Using esp works by coincidence as long as the stack pointer is within the first 4 GB of the address space - which seems to work as long as the test binary is built with /dynamicbase:no, but breaks if this option is removed.