ropshell> use 00dfcfa3da8c5e7c15e89a1a2ed510d6 (download)
name         : ntdll.dll (i386/PE)
base address : 0x4b281000
total gadgets: 12442
ropshell> suggest
call
    > 0x4b29fe06 : call eax
    > 0x4b2a62fe : call ebx
    > 0x4b2af4c7 : call ecx
    > 0x4b2a155e : call edx
    > 0x4b2a5ba0 : call esi
jmp
    > 0x4b29b5b8 : push esp; ret
    > 0x4b2a23dd : jmp eax
    > 0x4b289ccc : jmp ebx
    > 0x4b28f8d0 : jmp ecx
    > 0x4b3127d6 : jmp edx
load mem
    > 0x4b29f035 : mov edx, [ebx]; ret
    > 0x4b29b9c0 : mov ebp, [eax]; ret
    > 0x4b2fa314 : mov eax, [edx + 4]; ret
    > 0x4b35fd63 : mov eax, [esi + 0x20]; pop esi; ret
    > 0x4b2f5f5d : mov eax, [ebp + 0x10]; pop ebp; ret
load reg
    > 0x4b2ecaf2 : pop eax; ret
    > 0x4b2a8ef9 : pop ebx; ret
    > 0x4b29d581 : pop ecx; ret
    > 0x4b291540 : pop edx; ret
    > 0x4b2a788d : pop esi; ret
pop pop ret
    > 0x4b2ecaf2 : pop eax; ret
    > 0x4b2f7032 : pop eax; pop ebp; ret
    > 0x4b2fee82 : pop eax; pop esi; pop ebp; ret
    > 0x4b2f6fcc : pop eax; pop edi; pop esi; pop ebp; ret
    > 0x4b2ff5df : pop eax; pop edi; pop esi; pop ebx; pop ebp; ret
sp lifting
    > 0x4b2f50c7 : add esp, 0x14; ret
    > 0x4b2f50c7 : add esp, 0x14; ret
stack pivoting
    > 0x4b2b2a6d : xchg eax, esp; ret
    > 0x4b32b7c6 : xchg esp, edi; dec ecx; ret
    > 0x4b2b36bb : mov esp, ebx; pop ebx; ret
    > 0x4b2a65e4 : mov esp, ebp; pop ebp; ret
    > 0x4b2d8500 : lea esp, [edx + 0x48d4b39]; ret
write mem
    > 0x4b2a7c6d : add [ebx], eax; ret
    > 0x4b2b487f : add [ebx], esi; ret
    > 0x4b300de1 : add [ebx], edi; ret
    > 0x4b2cba54 : add [ecx], eax; pop edi; ret
    > 0x4b29e435 : adc [edx], ebp; lahf ; ret