ropshell> use 2d16e455648f41e816d1951ab7d09667 (download)
name         : ch72.exe (i386/PE)
base address : 0x401000
total gadgets: 1567

ropshell> suggest "jmp"
> 0x00412d95 : jmp eax
> 0x0040209c : jmp esi
> 0x0040406c : jmp ebp
> 0x00409634 : jmp [eax]
> 0x00406d80 : jmp [ebx]
> 0x0040fd3a : jmp [ecx]
> 0x00409d77 : jmp [esi + 0x39]
> 0x00410fcf : push esp; shl [esi + 0xf], 0x56; ret