You need to reverse how the address was calculated a bit, you really don't tend to see offsets of zero with most structures. So see where EDX is set and scan for that. And I would try to reverse the pointer in the opcode to see how it's calculated. But with just scanning for the address or a base address your just using random addresses to build your pointer, so why not just use the pointer scanner?