I am trying to call the USER32.DLL function from assembly code. I launched an application (calc.exe) in Ollydbg 2.01. I chose calc.exe just because I know it loads USER32.DLL.
I see the format as:
MessageBox(HWND hWnd, LPCTSTR lpText, LPCTSTR lpCaption, uType);
hWnd=0 usually "If this parameter is NULL, the message box has no owner window"
uType = MB_OK =0 for OK button only
I'm pushing the 4 values on the stack and then trying to enter the following into Olly:
CALL DWORD PTR DS:[<&USER32.MessageBoxA>]
But Olly won't assemble it and gives me the error "Please specify module" (as in link)
I know USER32.DLL is loaded: 
and I do see that messagebox procedure is in memory
:
Edit: It appears I can't use the exact syntax Olly disassembles as. For example, calc.exe calls USER32.MessageBeep, but it does it indirectly by using an addressed stored at 00121420 = &USER32.MessageBeep.
00145C19 |. FF15 20141200 CALL DWORD PTR DS:[<&USER32.MessageBeep> ; \USER32.MessageBeep
To get Olly to create the same instruction I would double-click and assemble:
CALL DWORD PTR DS:[00121420]
and then
00145C19 |. FF15 20141200 CALL DWORD PTR DS:[<&USER32.MessageBeep> ; \USER32.MessageBeep
will appear. It would be nice if I could figure out how to type the label USER32.MessageBeep instead of hunting for it and copy/pasting the address.
It seems perhaps there is more to know before one can simply call a function in a loaded DLL. When I see people edit patches in Olly to call procedures from other modules they seem to be only calling procedures already called by the original program, whereas for USER32.DLL with MessageBoxA I have the extra challenge of it not being in memory. I got strange results when I tried to call the messagebox (it appeared in the background but wouldn't let the mouse go near it and returned to a strange address of 90909090 -possibly due to my next instruction opcodes). Perhaps this strange behavior is due to it having needed to do some setup for messageboxes which wasn't done by the program.
So perhaps an answer to my question depends on whether the procedure is somehow already loaded by the original program. In Blabbb's answer, s/he uses notepad.exe not calc.exe.
My question is perhaps getting more unfocused but perhaps a good answer to my question could explain how other modules are loaded, as well as how to make this happen in Ollydbg. I am still learning how PE applications are loaded into memory but I wonder if the answer is that to go between modules we shouldn't expect to see the relative CALL opcode E8 (see blabbb's comment below) since the programmer doesn't know what address in memory the DLL procedure will be loaded into, and in the original program they must go indirectly through an indirect CALL with opcode FF15 instead. I assume this may be related to the act of "registering a DLL function maybe?". In calc.exe it looks like MessageBoxA can't be called indirectly (unless if I edit memory somewhere with its address perhaps). But if I am paused inside a program already loaded into Olly I should be able to assemble these relative CALL instructions and invoke the procedure.
In my case with calc.exe I see some, but not all, USER32.DLL procedures in the calc .text part of memory. It appears programs call them indirectly through this list. For example here are some of the USER32
With calc.exe I can't find MessageBoxA here, but if I look for its address in the USER32.DLL module, and select names (see below)
I can sort by name, and start typing the name so it finds it for me
and then assemble call 7634FD1E
00148C40 6A 00 PUSH 0
00148C42 68 598C1400 PUSH 00148C59 ; ASCII "cap"
00148C47 68 5D8C1400 PUSH 00148C5D ; ASCII "text"
00148C4C 6A 00 PUSH 0
00148C4E E8 CB702076 CALL MessageBoxA
