ropshell> use 177c3e29e9a341dc64f2e17f08305d01 (download)
name         : avast_free_antivirus_setup_online.exe (i386/PE)
base address : 0x401000
total gadgets: 2542

ropshell> suggest
call
    > 0x00401b40 : call eax
    > 0x004066b9 : call ebx
    > 0x0040152b : call ecx
    > 0x0040105d : call esi
    > 0x00406721 : call edi
jmp
    > 0x00406343 : jmp eax
    > 0x004119cf : jmp esi
    > 0x00402e72 : jmp [eax]
    > 0x0041171c : jmp [ebx]
    > 0x004051fa : jmp [edx]
load mem
    > 0x0041f584 : mov eax, [edx + 4]; ret
    > 0x00412d83 : mov eax, [ecx + 8]; pop ebp; ret
    > 0x00410eb1 : mov ebp, [ebx + 0x20]; jmp eax
    > 0x0040c770 : mov eax, [ebx]; pop edi; pop esi; pop ebx; pop ebp; ret
    > 0x0040c77b : mov eax, [esi]; pop edi; pop esi; neg eax; pop ebx; pop ebp; ret
load reg
    > 0x004063e9 : pop ebx; ret
    > 0x0040691c : pop ecx; ret
    > 0x0041e55e : pop edx; ret
    > 0x004027bb : pop esi; ret
    > 0x004102b5 : pop edi; ret
pop pop ret
    > 0x004011cf : pop ebp; ret
    > 0x00413a91 : pop eax; pop ebp; ret
    > 0x0041903d : pop ebx; pop edi; pop esi; ret
    > 0x0041983a : pop eax; pop edi; pop esi; pop ebp; ret
    > 0x00419b73 : pop ecx; pop edi; pop ebx; pop esi; pop ebp; ret
sp lifting
    > 0x0041a3d9 : add esp, 0x10; ret
    > 0x0041a3d9 : add esp, 0x10; ret
stack pivoting
    > 0x00415ed0 : xchg eax, esp; ret
    > 0x0041ff25 : mov esp, ebx; pop ebx; ret
    > 0x004012ec : mov esp, ebp; pop ebp; ret
    > 0x0041f3c9 : lea esp, [esp]; ret
    > 0x0041be40 : lea esp, [eax + 0xbfffff8]; ret
write mem
    > 0x0040c56a : add [ebx], eax; ret
    > 0x00418d82 : add [ebx + 0x3b6602c1], eax; ret
    > 0x004137d5 : add [ebx + 0x5d5b5fc7], ecx; ret 4
    > 0x004152da : add [esi + 0x5b], ebx; ret
    > 0x0041569e : add [edi + 0x5e], ebx; ret