The easy way to do what you are trying to do is to use negative values in ecx instead of positive values.
for example, if your sample looks something like:
; Run through four local vars
mov ecx, 1
.l1:
lea eax, [ebp - ecx*4]
; do something with eax as a pointer
inc ecx
cmp ecx, 4
jb .l1
You will get an error on the lea as you described.
But you can do the same thing using negative values, like this:
; Run through four local vars
mov ecx, -1
.l1:
lea eax, [ebp + eax*4]
; do something with eax as a pointer
dec ecx
cmp ecx, -4
jg .l1
Alternatively, if you're just trying to optimize your code and just using the lea to calculate "ebp - ecx*4", the same basic thing works if you do
; EAX = EBP - ECX * 4
neg ecx ; Switch ecx's sign
lea eax, [ebp + ecx*4]
instead of what you are doing
Not totally efficient, but it works
Hope that helps!
