Shellcode analysis - WinExec check