format  PE64 GUI; at 400000h on 'cm.exe'

include 'C:\asm\tool\fasm\fasmw\INCLUDE\win64axp.inc'
include 'pe.inc'

;;equ
max_size        =       16*1024*1024

.data
        fl_name db      'C:\asm\tool\fasm\fasmw\test\pe\pe-01\pe-01.exe',0

        pe_info db      'e_magic=0x%.16IX',13,10
                db      'signature=0x%.16IX',0
        sz      db      'pe info',0

       ; buff    db      1024        dup     (?)
       ; fl_buff db      1024        dup     (?)
.code
start:
        ;;create stack for api used
        sub      rsp,38H

        ;;createfile,just open file
        mov      qword [rsp+8*(4+2)],0  ;;7th arg
        mov      qword [rsp+8*(4+1)],80 ;;6th arg
        mov      qword [rsp+8*(4+0)],3  ;;5th arg
        xor      r9,r9                  ;;4TH ARG
        mov      r8,1                   ;;3TH ARG
        mov      edx,80000000h          ;;2th arg---edx is enough
        lea      rcx,[fl_name]          ;;1th arg
        call     [CreateFileA]
        inc      rax
        je       _exit
        dec      rax
        xchg     rax,rbx
        ;;get file size
        xor      rdx,rdx                ;;2th arg
        mov      rcx,rbx
        call     [GetFileSize]
        ;cmp      eax,max_size
        ;jae      _exit
        xchg     eax,ebp
        ;;read file
        mov      qword [rsp+20H],0      ;;5th arg
        lea      r9,[rsp+28H]           ;;4th arg
        mov      r8d,ebp                ;;3th arg
        lea      rdx,[fl_buff]          ;;2th arg
        mov      rcx,rbx                ;;1th arg
        call     [ReadFile]

        test     eax,eax
        je       _exit
        xchg     eax,esi
        ;;close handle
        mov      rcx,rbx
        call     [CloseHandle]

        lea      rdx,[fl_buff]
        ;;read the dos header
        mov      eax,dword [rdx+IMAGE_DOS_HEADER.e_magic]
        mov      ebx,dword [rdx+IMAGE_DOS_HEADER.e_lfanew]
        lea      rbx,[rdx+rbx*1]
      ; mov        eax,dword [fl_buff]
        mov      edx,dword [rbx+IMAGE_NT_HEADERS64.Signature]
        mov       edx,dword [fl_buff+36]

        ;;;;;;;;;;;;;;;;
        ;;any code
        ;;;;;;;;;;;;;;;;

       ; sub      rsp,8*4
        ;;print it
        mov      r9d,edx
        mov      r8d,eax
        lea      rdx,[pe_info]
        lea      rcx,[buff]
        call     [wsprintf]

        ;;msgox
        xor      r9,r9
        lea      r8,[sz]
        lea      rdx,[buff]
        xor      rcx,rcx
        call     [MessageBoxA]

       ; add      rsp,8*4
_exit:

        add      rsp,38H

        xor      rcx,rcx
        call     [ExitProcess]

.end    start    

sub rsp, 8 ; This appeared out of the blue
sub rsp, 38H ; This instruction is yours    

macro .code {
  section '.text' code readable executable
  entry $
  sub rsp,8 ; Here it is the unexpected instruction
  local main,code
  entry equ main
  if main <> code
  jmp main
  end if
  code: }    

After checking with a debugger I've noticed the actual code was this:

Code:

sub rsp, 8 ; This appeared out of the blue
sub rsp, 38H ; This instruction is yours    

After replacing SUB RSP, 38H with SUB RSP, 30H it worked (well, I've to made some extra modifications because I don't have pe.inc and buff and fl_buff were commented)

Code:

macro .code {
  section '.text' code readable executable
  entry $
  sub rsp,8 ; Here it is the unexpected instruction
  local main,code
  entry equ main
  if main <> code
  jmp main
  end if
  code: }