Con arwin podremos saber rapidamente la direccion de las funciones de las dll especificada.

Ejemplo:

C:\arwin.exe kernel32.dll ExitProcess
> arwin - win32 address resolution program - by steve hanna - v.01
> ExitProcess is located at 0x7c81cb12 in kernel32.dll

xor eax,eax
        mov ebx, 0x7c81cb12 ;direccion ExitProcess
        mov eax, 0      ; primer argumento de ExitProcess = 0
        push eax    ; 0
        call ebx        ;ExitProcess(0)                                  

Vas a Ollydbg y sacas el opcode:

0040100E   . 31C0              XOR EAX,EAX
00401010   . BB 12CB817C    MOV EBX,kernel32.ExitProcess
00401015   . B8 00000000    MOV EAX,0
0040101A   . 50                 PUSH EAX                                 ; /ExitCode => 0
0040101B   . FFD3              CALL EBX                                 ; \ExitProcess

char opcode[] = "\x31\xc0\xbb\x12\xcb\x81\x7c\xb8\x00\x00\x00\x00\x50\xff\xd3";

DESCARGAR: arwin - win32 address resolution program - by steve hanna - v.01
http://www.megaupload.com/?d=SMQXG2GG

Source:

#include <windows.h>
#include <stdio.h>
 
/***************************************
arwin - win32 address resolution program
by steve hanna v.01
   vividmachines.com
   shanna@uiuc.edu
you are free to modify this code
but please attribute me if you
change the code. bugfixes & additions
are welcome please email me!
to compile:
you will need a win32 compiler with
the win32 SDK
 
this program finds the absolute address
of a function in a specified DLL.
happy shellcoding!
***************************************/
 
 
int main(int argc, char** argv)
{
	HMODULE hmod_libname;
	FARPROC fprc_func;
 
	printf("arwin - win32 address resolution program - by steve hanna - v.01\n");
	if(argc < 3)
	{
		printf("%s <Library Name> <Function Name>\n",argv[0]);
		exit(-1);
	}
 
	hmod_libname = LoadLibrary(argv[1]);
	if(hmod_libname == NULL)
	{
		printf("Error: could not load library!\n");
		exit(-1);
	}
	fprc_func = GetProcAddress(hmod_libname,argv[2]);
 
	if(fprc_func == NULL)
	{
		printf("Error: could find the function in the library!\n");
		exit(-1);
	}
	printf("%s is located at 0x%08x in %s\n",argv[2],(unsigned int)fprc_func,argv[1]);
}

Por cierto la page del autor no tiene desperdicio: www.vividmachines.com  

Saludos.