ropshell> use 837b1e310f2aa8b20f07a9b1ce90ac4f (download)
name         : msvcr71.dll (i386/PE)
base address : 0x7c361000
total gadgets: 2987

ropshell> suggest "load mem"
> 0x7c37640a : mov eax, [ecx + 0xc]; ret
> 0x7c393334 : mov eax, [edx + 4]; ret
> 0x7c37094d : mov eax, [esi + 0x28]; pop esi; ret
> 0x7c36d546 : mov eax, [ebp + 0x10]; pop ebp; ret
> 0x7c380d90 : movzx eax, [ecx]; add eax, esi; pop esi; ret
> 0x7c38c1bc : movzx ecx, [edx]; sub eax, ecx; pop ebp; ret
> 0x7c375765 : mov ebp, [ebx + 0x20]; jmp eax
> 0x7c361556 : mov ecx, [eax]; mov eax, [eax + 4]; push eax; ret
> 0x7c374a7d : mov ecx, [esi + 0xc]; mov [eax + 0x80], ecx; pop esi; ret
> 0x7c374a9c : mov ecx, [ebp + 0xc]; call [ebp + 8]
> 0x7c3765fc : mov eax, [esi]; mov ecx, esi; call [eax]
> 0x7c37663a : mov eax, [edi]; mov ecx, edi; pop edi; pop esi; jmp [eax + 4]
> 0x7c38c1e4 : mov edx, [eax]; sub dx, cx; neg dx; sbb edx, edx; not edx; and eax, edx; ret
> 0x7c3767e8 : mov ecx, [esi]; mov [esi + ecx*4 + 4], eax; mov eax, esi; pop esi; ret 4
> 0x7c375503 : mov ebx, [ebp + 0xc]; mov esp, [ebx - 4]; mov ebp, [ebp - 4]; jmp eax
> 0x7c3748f0 : mov esi, [edx + esi]; mov ecx, [esi + ecx]; add ecx, edx; add eax, ecx; pop esi; ret
> 0x7c3759f2 : mov esi, [eax + 8]; add ecx, [edx + esi]; pop esi; mov eax, [eax]; add eax, ecx; ret
> 0x7c3754f8 : mov eax, [ebx]; mov fs:[0], eax; mov eax, [ebp + 8]; mov ebx, [ebp + 0xc]; mov esp, [ebx - 4]; mov ebp, [ebp - 4]; jmp eax