ropshell> use 3821bd26a6940981694e4a261e659323 (download) name : kernel32.dll (i386/PE) base address : 0x6b810000 total gadgets: 3925
ropshell> suggest "load mem" > 0x6b822c20 : mov eax, [ecx + 0x10]; ret > 0x6b866362 : mov ebp, [ebx + 0x2b]; ret > 0x6b81d573 : mov ecx, [edx]; sub eax, ecx; ret > 0x6b822ad5 : mov eax, [ebp + 8]; pop ebp; ret 4 > 0x6b824a58 : mov ecx, [esi]; sub cx, ax; mov ax, cx; pop esi; ret > 0x6b820eec : mov eax, [edx + 0x18]; mov edx, [edx + 0x1c]; ret > 0x6b816cc8 : mov ecx, [ebp + 8]; xadd [ecx], eax; pop ebp; ret 8 > 0x6b85905c : mov edx, [ebp + 0xc]; mov [edx + 2], ax; ret > 0x6b856bff : mov ecx, [edx + 0x84]; mov edx, [edx + 0x5c]; sub edx, [ecx + 4]; mov eax, edx; ret