ropshell> use 2d16e455648f41e816d1951ab7d09667 (download)
name         : ch72.exe (i386/PE)
base address : 0x401000
total gadgets: 1567

ropshell> suggest "load mem"
> 0x004116f4 : mov eax, [edx + 4]; ret
> 0x00402753 : mov eax, [ecx + 0x400]; shr eax, 1; ret
> 0x00403976 : mov eax, [ebp + 0xc]; add [ecx], eax; pop ebp; ret 0x10
> 0x0040a7a2 : movzx eax, [edx]; movzx ecx, [ecx]; sub eax, ecx; pop esi; pop ebp; ret
> 0x004016a5 : mov ecx, [eax + 4]; or [eax], 2; mov [eax + 4], ecx; ret
> 0x00403973 : mov ecx, [ebp + 0x10]; mov eax, [ebp + 0xc]; add [ecx], eax; pop ebp; ret 0x10
> 0x004094ac : mov eax, [esi]; mov eax, [eax]; mov eax, [eax + 0x48];  inc [eax]; pop esi; ret
> 0x004104f9 : mov eax, [esi + 4]; and [esi + 8], 0; pop edi; mov [esi], eax; pop esi; pop ebp; ret