I have something here for you guys.
option casemap:none
option frame:auto
OPTION WIN64:15
OPTION ARCH:SSE
OPTION STACKBASE:RSP
.code
proc1 proc public FRAME uses xmm6 xmm7 xmm8 xmm9 xmm10 rsi rdi r12 cols: qword, rows : qword
dec rows
.if rows>=1
invoke proc1, cols, rows
.endif
ret
proc1 endp
end
It disassembles to:
proc1:
000000013F611020 mov qword ptr [rsp+8],rcx
000000013F611025 mov qword ptr [rsp+10h],rdx
000000013F61102A push rsi
000000013F61102B push rdi
000000013F61102C push r12
000000013F61102E sub rsp,70h
000000013F611032 movdqa xmmword ptr [rsp+20h],xmm6
000000013F611038 movdqa xmmword ptr [rsp+30h],xmm7
000000013F61103E movdqa xmmword ptr [rsp+40h],xmm8
000000013F611045 movdqa xmmword ptr [rsp+50h],xmm9
000000013F61104C movdqa xmmword ptr [rsp+60h],xmm10
000000013F611053 dec qword ptr [rsp+98h]
000000013F61105B cmp qword ptr [rsp+98h],1
000000013F611064 jb proc1+5Bh (13F61107Bh)
000000013F611066 mov rcx,qword ptr [rsp+90h]
000000013F61106E mov rdx,qword ptr [rsp+98h]
000000013F611076 call proc1 (13F611020h)
000000013F61107B movdqa xmm6,xmmword ptr [rsp-30h]
000000013F611081 movdqa xmm7,xmmword ptr [rsp-20h]
000000013F611087 movdqa xmm8,xmmword ptr [rsp-10h]
000000013F61108E movdqa xmm9,xmmword ptr [rsp]
000000013F611094 movdqa xmm10,xmmword ptr [rsp+10h]
000000013F61109B add rsp,70h
000000013F61109F pop r12
000000013F6110A1 pop rdi
000000013F6110A2 pop rsi
000000013F6110A3 mov rsi,qword ptr [rsp+18h]
000000013F6110A8 mov rdi,qword ptr [rsp+20h]
000000013F6110AD ret
As you see it will corrupt the rsi and rdi registers.