DWORD ret_eip = (DWORD)&hmod - 4;

вернее

DWORD *p = (DWORD *)&hmod - 1;
DWORD ret_eip = p[0];