ropshell> use 4ca0efa819646e63b1ed96fa41d42ad9 (download)
name         : rpcrt4.dll (i386/RAW)
base address : 0x0
total gadgets: 7062

ropshell> suggest "load mem"
> 0x000baaf4 : mov esi, [eax]; ret
> 0x0003e450 : mov eax, [ecx + 0x134]; ret
> 0x000221e4 : mov eax, [esi + 0x14]; pop esi; ret
> 0x0003e4c5 : mov eax, [ebp + 8]; pop ebp; ret 4
> 0x00028416 : mov eax, [edi + 0x13c]; pop edi; pop esi; ret
> 0x000a0eba : movzx edx, [eax + 0x1a2]; mov ax, dx; ret
> 0x0005eb51 : mov eax, [edx + 0x38]; and eax, 2; pop ebp; ret 8
> 0x00015a74 : mov ecx, [ebp + 8]; call esi
> 0x0007df15 : mov ecx, [esi]; mov [edi], cx; pop edi; pop esi; ret
> 0x000327e9 : mov eax, [ebx + 4]; mov [eax + 0x2c], 0; ret
> 0x0007dd42 : mov ecx, [esi + 4]; mov [edi], cx; pop edi; pop esi; ret
> 0x0009b554 : mov edx, [ebx + 4]; mov ecx, edi; call esi
> 0x00093e56 : mov edx, [ebp + 0x10]; mov ecx, edi; call esi
> 0x0002e3c4 : mov eax, [edx]; mov [esi + 0x7c], eax; mov eax, edx; pop esi; ret
> 0x00010a3a : mov ecx, [edi]; mov [esi + 4], ecx; pop edi; pop esi; pop ebp; ret 0xc
> 0x0000f50b : mov edx, [esi]; mov eax, [ebp - 8]; pop esi; mov esp, ebp; pop ebp; ret
> 0x0007dcba : mov eax, [esi]; mov [ecx + 4], ax; xor eax, eax; pop edi; pop esi; pop ebp; ret 4
> 0x0003e2db : mov ecx, [eax + 0x78]; mov eax, [ebp + 8]; mov [eax], ecx; pop ebp; ret 4
> 0x00065a64 : mov ecx, [edx + 0x14]; mov [esi], eax; mov [esi + 4], ecx; xor eax, eax; pop esi; pop ebp; ret 0x10
> 0x00079337 : mov eax, [ecx]; mov [edx + 0x3c], eax; mov eax, [ecx + 4]; mov [edx + 0x40], eax; pop ebp; ret 8
> 0x0002c7c0 : mov edx, [ecx + 4]; mov eax, [esi + 4]; pop esi; mov [edx], eax; add [ecx + 4], 4; ret
> 0x000185e9 : mov ecx, [edx]; mov eax, [ecx + esi*4]; dec [edx + 8]; and [ecx + esi*4], 0; pop esi; pop ebp; ret 4