RCX
, along with R11
, is used by the syscall
instruction, being immediately destroyed by it. Thus these registers are not only not saved after syscall, but they can’t even be used for parameter passing. Thus R10
was chosen to replace unusable RCX
to pass fourth parameter.
See also this answer for a bit more information on how syscall
uses these registers.
Reference: Intel’s Instruction Set Reference, look for SYSCALL
.