ropshell> use 3c94bcda2a65e71413d3fee2b4be913e (download)
name         : tcpip.sys (x86_64/PE)
base address : 0x1c0001000
total gadgets: 6847

ropshell> suggest "write mem"
> 0x1c01c6401 : add [rax], edx; ret
> 0x1c01c6468 : add [rax], esi; ret
> 0x1c011432a : adc [rbx], ecx; ret
> 0x1c004743d : adc [rbx], edi; ret
> 0x1c006e31f : add [rdx], edi; ret
> 0x1c0083047 : add [rax + 0x3b], ecx; ret
> 0x1c0159a31 : add [rax + 1], edi; ret
> 0x1c0128506 : add [rbx + 0x448b48c8], ecx; ret
> 0x1c00b6ae8 : add [rcx + 0x2b], rax; ret
> 0x1c002ceb8 : adc [rcx + 0x2a], eax; ret
> 0x1c01406b1 : adc [rbp + 3], eax; ret
> 0x1c002eeaa : add [rbp + 1], esi; ret
> 0x1c01056fa : add [r9 + 0x3b], eax; ret
> 0x1c002210f : add [r9 + 0x20], ecx; ret
> 0x1c00ae788 : adc [rdi], eax; add bh, bh; ret
> 0x1c000a396 : add [r8], eax; add bh, dh; ret
> 0x1c015979c : add [rcx], edi; add [rax], al; ret
> 0x1c0008b4a : add [rdi], ecx; test [rbx - 0x74fff38a], al; ret
> 0x1c0189243 : adc [rdx + rbx], eax; mov eax, r9d; ret
> 0x1c016bd2d : adc [rdx + 3], esi; xor al, al; ret
> 0x1c018b02e : add [rcx], eax; and [rcx + 0x10], r11; ret
> 0x1c018b02d : add [r9], rax; and [rcx + 0x10], r11; ret
> 0x1c0133f29 : add [rdi + 4], esi;  inc [rcx + 0x10]; ret
> 0x1c00a30c3 : add [rbp + 0x3b], ecx; sal [rdx - 0x21], 1; ret
> 0x1c019186b : add [rdi], ebp; or [rax], eax; add rsp, 0x78; ret
> 0x1c0173c9e : add [rbx + 0x44000c62], eax; mov [rdx + 4], eax; ret
> 0x1c0147d4b : adc [rdx + 0x45706354], edi; call [rip + 0xdc7a0]; nop [rax + rax]; add rsp, 0x28; ret
> 0x1c0004389 : add [rcx + 0x28], edx; sub [rcx + 0x18], edx; mov [rcx + 0x10], r8d; add rsp, 0x28; ret
> 0x1c018b022 : add [r8], rax; mov rax, [rcx + 0x10]; and [rcx + 8], r11; add [r9], rax; and [rcx + 0x10], r11; ret
> 0x1c01c63ed : add [rax], ecx; mov rax, [rip + 0x45a8a]; lea rcx, [r8 + r8*2]; shl rcx, 6; add [rcx + rax + 0x10], rdx; ret
> 0x1c01c6454 : add [rax], ebp; mov rax, [rip + 0x45a23]; lea rcx, [r8 + r8*2]; shl rcx, 6; add [rcx + rax + 0x30], rdx; ret