ropshell> use 147134e164e0d8e0d405a4bc5f1fa8af (download)
name         : SERVER.exe (i386/PE)
base address : 0x10471000
total gadgets: 4587
ropshell> suggest "load mem"
> 0x10478ae4 : mov eax, [ecx]; ret
> 0x104a9f80 : mov eax, [ecx + 0x10]; ret
> 0x104bf6b4 : mov eax, [edx + 4]; ret
> 0x104bda0d : mov eax, [ebp + 0x14]; pop ebp; ret
> 0x1047a497 : mov edx, [ebp + 0xc]; pop ebp; ret
> 0x104a9c55 : mov eax, [esi + 8]; pop esi; pop ebp; ret
> 0x104822ad : mov ebp, [ebx + 0x20]; jmp eax
> 0x104bd9d9 : mov ecx, [ebp + 0x10]; shl eax, cl; pop ebp; ret
> 0x10499635 : mov eax, [edx]; inc [eax]; mov al, 1; pop ebp; ret 8
> 0x1048ba72 : mov ecx, [edx + 0x460]; mov [edx + 0x10], ecx; ret
> 0x104a7b8a : mov ecx, [edx]; mov [ecx], ax; add [edx], 2; pop ebp; ret
> 0x10489697 : mov edx, [eax]; mov eax, [edx - 8]; mov edx, [edx - 4]; pop ebp; ret
> 0x104a16bb : mov edx, [ecx]; mov al, [edx]; inc edx; mov [ecx], edx; ret
> 0x104a2117 : mov ecx, [eax]; mov eax, [ebp + 8]; mov [eax], ecx; pop ebp; ret
> 0x10477b8d : mov ecx, [eax + 4]; or [eax], 2; mov [eax + 4], ecx; ret
> 0x10484008 : mov eax, [edi]; mov [ecx], eax; mov [ecx + 4], 0; pop edi; pop ebp; ret
> 0x104820d4 : mov ebx, [ebp + 0xc]; mov ebp, [ebp - 4]; mov esp, [ebx - 4]; jmp eax
> 0x104aa1be : mov eax, [esi]; mov eax, [eax]; mov eax, [eax + 0x48];  inc [eax]; pop esi; ret
> 0x1047a451 : mov ecx, [esi]; mov [esi + ecx*4 + 4], eax; pop edi; mov eax, esi; pop esi; pop ebp; ret 4
> 0x10478e5d : mov edx, [esi + edx]; mov ecx, [edx + ecx]; add ecx, esi; add eax, ecx; pop esi; pop ebp; ret
> 0x10488434 : mov edx, [eax + 4]; mov eax, [ebp + 8]; mov [eax], ecx; mov [eax + 4], edx; mov al, 1; pop ebp; ret 4
> 0x104820c9 : mov eax, [ebx]; mov fs:[0], eax; mov eax, [ebp + 8]; mov ebx, [ebp + 0xc]; mov ebp, [ebp - 4]; mov esp, [ebx - 4]; jmp eax