x86 Machine Code Statistics (2008)

> Note that PUSH is twice more common than POP. These instructions are used in pairs for preserving EBP, ESI, EDI, and EDX registers across function calls, and PUSH is also used for passing arguments to functions; that's why it is more frequent.

To expand on why PUSH being used for passing arguments to functions makes it more frequent than POP: The caller of a function will usually push one argument at a time to the stack, but then just use the ADD instruction to put the stack pointer back afterwards. (Or with __stdcall functions, the RET instruction will take an operand that does the same thing.)