ropshell> use 5fa34090bffaae489c45ba43712a50c5 (download) name : dns.exe (x86_64/PE) base address : 0x100001000 total gadgets: 2880
ropshell> suggest "load reg" > 0x100040938 : pop rax; ret > 0x1000174fa : pop rbx; ret > 0x10005afbf : pop rcx; ret > 0x100017e6d : pop rsi; ret > 0x100017074 : pop rdi; ret > 0x100018f5f : pop rbp; ret > 0x10001a65f : pop rsp; ret > 0x10001a65e : pop r12; ret > 0x100026f5d : pop r13; ret > 0x100022670 : pop r15; ret > 0x10003e3c8 : pop r14; pop r12; ret > 0x1000469b8 : pop rdx; add [rax - 0x75], ecx; ret > 0x1000616fa : mov rbx, [rsp + 8]; ret > 0x10006b758 : mov rsi, [rsp + 0x10]; ret > 0x100079485 : mov rdi, [rsp + 0x10]; ret > 0x1000616fb : mov ebx, [rsp + 8]; ret > 0x10006b759 : mov esi, [rsp + 0x10]; ret > 0x100079486 : mov edi, [rsp + 0x10]; ret > 0x100040930 : mov rax, [rsp + 0x68]; add rsp, 0x58; ret > 0x1000816c4 : mov r11, [rsp + 8]; add rsp, 0x10; ret > 0x100040931 : mov eax, [rsp + 0x68]; add rsp, 0x58; ret > 0x1000816c0 : mov r10, [rsp]; mov r11, [rsp + 8]; add rsp, 0x10; ret > 0x1000816c1 : mov edx, [rsp]; mov r11, [rsp + 8]; add rsp, 0x10; ret > 0x10006e0f3 : mov rbp, [rsp + 0x10]; mov rsi, [rsp + 0x18]; mov rdi, [rsp + 0x20]; ret > 0x10006e0f4 : mov ebp, [rsp + 0x10]; mov rsi, [rsp + 0x18]; mov rdi, [rsp + 0x20]; ret > 0x100043d43 : mov ecx, [rsp + 0xe8]; mov r9, rbx; mov r8d, r14d; mov rdx, r12; call r15 > 0x10007130a : mov r9, [rsp + 0x68]; lea rdx, [rip - 0x5da46]; mov r8d, r12d; mov rcx, r15; call r14 > 0x100020dd7 : mov r13, [rsp + 0x160]; lea rdx, [rip - 0x1e566]; mov rcx, r12; mov [rsp + 0x20], eax; call r13 > 0x10007f3c2 : mov rdx, [rsp + 0x50]; mov rcx, [rcx + 0x38]; mov [rsp + 0x20], eax; call [r10 + 0x20] > 0x1000707c4 : mov r8, [rsp + 0x68]; lea rdx, [rip - 0x5da10]; mov rcx, r15; mov [rsp + 0x28], rbp; mov [rsp + 0x20], rdi; call r14 > 0x100020dcf : mov r12, [rsp + 0x168]; mov r13, [rsp + 0x160]; lea rdx, [rip - 0x1e566]; mov rcx, r12; mov [rsp + 0x20], eax; call r13 > 0x100020dd0 : mov esp, [rsp + 0x168]; mov r13, [rsp + 0x160]; lea rdx, [rip - 0x1e566]; mov rcx, r12; mov [rsp + 0x20], eax; call r13 > 0x10007f3bd : mov rcx, [rsp + 0x48]; mov rdx, [rsp + 0x50]; mov rcx, [rcx + 0x38]; mov [rsp + 0x20], eax; call [r10 + 0x20]