Code is to show how ctypes can be used to retrieve address of functions from dll

exec.py

import ctypes
kernel32 = ctypes.windll.kernel32
handle = kernel32.LoadLibraryW(u'kernel32.dll')  
winExec_address = kernel32.GetProcAddress(handle,'WinExec') #Gets base address of WinExec function
exit_address = kernel32.GetProcAddress(handle,'ExitProcess') #Gets address of ExitProcess module
code = '''
;execcmd.asm
[Section .text]

global _start

_start:

jmp short GetCommand

CommandReturn:
     pop ebx            	;ebx holds the string
   	 xor eax,eax
  	 mov [ebx + 7],al   	;insert the NULL character
  	 push ebx
  	 mov ebx,%s
  	 call ebx           	;call 
     xor eax,eax        	;zero the register again, clears winexec retval
   	 push eax
   	 mov ebx, %s
 	   call ebx           	;call ExitProcess(0);

GetCommand:
    	;the N at the end of the db will be replaced with a null character
    	call CommandReturn
	    db "cmd.exeN"
''' % (hex(winExec_address), hex(exit_address))

print code