OEP is stored to [esp+10] after return of second time of gettickcount.
The OEP is usually stored with "ror oep, 7"
so u can get real oep with "rol [esp+10], 7"
of course the value, 7 is dependent on u.
when u try some other number, u maybe find oep easily.
if u have a problem, feel free to know me that.
regards