No, because this is only reached if AddressOfEntryPoint is 0; so in other words, there is no entry point to jump back to. In that case, entry_off is pointing to a nonsensical -start_rva. Instead, we need to jump back to our hardcoded function stub, which starts at xor eax, eax. That's also why it isn't just skip.length; it would be skip.length - length of "cmp [esp + 8],1; jz spawncode".