Finding a pop pop ret structure