What IR Codes are the Power Function remotes sending to the receiver?
As with most things related to Power Function,s you can find this information on Philo's page on Power Functions.

If you scroll down a little, you'll find a link to "LEGO Power Functions RC" which is a document straight from LEGO outlining the PF RC protocol. The protocol does include commands to set an absolute speed.

Now, whether you can make sense of it is another story altogether. That's what HiTechnic used to create the NXT IRLink Sensor, and with it connected to a NXT you can indeed send the commands to set the speed to a defined level instead of increasing/decreasing.

Note that due to power limitations in the NXT, IRLink has a short transmission range.