mov eax,dword [..address]
   lea edx,[..address]
    

It has been mentioned before.

It has been mentioned before. IIRC, I even suggested a method (and gave the macros) to fix it but no one thought it needed fixing. But if not fixed it should be mentioned in the macro documentation.

A year passed since ...

revolution, can you please write a macro to detect this? BTW, it may be even better solution because user can re-arrange his code and avoid inefficiensy and complexity related to your "automated" solution ...

macro callpusher ret_arg_count,[arg] {
    common
     local edx_corrupted_flag, edx_save_flag, temp_edx_save_flag, arg_count, temp_arg_count, ip, opcode
  temp_arg_count=0
    reverse
     match x =edx y,:arg: \{
               if defined edx_corrupted_flag & edx_corrupted_flag=1
                    temp_edx_save_flag=1
                        edx_corrupted_flag=0
                        rb -1 ;error with use of edx!
               end if
      \}
    ip=$
        pushd arg
   load opcode from ip
 if opcode=0x8d
              edx_corrupted_flag=1
        end if
      temp_arg_count=temp_arg_count+1
    common
       if defined temp_edx_save_flag
               edx_save_flag=1
     end if
      arg_count=temp_arg_count
    ret_arg_count=arg_count
}    

revolution,

What about two-pass approach? First pass pushes everything besides addr args (push any for them), then second pass use lea/mov [esp+X] to put EAs in their places (only for addrs, granted we have macro-expansion-time calculations). No need to bother with which register is corrupted.

The only problem is that addr is a part of pushd macro semantics, not stdcall/ccall/invoke/cinvoke.

stdcall function, addr edx+8, addr ecx+8, addr edx+4, addr ecx+4