ropshell> use 67b2026b5d9009b183a8f4eb23a6180e (download)
name         : KernelBase.dll (x86_64/PE)
base address : 0x180001000
total gadgets: 17820

ropshell> suggest "load reg"
> 0x1800115cc : pop rax; ret
> 0x180001ca7 : pop rbx; ret
> 0x1800d4963 : pop rcx; ret
> 0x18009e73b : pop rdx; ret
> 0x180001ae9 : pop rsi; ret
> 0x1800017ce : pop rdi; ret
> 0x18000111f : pop rbp; ret
> 0x180004b34 : pop rsp; ret
> 0x180004b33 : pop r12; ret
> 0x180009a0d : pop r13; ret
> 0x18000503e : pop r14; ret
> 0x180007308 : pop r15; ret
> 0x18009e739 : pop r10; pop rdx; ret
> 0x18002aa07 : mov rax, [rsp + 8]; ret
> 0x180005908 : mov rbx, [rsp + 8]; ret
> 0x180002342 : mov rdi, [rsp + 0x10]; ret
> 0x18002aa08 : mov eax, [rsp + 8]; ret
> 0x180005909 : mov ebx, [rsp + 8]; ret
> 0x180002343 : mov edi, [rsp + 0x10]; ret
> 0x180039a30 : mov rbp, [rsp + 0x30]; pop r14; pop rsi; ret
> 0x180039a31 : mov ebp, [rsp + 0x30]; pop r14; pop rsi; ret
> 0x18002b0d9 : mov rsi, [rsp + 0x10]; mov rdi, [rsp + 0x18]; ret
> 0x18002b0da : mov esi, [rsp + 0x10]; mov rdi, [rsp + 0x18]; ret
> 0x18004838b : mov ecx, [rsp + rax*4 + 0x48478]; add rcx, r12; jmp rcx