Systems and methods for protecting vulnerable code by obtaining an input file comprising code representing executable files; generating a protected executable file by replacing an unencrypted version of each vulnerable function of the input file with a VM-exit generating instruction; and generating a database file including an encrypted version of each vulnerable function deleted from the input file. The protected executable file, database file are stored on a target device. A UEFI application initializes a hypervisor which accesses the decryption key using a TPM device and loads an operating system. When the hypervisor detects an attempt to execute an encrypted version of a vulnerable function it decrypts the encrypted version of the vulnerable function.