Stack spill heuristic

[riptl]

When function arg count exceeds 5, then r5 becomes some weird call args pointer to the stack. If callee does indirect addressing on r5, there's a decent chance that these are function args