This seems to be the best and the closest we can pivot back to the controlled area behind the SEH record, where we have the most available space for the payload before hitting the heap.