ropshell> use 5fa34090bffaae489c45ba43712a50c5 (download)
name         : dns.exe (x86_64/PE)
base address : 0x100001000
total gadgets: 2880
ropshell> suggest "load reg"
> 0x100040938 : pop rax; ret
> 0x1000174fa : pop rbx; ret
> 0x10005afbf : pop rcx; ret
> 0x100017e6d : pop rsi; ret
> 0x100017074 : pop rdi; ret
> 0x100018f5f : pop rbp; ret
> 0x10001a65f : pop rsp; ret
> 0x10001a65e : pop r12; ret
> 0x100026f5d : pop r13; ret
> 0x100022670 : pop r15; ret
> 0x10003e3c8 : pop r14; pop r12; ret
> 0x1000469b8 : pop rdx; add [rax - 0x75], ecx; ret
> 0x1000616fa : mov rbx, [rsp + 8]; ret
> 0x10006b758 : mov rsi, [rsp + 0x10]; ret
> 0x100079485 : mov rdi, [rsp + 0x10]; ret
> 0x1000616fb : mov ebx, [rsp + 8]; ret
> 0x10006b759 : mov esi, [rsp + 0x10]; ret
> 0x100079486 : mov edi, [rsp + 0x10]; ret
> 0x100040930 : mov rax, [rsp + 0x68]; add rsp, 0x58; ret
> 0x1000816c4 : mov r11, [rsp + 8]; add rsp, 0x10; ret
> 0x100040931 : mov eax, [rsp + 0x68]; add rsp, 0x58; ret
> 0x1000816c0 : mov r10, [rsp]; mov r11, [rsp + 8]; add rsp, 0x10; ret
> 0x1000816c1 : mov edx, [rsp]; mov r11, [rsp + 8]; add rsp, 0x10; ret
> 0x10006e0f3 : mov rbp, [rsp + 0x10]; mov rsi, [rsp + 0x18]; mov rdi, [rsp + 0x20]; ret
> 0x10006e0f4 : mov ebp, [rsp + 0x10]; mov rsi, [rsp + 0x18]; mov rdi, [rsp + 0x20]; ret
> 0x100043d43 : mov ecx, [rsp + 0xe8]; mov r9, rbx; mov r8d, r14d; mov rdx, r12; call r15
> 0x10007130a : mov r9, [rsp + 0x68]; lea rdx, [rip - 0x5da46]; mov r8d, r12d; mov rcx, r15; call r14
> 0x100020dd7 : mov r13, [rsp + 0x160]; lea rdx, [rip - 0x1e566]; mov rcx, r12; mov [rsp + 0x20], eax; call r13
> 0x10007f3c2 : mov rdx, [rsp + 0x50]; mov rcx, [rcx + 0x38]; mov [rsp + 0x20], eax; call [r10 + 0x20]
> 0x1000707c4 : mov r8, [rsp + 0x68]; lea rdx, [rip - 0x5da10]; mov rcx, r15; mov [rsp + 0x28], rbp; mov [rsp + 0x20], rdi; call r14
> 0x100020dcf : mov r12, [rsp + 0x168]; mov r13, [rsp + 0x160]; lea rdx, [rip - 0x1e566]; mov rcx, r12; mov [rsp + 0x20], eax; call r13
> 0x100020dd0 : mov esp, [rsp + 0x168]; mov r13, [rsp + 0x160]; lea rdx, [rip - 0x1e566]; mov rcx, r12; mov [rsp + 0x20], eax; call r13
> 0x10007f3bd : mov rcx, [rsp + 0x48]; mov rdx, [rsp + 0x50]; mov rcx, [rcx + 0x38]; mov [rsp + 0x20], eax; call [r10 + 0x20]