ropshell> use 1aff244ca134956c54474f4e2433e4ce (download)
name         : advapi32.dll (i386/PE)
base address : 0x77dd1000
total gadgets: 6815

ropshell> suggest "load mem"
> 0x77e29b0a : mov ecx, [edx + 0x3000000]; ret
> 0x77e2ac6f : mov eax, [ebp + 0xc]; pop ebp; ret 8
> 0x77e1e7c8 : movzx esi, [eax + 2]; call ebx
> 0x77dd90a3 : mov ecx, [ebp + 0x10]; mov [ecx], eax; pop ebp; ret 0xc
> 0x77e3c901 : mov edx, [ebp + 0x14]; mov [ecx], edx; pop ebp; ret 0x14
> 0x77e26877 : mov esi, [ebp + 0xc]; push esi; call eax
> 0x77df1d69 : mov edi, [ebp + 0x14]; push edi; call esi
> 0x77e13fa2 : movzx eax, [ebx + 4]; push eax; push esi; call edi
> 0x77dd28ec : mov ebx, [ecx]; add [edi - 0x51ffffa7], dl; pop ecx; add [eax], al; ret
> 0x77e2544e : mov edx, [eax]; mov [ecx], edx; and [eax], 0; pop ebp; ret 4
> 0x77dd90a1 : mov eax, [ecx]; mov ecx, [ebp + 0x10]; mov [ecx], eax; pop ebp; ret 0xc
> 0x77e24144 : mov ecx, [esi + 0x14]; mov [eax], ecx; push esi; call edi
> 0x77e08e94 : mov eax, [esi]; push esi; push eax; push ebx; push 3; push [ebp + 8]; call edi
> 0x77de33ba : mov ecx, [eax]; lea eax, [edi + edi]; add ecx, eax; push ecx; call esi
> 0x77de348f : mov ecx, [ebx]; lea eax, [edi + edi]; add ecx, eax; push ecx; call esi
> 0x77e1713b : mov eax, [esi + 0x34]; mov [esi + 0x18], eax; xor eax, eax; inc eax; pop esi; pop ebp; ret 4
> 0x77e1ceac : mov ecx, [eax + 0x50]; movzx ecx, [ecx - 2]; sub ecx, 4; mov [eax + 0x3c], ecx; pop ebp; ret 4
> 0x77e117d1 : mov ebx, [ebp + 0x10]; push ebx; push [ebp + 0xc]; push [edi + 0x70]; call [edi + 0x48]
> 0x77e3b6ec : movzx ecx, [edi + 2]; mov eax, [eax + 0x30]; push ecx; push 0; push [eax + 0x18]; call esi
> 0x77defc31 : mov edx, [eax + 8]; mov [ecx + 8], edx; mov eax, [eax + 8]; mov [ecx + 0xc], eax; pop ebp; ret 8
> 0x77e03bc6 : mov ebx, [eax + 0x14]; mov [ebp - 0xc], eax; mov [ebp - 1], 0; lea eax, [ebp - 8]; push eax; push edi; call esi