ropshell> use 22f450c23d8abdfa6bed991ad1c34b1c (download)
name         : VsaVb7rt.dll (i386/RAW)
base address : 0x0
total gadgets: 29415

ropshell> suggest "stack pivoting"
> 0x0000f230 : xchg eax, esp; ret
> 0x0004f9a4 : push eax; pop esp; ret
> 0x00022431 : mov esp, ebp; pop ebp; ret
> 0x00048173 : lea esp, [edi]; pop esi; ret
> 0x000afca5 : mov esp, edi; inc [ebx + 0x5e5f20c4]; pop ebx; pop ebp; ret 4
> 0x000beee3 : mov esp, ecx; stc ; call [eax - 1]
> 0x00100923 : mov esp, edx; stc ; call [eax + 0x68]
> 0x00047a66 : lea esp, [ebx - 3]; call [edi - 0x73]
> 0x00099519 : lea esp, [esi + edi*8 - 1]; call [edx + 0x50]
> 0x000af0b9 : lea esp, [esp]; movzx eax, [esi]; push eax; call ebx
> 0x0013df32 : push esp; xor ebx, [eax + 0x33]; pop esp; xor esi, [edx + 0x34]; ret
> 0x000adb15 : xchg esp, edi; inc [eax + eax*8 + 0x5e5f0c74]; mov eax, 1; pop ebx; pop ebp; ret 0x14
> 0x00080089 : lea esp, [ecx + 0x3ab85e2b]; add [eax], al; add bl, al; mov eax, 0x3b; ret
> 0x0009d15b : lea esp, [ebp + edi*8 + 0x6a50ffff]; add [ebp - 0x2537b], cl; call [eax + 0x6a]
> 0x0002a892 : xchg esp, ecx; add [eax], al; add [ebx - 0x3aa72f8], cl; push edx; push eax; call [ecx + 0x34]
> 0x00017774 : leave ; ret