- add $0x8,%esp #skip RFLAGS\r
- .byte 0x67 #test [esp + 0eh], 1\r
+ sub 64, %esp\r
+ .byte 0x66, 0x9d #popfd\r
+ add $0x4,%esp #skip high part of RFLAGS\r
+ .byte 0x67 #; test (_STK16 ptr [esp + STACK_PARAM_SIZE + sizeof(IA32_REGS)]).ThunkFlags, 1\r