Connection con = DriverManager.getConnection(url, user, pass);
      CallableStatement cstmt = con.prepareCall("{ call ? := random }");
      cstmt.registerOutParameter(1, OracleTypes.CURSOR);
      cstmt.execute();
      OracleCallableStatement stmt = (OracleCallableStatement) cstmt;
      if(stmt == null) {
            System.out.println("Could not cast to OracleCallableStatement");
      }
      ResultSet rs = stmt.getCursor(1);
                                while (rs.next()) {
                                  System.out.println (rs.getInt(1) + " " + rs.getString(2));
                                }

CREATE OR REPLACE FUNCTION RANDOM RETURN SYS_REFCURSOR
IS
_cursor SYS_REFCURSOR;
BEGIN
  OPEN _cursor FOR SELECT 1 as NUM, 'A' as VAL FROM DUAL;
RETURN _cursor;
END RANDOM;

{call ? := random }
or
{? = call random}
are same and have no impact, Oracle included.
also with functions and procedures if you don't pass any data, you don't need () or alternatively you can put it

there is no equivalent of registerOutParameter

<sql-query name="select">
<return-scalar column="num" type="long"/>
<return-scalar column="val" type="string"/>
{? = call random()}
</sql-query>

Session session = ...
Query query = session.getNamedQuery("select");
//will execute and return the resultsets as List
List list = query.list();
Object items[] = (Object[]) list;
System.out.println (items[0]  +  " " + items[1]);