ropshell> use 496b8f2985017169a4201a8d263aeac0 (download)
name         : msvcrt.dll (i386/PE)
base address : 0x10101000
total gadgets: 5057

ropshell> suggest "write mem"
> 0x10197b0d : adc [eax], edx; ret
> 0x10116d9a : add [ebx], esi; ret
> 0x10159c9a : add [ebx], edi; ret
> 0x10146ba4 : add [ebx + 0x300f465], eax; ret
> 0x10187d77 : add [esi + 0x5b], ebx; ret
> 0x10113478 : adc [ebx], edx; mov bh, 6; ret
> 0x1016a822 : add [ebx + 0x4528b02], ecx; pop ebp; ret
> 0x10137dab : add [edi + 0x5e], ebx; pop ebp; ret
> 0x101a3d21 : add [eax + 0x5f], ebx; pop esi; pop ebx; pop ebp; ret
> 0x1015d1cf : adc [edi + 0x50], edx; call esi
> 0x101a0c42 : add [ebp + 5], esi; xor ch, ch; fsqrt ; ret
> 0x10196e5d : add [edi], ecx; push esi; ror [edi], 1; push esi; ret
> 0x101328ab : add [ecx], eax; add [eax], al; pop ecx; pop ecx; pop ebp; ret
> 0x10189b38 : adc [ebp + 0x39660249], ecx; xor [ebp - 0xb], esi; pop esi; pop ebp; ret