ropshell> use 5d7f1e332eecbe9fb468d7b6a9f0423e (download)
name         : brainpan.exe (i386/PE)
base address : 0x31171000
total gadgets: 109

ropshell> suggest
call
    > 0x3117104c : call eax
    > 0x31171516 : call [eax]
    > 0x311713af : call [ebx + esi]
jmp
    > 0x31171c9b : jmp eax
    > 0x311712ca : jmp ecx
    > 0x311712f3 : jmp esp
load mem
    > 0x31171959 : mov ecx, [eax + 4]; jmp ecx
    > 0x31171c96 : mov ecx, [eax]; mov eax, [eax + 4]; jmp eax
load reg
    > 0x311712f8 : pop ebx; ret
    > 0x311712fa : pop ebp; ret
    > 0x31171a1b : pop edi; pop ebp; ret
    > 0x311717c6 : pop ecx; pop ebx; pop ebp; ret
    > 0x31171a1a : pop esi; pop edi; pop ebp; ret
pop pop ret
    > 0x311712fa : pop ebp; ret
    > 0x311717c7 : pop ebx; pop ebp; ret
    > 0x311717c6 : pop ecx; pop ebx; pop ebp; ret
    > 0x31171a19 : pop ebx; pop esi; pop edi; pop ebp; ret
stack pivoting
    > 0x3117105b : mov esp, ebp; pop ebp; ret 4
    > 0x31171a16 : lea esp, [ebp - 0xc]; pop ebx; pop esi; pop edi; pop ebp; ret
    > 0x31171c94 : mov esp, ecx; mov ecx, [eax]; mov eax, [eax + 4]; jmp eax
    > 0x31171361 : leave ; ret