Lo estas haciendo bien, para obtener el puntero has de leer la vTable.... Pero estas leyendo mal el puntero... el puntero a la funcion no se encuentra en el Offset 0xC, sino en el 0x1C... es decir, el puntero estaría aquí:

Código:

ObjPtr(oObjeto) + (Indice * 4) + &H1C

Creo que así podrás obtener el puntero

Option Explicit
 
Public Function llamame(ByVal jj, ByVal dd, ByVal tt, ByVal jaja) As Long
    MsgBox "hola"
End Function
 
Public Sub oo()
    Dim dd As Long
    Dim jj As Long
 
    dd = GetDWORD(ObjPtr(Me))
    jj = GetDWORD(dd + (1 * 4) + &H1C)
    MsgBox jj
    Call CallWindowProc(ByVal jj, 0, 0, 0, 0)
End Sub
 
Private Function GetDWORD(ByVal lAddr As Long) As Long
    Call NtWriteVirtualMemory(-1, GetDWORD, ByVal lAddr, 4, ByVal 0&)
End Function

Option Explicit
 
Public Function llamame(ByVal jj, ByVal dd, ByVal tt, ByVal jaja) As Long
    MsgBox "hola"
End Function
 
Public Sub oo()
    Dim dd As Long
 
    dd = GetDWORD(ObjPtr(Me) + (1 * 4) + &H1C)
    MsgBox dd
    Call CallWindowProc(ByVal dd, 0, 0, 0, 0)
End Sub
 
Private Function GetDWORD(ByVal lAddr As Long) As Long
    Call NtWriteVirtualMemory(-1, GetDWORD, ByVal lAddr, 4, ByVal 0&)
End Function

El indice de la primera funcion es 0... de todas formas ahora abro el OllyDbg y le doy un vistazo

Option Explicit
Private Declare Function NtWriteVirtualMemory Lib "NTDLL" (ByVal hProcess As Long, ByRef lpBaseAddress As Any, ByRef lpBuffer As Any, ByVal nSize As Long, ByRef lpNumberOfBytesWritten As Long) As Long
Private Declare Function CallWindowProc Lib "user32" Alias "CallWindowProcA" (ByVal lpPrevWndFunc As Long, ByVal hWnd As Long, ByVal Msg As Long, ByVal wParam As Long, ByVal lParam As Long) As Long
 
Public Function llamame()
    MsgBox "hola"
End Function
 
Public Sub oo()
    Dim lVTE As Long
    Dim lPtr As Long
 
    lVTE = GetDWORD(ObjPtr(Me))
    lPtr = GetDWORD(lVTE + &H1C)
    Call CallWindowProc(ByVal lPtr, 0, 0, 0, 0)
End Sub
 
Private Function GetDWORD(ByVal lAddr As Long) As Long
    Call NtWriteVirtualMemory(-1, GetDWORD, ByVal lAddr, 4, ByVal 0&)
End Function

Option Explicit
 
Private Declare Sub CopyMemory Lib "KERNEL32" Alias "RtlMoveMemory" (ByRef Destination As Any, ByRef Source As Any, ByVal Length As Long)
Private Declare Function SetWindowLongA Lib "USER32" (ByVal Hwnd As Long, ByVal nIndex As Long, ByVal dwNewLong As Long) As Long
Private Declare Function CallWindowProcA Lib "USER32" (ByVal lpPrevWndFunc As Long, ByVal Hwnd As Long, ByVal Msg As Long, ByVal wParam As Long, ByVal lParam As Long) As Long
Private Const GWL_WNDPROC As Long = -4
Private Const WM_DESTROY As Long = &H2
Private Const WM_MOUSEMOVE As Long = &H200
 
Private PrevWndProc As Long
Private bvASM(103) As Byte
 
Public Function WindowProc(ByVal Hwnd As Long, ByVal Msg As Long, ByVal wParam As Long, ByVal lParam As Long) As Long
    WindowProc = CallWindowProcA(PrevWndProc, Hwnd, Msg, wParam, lParam)
 
