When you use "pushl" it substracts 4 bytes from your esp. The reason why you see 1 is because after the pushl was used, it moves the memory to other location so 0xffffcb60 is not storing the "85" and the value you can see is whatever was before calling pushl.