ropshell> use 3891413139eaabfefe9b0ca49b5cd395 (download)
name         : msvcrt.dll (i386/PE)
base address : 0x77be1000
total gadgets: 3854

ropshell> suggest "load mem"
> 0x77bf3925 : mov eax, [ecx + 0xc]; ret
> 0x77c20c64 : mov eax, [edx + 4]; ret
> 0x77beee80 : mov eax, [ebx]; add cl, cl; ret
> 0x77c032d8 : mov eax, [esi + 0x64]; pop esi; ret
> 0x77bec30f : mov eax, [ebp + 0x10]; pop ebp; ret
> 0x77c0257f : movzx eax, [ecx]; add eax, edx; pop ebp; ret
> 0x77bf398a : movzx ecx, [edx]; sub eax, ecx; pop ebp; ret
> 0x77bf2662 : mov eax, [edi + 4]; pop edi; pop esi; ret
> 0x77bfc733 : mov esi, [ebp + 8]; xor edi, edi; ret
> 0x77bf2a15 : mov ebp, [ebx + 0x20]; jmp eax
> 0x77c0a636 : mov ecx, [eax]; mov eax, [eax + 4]; push eax; ret
> 0x77c26849 : movzx eax, [ebx + 0x77c27655]; jmp [0]
> 0x77bf1ba3 : mov ecx, [esi + ecx]; add ecx, edx; add eax, ecx; pop esi; ret
> 0x77bf1d2d : mov ecx, [ebp + 0xc]; call [ebp + 8]
> 0x77c1c5c7 : mov edx, [ebp + 0x10]; mov [edx], ecx; pop esi; pop ebp; ret
> 0x77bf3b35 : mov eax, [esi]; mov ecx, esi; call [eax]
> 0x77bf3b7a : mov eax, [edi]; mov ecx, edi; pop edi; pop esi; jmp [eax + 4]
> 0x77bf277e : mov ebx, [ebp + 0xc]; mov esp, [ebx - 4]; mov ebp, [ebp - 4]; jmp eax
> 0x77bf3d52 : mov ecx, [esi]; mov [esi + ecx*4 + 4], eax; mov eax, esi; pop esi; pop ebp; ret 4
> 0x77bf1ba0 : mov esi, [edx + esi]; mov ecx, [esi + ecx]; add ecx, edx; add eax, ecx; pop esi; ret
> 0x77bf2d07 : mov esi, [eax + 8]; add ecx, [edx + esi]; pop esi; mov eax, [eax]; add eax, ecx; pop ebp; ret
> 0x77c267e5 : mov ecx, [eax + 0x20]; and [ecx + 4], -0x9; mov eax, [eax + 0x20]; and [eax + 4], -0x11; ret