Microsoft x64 (Windows)

• Only 4 register args (vs 6 on System V) — and different registers.
• Caller allocates 32 bytes of shadow space even when unused.
• Windows malware uses this convention — watch RCX for the 1st arg.