ropshell> use 496b8f2985017169a4201a8d263aeac0 (download)
name         : msvcrt.dll (i386/PE)
base address : 0x10101000
total gadgets: 5057
ropshell> suggest "load mem"
> 0x10141ca0 : mov eax, [ecx + 0xc]; ret
> 0x101a0264 : mov eax, [edx + 4]; ret
> 0x101677dc : mov eax, [ebp + 0x10]; ret
> 0x1013c0da : mov ebp, [ebx + 0x20]; jmp eax
> 0x1013c997 : mov eax, [esi]; add eax, edx; pop esi; pop ebp; ret
> 0x1016a823 : mov eax, [edx]; mov edx, [edx + 4]; pop ebp; ret
> 0x10137956 : mov ecx, [ebp + 0x10]; mov [ecx], edx; pop ebp; ret
> 0x10156e88 : mov eax, [esi + 0x68]; pop edi; pop esi; pop ebx; mov esp, ebp; pop ebp; ret
> 0x1013a7ad : mov ecx, [edx + ecx]; add ecx, esi; add eax, ecx; pop esi; pop ebp; ret
> 0x1014230a : mov ecx, [edx]; mov [edx], eax; mov [esi], ecx; pop esi; pop ebp; ret
> 0x1013bda4 : mov eax, [edi + 0xc]; mov [esi + 0x8c], eax; pop esi; pop edi; pop ebp; ret
> 0x101422b8 : mov ecx, [eax]; mov eax, [ebp + 0xc]; cmp ecx, [eax]; sete al; pop ebp; ret
> 0x1013bfaa : mov ebx, [ebp + 0xc]; mov ebp, [ebp - 4]; mov esp, [ebx - 4]; jmp eax
> 0x1013177b : mov ecx, [edi + 4]; mov [eax], ecx; xor eax, eax; pop edi; pop esi; pop ebp; ret
> 0x101a3e38 : mov ecx, [eax + 0x9c]; mov eax, [ebp + 8]; mov [eax], ecx; xor eax, eax; pop ebp; ret
> 0x1013a7aa : mov edx, [esi + edx]; mov ecx, [edx + ecx]; add ecx, esi; add eax, ecx; pop esi; pop ebp; ret
> 0x1016a81c : mov edx, [ecx]; lea eax, [edx + 8]; mov [ecx], eax; mov eax, [edx]; mov edx, [edx + 4]; pop ebp; ret
> 0x1013bf9f : mov eax, [ebx]; mov fs:[0], eax; mov eax, [ebp + 8]; mov ebx, [ebp + 0xc]; mov ebp, [ebp - 4]; mov esp, [ebx - 4]; jmp eax
> 0x10160feb : mov esi, [edx + 0xc]; mov eax, [esp + 0x5c]; cmp eax, 1; adc eax, 0; mov esp, [edx + 0x10]; add esp, 4; jmp [edx + 0x14]