Our nseh is doing a JMP -128, so we need to put the egghunter at -128 from nseh. This gives us up to 128 byes for the egghunter. As per your other comment, I can get rid of the nops in the next line by properly aligning this as -126 though.