How did i know that ebx remained zero, couldn't some of the calls that were made have changed
the value of ebx?

Answer:
If you examine these calls that are made you'll see that all of them execept one looks like
this:
:00406C18 53                      push ebx	;Store ebx on the stack! data(1)
:00406C19 56                      push esi	; Store esi on the stack data(2)
:00406C1A 8BF2                    mov esi, edx
:00406C1C 8BD8                    mov ebx, eax
:00406C1E 8BC3                    mov eax, ebx
:00406C20 E8DBFEFFFF              call 00406B00
:00406C25 8BD6                    mov edx, esi
:00406C27 E824FFFFFF              call 00406B50
:00406C2C 8BC3                    mov eax, ebx
:00406C2E 5E                      pop esi	; pop data(2) to Esi
:00406C2F 5B                      pop ebx	; Pop data(1) to ebx
:00406C30 C3                      ret

The stack is (as you should know by now) a LIFO (Last In First Out). This means that when we retrieve data from the stack with pop, we get the data that was stored there with the last push. Now I said all calls exept one. This is the call at 4C000C. It begins with: :0041D35C 55 push ebp :0041D35D 8BEC mov ebp, esp :0041D35F 6A00 push 00000000 :0041D361 53 push ebx :0041D362 56 push esi :0041D363 57 push edi :0041D364 8BF2 mov esi, edx :0041D366 8BD8 mov ebx, eax :0041D368 33C0 xor eax, eax :0041D36A 55 push ebp :0041D36B 68B2D34100 push 0041D3B2 :0041D370 64FF30 push dword ptr fs:[eax] and it ends with: :0041D39C 33C0 xor eax, eax :0041D39E 5A pop edx :0041D39F 59 pop ecx :0041D3A0 59 pop ecx :0041D3A1 648910 mov dword ptr fs:[eax], edx * Possible StringData Ref from Code Obj ->"_^[Y]" | :0041D3A4 68B9D34100 push 0041D3B9 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:0041D3B7(U) | :0041D3A9 8D45FC lea eax, dword ptr [ebp-04] :0041D3AC E81F62FEFF call 004035D0 :0041D3B1 C3 ret What's happening here? Well the push at 0041D3A4 puts the return adress on the stack and when the ret instruction is executed we return to 0041D3B9. wich looks like: :0041D3B9 5F pop edi :0041D3BA 5E pop esi :0041D3BB 5B pop ebx :0041D3BC 59 pop ecx :0041D3BD 5D pop ebp :0041D3BE C3 ret Now everything is correct, ebx's value is the same as when we entered the function. End of NewbieQuestion