks again.

i can't think up of an API that doesn't preserve the three for normal use, it's stdcall standard (and common sense). if you're just coding low, ebp can also be used as a general-purpose register (and quite handy too). esi/edi should be saved for string operations, so ebx/ebp could be used. it's all preference.

And remember that you need to preserve ebx,esi,edi,ebp yourself in callbacks, as well as the direction flag.

thanks drocon and f0dder...