ropshell> use 5081e2ba40b2df97f193382b0212d17a (download)
name         : binkw32.dll (i386/PE)
base address : 0x10001000
total gadgets: 2597

ropshell> suggest "load mem"
> 0x1001ee44 : mov eax, [edx + 4]; ret
> 0x1001ab46 : mov eax, [ecx + 0x28]; pop esi; ret 8
> 0x1001ab15 : mov eax, [esi + 0x28]; pop esi; ret 8
> 0x1001c8b1 : mov eax, [edi + 0x28]; pop edi; ret 8
> 0x1001e059 : mov eax, [ebp + 0xc]; pop esi; pop ebx; pop ebp; ret
> 0x1001d028 : mov ecx, [eax]; mov eax, [eax + 4]; push eax; ret
> 0x100070b8 : mov eax, [ebx]; push ebx; call [eax + 0x6c]
> 0x1001c6b7 : mov edx, [eax]; push eax; call [edx + 0x50]
> 0x10005901 : mov edx, [esi]; push esi; call [edx + 0x6c]
> 0x10006fcc : mov edx, [edi]; push edi; call [edx + 8]
> 0x1000e3f1 : mov ecx, [ebx + 0x5f102454]; lea eax, [esi + edx]; pop esi; ret
> 0x1001c34a : mov eax, [ecx]; push ebp; push ecx; call [eax + 0x44]
> 0x1001c915 : mov eax, [esi]; mov ecx, [eax]; push eax; call [ecx + 0x48]
> 0x10009baa : mov ecx, [eax + 0xc]; mov [eax + 0x228], edx; mov [eax + 0x220], ecx; ret
> 0x10009bc2 : mov edx, [eax + 0xc]; mov [eax + 0x224], ecx; mov [eax + 0x228], edx; ret
> 0x1001c3b9 : mov edx, [esi + 4]; push edx; push 0; push eax; call [ecx + 0x2c]
> 0x1001c681 : mov esi, [eax + 0x38]; mov eax, [eax + 0x3c]; push esi; push eax; push ecx; call [edx + 0x4c]
> 0x1000787d : mov eax, [edx]; lea ecx, [esp + 4]; push ecx; push edx; mov [esp + 0xc], 0x20; call [eax + 0x54]
> 0x1001ceb5 : mov ecx, [ebp + 8]; mov [ebx + 8], ecx; mov [ebx + 4], eax; mov [ebx + 0xc], ebp; pop ecx; pop ebx; ret 4