ropshell> use 5e28284f9b5f9097640d58a73d38ad4c (download)
name         : notepad.exe (i386/PE)
base address : 0x1001000
total gadgets: 869

ropshell> suggest "write mem"
> 0x010045bd : add [ebx], edi; ret
> 0x01006a42 : add [eax + 0x3b], ecx; ret
> 0x01004e15 : add [esi + 0x5d], ebx; ret 4
> 0x010033d3 : add [edi + 0x5e], ebx; ret
> 0x01001fe0 : add [ebx + 0x5fc78bf8], ecx; pop esi; pop ebp; ret 0x14
> 0x010034bc : add [ebx], esi; rcr [edi + 0x5e], 0xc9; ret 0x10
> 0x0100461a : add [edi], ecx; test [ebp + 0x3b000003], cl; ret
> 0x01005f55 : add [ebx + 0xa13825], eax; add [eax], eax; ret
> 0x01002966 : add [edx + 1], ebp; call eax
> 0x01001940 : add [ebp + 0x500374c0], eax; call esi
> 0x0100448f : add [ebp + 0x5302435c], ecx; call esi
> 0x010034b1 : add [ebp + 9], esi; call esi
> 0x01003400 : add [edx], ebp; push [ebp + 8]; call esi
> 0x01001dd5 : add [ebx], eax; add [eax], al; push 1; push ebx; call esi
> 0x01002a11 : add [esi + 0x56], edx; lea eax, [ebp - 0x20]; push esi; push eax; call edi
> 0x01001a8b : add [ecx], eax; add [eax], al; push edi; push [ebp + 8]; call esi
> 0x01002e52 : add [eax + 0x30], ebp; movsb es:[edi], [esi]; add [ecx], al; call esi
> 0x01004cce : add [eax + 0x6a], edx; add [eax - 0x38], ebp; add [eax], al; add bh, bh; xor eax, 0x1009838; call esi