diff --git a/examples/sysir/drawing2.janet b/examples/sysir/drawing2.janet
index 35fbece9..5201fd09 100644
--- a/examples/sysir/drawing2.janet
+++ b/examples/sysir/drawing2.janet
@@ -15,9 +15,15 @@
 (defpointer cursor p32)
 
 # Linux syscalls
-(defn-syscall brk:p32 12 [amount:uint])
-(defn-syscall exit:void 60 [code:int])
-(defn-syscall write:void 1 [fd:int data:p32 size:uint])
+# (defn-syscall brk:p32 12 [amount:uint])
+# (defn-syscall exit:void 60 [code:int])
+# (defn-syscall write:void 1 [fd:int data:p32 size:uint])
+# (defn-syscall write_string 1 [fd:int data:pointer size:uint])
+
+# External
+(defn-external write:void [fd:int mem:pointer size:uint])
+(defn-external exit:void [x:int])
+(defn-external malloc:p32 [size:uint])
 
 (defsys w32:void [c:cursor x:uint]
   (def p:p32 (load c))
@@ -34,10 +40,10 @@
 
 (defsys makebmp:p32 [w:uint h:uint]
   (def size:uint (+ 56 (* w h 4)))
-  (def mem:p32 (brk size))
+  (def mem:p32 (malloc size))
+  (def c:cursor (cast (malloc 4)))
   #(def cursor_data:p32 mem)
   #(def c:cursor (address cursor_data))
-  (def c:cursor (cast (brk 4)))
   (store c mem)
   (w16 c 0x4D42) # ascii "BM"
   (w32 c size)
@@ -72,18 +78,15 @@
   (write 1 mem size)
   (return mem))
 
-(defsys _start:void []
+(defsys main:int []
   (def w:uint 512)
   (def h:uint 512)
-  # (makebmp w h)
-  (def size:uint (+ 56 (* w h 4)))
-  (def mem:p32 (brk size))
-  (store mem (the uint 0x4d424d42))
-  (write 1 mem 4)
-  #(write 1 (cast "hello, world!\n") 14)
-  (exit 0)
-  (return))
+  (makebmp w h)
+  (return 0))
 
 ####
 
-(dumpx64)
+#(dumpx64)
+
+(print "#include <unistd.h>")
+(dumpc)
diff --git a/examples/sysir/frontend.janet b/examples/sysir/frontend.janet
index ee6f5c4e..2cc66f92 100644
--- a/examples/sysir/frontend.janet
+++ b/examples/sysir/frontend.janet
@@ -153,6 +153,17 @@
             (array/push into ~(pointer-add ,slot ,base-slot ,offset-slot))
             slot)
 
+          'pointer-sub
+          (do
+            (assert (= 2 (length args)))
+            (def [base offset] args)
+            (def base-slot (visit1 base into false type-hint))
+            (def offset-slot (visit1 offset into false 'int))
+            (def slot (get-slot))
+            (when type-hint (array/push into ~(bind ,slot ,type-hint)))
+            (array/push into ~(pointer-subtract ,slot ,base-slot ,offset-slot))
+            slot)
+
           # Type hinting
           'the
           (do
diff --git a/examples/sysir/run_drawing.sh b/examples/sysir/run_drawing.sh
index ff535d27..402edfc6 100755
--- a/examples/sysir/run_drawing.sh
+++ b/examples/sysir/run_drawing.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-valgrind build/janet examples/sysir/drawing.janet > temp.nasm
-nasm -felf64 temp.nasm -l temp.lst -o temp.o
-ld -o temp.bin -dynamic-linker /lib64/ld-linux-x86-64.so.2 -lc temp.o
-valgrind ./temp.bin
+valgrind build/janet examples/sysir/drawing.janet > temp.c
+cc temp.c
+./a.out > temp.bmp
+feh temp.bmp
diff --git a/src/core/sysir_x86.c b/src/core/sysir_x86.c
index 6d854569..d4b00a4e 100644
--- a/src/core/sysir_x86.c
+++ b/src/core/sysir_x86.c
@@ -682,7 +682,6 @@ static void sysemit_sysv_call(JanetSysx64Context *ctx, JanetSysInstruction instr
         janet_formatb(buffer, "call ");
         sysemit_operand(ctx, instruction.call.callee, "\n");
     }
-    if (instruction.call.flags & JANET_SYS_CALLFLAG_HAS_DEST) sysemit_movreg(ctx, RAX, instruction.call.dest);
     if (save_r11) sysemit_popreg(ctx, 11);
     if (save_r10) sysemit_popreg(ctx, 10);
     if (save_r9) sysemit_popreg(ctx, 9);
@@ -691,6 +690,7 @@ static void sysemit_sysv_call(JanetSysx64Context *ctx, JanetSysInstruction instr
     if (save_rdx) sysemit_popreg(ctx, RDX);
     if (save_rsi) sysemit_popreg(ctx, RSI);
     if (save_rdi) sysemit_popreg(ctx, RDI);
+    if (instruction.call.flags & JANET_SYS_CALLFLAG_HAS_DEST) sysemit_movfromreg(ctx, instruction.call.dest, RAX);
 }
 
 static void sysemit_win64_call(JanetSysx64Context *ctx, JanetSysInstruction instruction, uint32_t *args, uint32_t argcount) {
@@ -726,13 +726,13 @@ static void sysemit_win64_call(JanetSysx64Context *ctx, JanetSysInstruction inst
     if (argcount > 4) {
         janet_formatb(buffer, "add rsp, %u\n", 8 * (argcount - 4));
     }
-    if (instruction.call.flags & JANET_SYS_CALLFLAG_HAS_DEST) sysemit_movreg(ctx, RAX, instruction.call.dest);
     if (save_r11) sysemit_popreg(ctx, 11);
     if (save_r10) sysemit_popreg(ctx, 10);
     if (save_r9) sysemit_popreg(ctx, 9);
     if (save_r8) sysemit_popreg(ctx, 8);
     if (save_rdx) sysemit_popreg(ctx, RDX);
     if (save_rcx) sysemit_popreg(ctx, RCX);
+    if (instruction.call.flags & JANET_SYS_CALLFLAG_HAS_DEST) sysemit_movfromreg(ctx, instruction.call.dest, RAX);
 }
 
 void janet_sys_ir_lower_to_x64(JanetSysIRLinkage *linkage, JanetSysTarget target, JanetBuffer *buffer) {