ropshell> use 0dc2a9882540dea4a55b08785e09d8fc (download)
name         : afd.sys (x86_64/PE)
base address : 0x11000
total gadgets: 1293

ropshell> suggest "load reg"
> 0x00014551 : pop rax; ret
> 0x00011860 : pop rbx; ret
> 0x00011ca1 : pop rsi; ret
> 0x00011932 : pop rdi; ret
> 0x00012125 : pop rbp; ret
> 0x00013637 : pop rsp; ret
> 0x00013636 : pop r12; ret
> 0x0001eae2 : pop r13; ret
> 0x0001eae0 : pop r14; pop r13; ret
> 0x0001eade : pop r15; pop r14; pop r13; ret
> 0x00018564 : mov rbx, [rsp + 0x30]; add rsp, 0x38; ret
> 0x0001c1f2 : mov rsi, [rsp + 0x78]; add rsp, 0x68; ret
> 0x00019778 : mov rdi, [rsp + 0x60]; add rsp, 0x68; ret
> 0x00018565 : mov ebx, [rsp + 0x30]; add rsp, 0x38; ret
> 0x0001c1f3 : mov esi, [rsp + 0x78]; add rsp, 0x68; ret
> 0x00019779 : mov edi, [rsp + 0x60]; add rsp, 0x68; ret
> 0x0001fc07 : pop rcx; add [rax], al; mov rdx, rbx; mov rcx, rsi; call [rbx + 0x10]
> 0x0001976e : mov rbp, [rsp + 0x78]; mov rbx, [rsp + 0x70]; mov rdi, [rsp + 0x60]; add rsp, 0x68; ret
> 0x0001976f : mov ebp, [rsp + 0x78]; mov rbx, [rsp + 0x70]; mov rdi, [rsp + 0x60]; add rsp, 0x68; ret
> 0x0001f2ab : mov rax, [rsp + 0x60]; mov rdx, r8; mov [r8 + 0x88], rax; mov rcx, [rip + 0x16a7f]; call [rip + 0x62a9]; add rsp, 0x28; ret
> 0x0001e257 : mov eax, [rsp + 0x38]; lea r11, [rsp + 0xc0]; mov rbx, [r11 + 0x10]; mov rsi, [r11 + 0x18]; mov rsp, r11; pop rdi; ret