[britedream]

for those of us who need to set the breakpoint in the right place, and for simplicity
I didn't check for the signature of the retn
I assumed it to be in the same place which
makes it less perfect, but it works.
for those can add under" lab4:" the following code:

lab4:

eob lab5
mov k,eip
add k,3d
ubp k
esto

lab5:
ret

I hope someone will give a feed back on this.
regards.
[note]
from the above breakpoint you can set memory breakpoint on the code section to find the oep, and also trace for your stolen .. etc, so it is very important breakpoint.