Great write-up with some side-notes and history references on what some common exploit shellcode is doing http://blog.fireeye.com/research/2010/08/download_exec_notes.html