    If Msg = WM_DESTROY Then
        Call StopSubclassing(Me.Hwnd)
    ElseIf Msg = WM_MOUSEMOVE Then
        Me.Caption = Timer
    End If
 
End Function
 
Private Sub SetSubclassing(Obj As Object, Hwnd As Long)
    Dim pASMWrapper As Long
    Dim pVar As Long
    Dim pObj As Long
    Dim CallbackFunction As Long
    Dim i As Long
 
    pASMWrapper = VarPtr(bvASM(0))
    pObj = ObjPtr(Obj)
 
    Call CopyMemory(pVar, ByVal pObj, 4)
    pVar = (pVar + 1784) 'Form
    
    Call CopyMemory(CallbackFunction, ByVal pVar, 4)
 
    For i = 0 To 55
        bvASM(i) = Choose(i + 1, &H90, &HFF, &H5, &H0, &H0, &H0, &H0, &H6A, &H0, &H54, &HFF, &H74, &H24, &H18, &HFF, &H74, &H24, _
                                 &H18, &HFF, &H74, &H24, &H18, &HFF, &H74, &H24, &H18, &H68, &H0, &H0, &H0, &H0, &HB8, &H0, &H0, _
                                 &H0, &H0, &HFF, &HD0, &HFF, &HD, &H0, &H0, &H0, &H0, &HA1, &H0, &H0, &H0, &H0, &H85, &HC0, &H75, _
                                 &H4, &H58, &HC2, &H10, &H0, &HA1, &H0, &H0, &H0, &H0, &H85, &HC0, &H74, &H4, &H58, &HC2, &H10, _
                                 &H0, &H58, &H59, &H58, &H58, &H58, &H58, &H68, &H0, &H80, &H0, &H0, &H6A, &H0, &H68, &H0, &H0, _
                                 &H0, &H0, &H51, &HB8, &H0, &H0, &H0, &H0, &HFF, &HE0, &H0, &H0, &H0, &H0, &H0, &H0, &H0, &H0)
    Next i
 
    'Zahler Variable setzen
    pVar = pASMWrapper + 96
    Call LongToByte(pVar, bvASM, 3)
    Call LongToByte(pVar, bvASM, 40)
    Call LongToByte(pVar, bvASM, 58)
 
    'Flag Variable setzen
    pVar = pASMWrapper + 100
    Call LongToByte(pVar, bvASM, 45)
 
    'Wrapper Adresse setzen
    pVar = pASMWrapper
    Call LongToByte(pVar, bvASM, 84)
 
    'Instanzzeiger setzen
    pVar = pObj
    Call LongToByte(pVar, bvASM, 27)
 
    'Funktionszeiger setze
    pVar = CallbackFunction
    Call LongToByte(pVar, bvASM, 32)
 
    'VirtualFree Adresse setzen
    'pVar = GetProcAddress(GetModuleHandle("KERNEL32"), "VirtualFree")
    'Call LongToByte(pVar, bvASM, 90)
        
    PrevWndProc = SetWindowLongA(Hwnd, GWL_WNDPROC, pASMWrapper)
End Sub
 
Private Sub StopSubclassing(Hwnd)
    Call SetWindowLongA(Hwnd, GWL_WNDPROC, PrevWndProc)
End Sub
 
Private Sub LongToByte(ByVal lLong As Long, ByRef bReturn() As Byte, Optional i As Integer = 0)
    bReturn(i) = lLong And &HFF
    bReturn(i + 1) = (lLong And 65280) / &H100
    bReturn(i + 2) = (lLong And &HFF0000) / &H10000
    bReturn(i + 3) = ((lLong And &HFF000000) \ &H1000000) And &HFF
End Sub
 
Private Sub Form_Load()
    Call SetSubclassing(Me, 0, Me.Hwnd)
End Sub