ropshell> use 8b063454f81c95209fc0900798507204 (download)
name         : OUTLMIME.DLL (i386/RAW)
base address : 0x0
total gadgets: 17388

ropshell> suggest "load mem"
> 0x0006fb36 : mov eax, [ecx]; ret
> 0x0006ecd8 : mov eax, [ecx + 0x1c]; ret
> 0x0006ab16 : mov eax, [ebp + 0x18]; pop ebp; ret 0x18
> 0x0006049a : mov ecx, [eax]; call [ecx + 0x20]; ret 4
> 0x0002a971 : mov esi, [eax]; call edi
> 0x0002f715 : mov esi, [edi]; call ebx
> 0x00001baa : mov eax, [esi + 0x100af558]; pop edi; pop esi; pop ebp; ret 4
> 0x0003959e : mov eax, [ebx]; call [eax + 4]
> 0x0006075f : mov eax, [edx]; call [eax + 4]
> 0x000096fd : mov eax, [esi]; call [eax + 0x10]
> 0x0002676e : mov eax, [edi]; call [eax + 0x28]
> 0x000342b8 : mov ecx, [edx]; call [ecx + 4]
> 0x00038ddd : mov ecx, [esi]; call [ecx + 4]
> 0x0000aa5d : mov edx, [eax]; call [edx + 0x14]
> 0x0001b80a : mov edx, [ecx]; call [edx + 0x10]
> 0x0002e8a3 : mov esi, [edx]; call [esi + 0x5c]
> 0x000669ec : mov edi, [esi]; call [edi + 0xc]
> 0x00027db6 : mov ecx, [ebp + 0xc]; mov [eax], ecx; pop ebp; ret 8
> 0x0006b0f8 : mov esi, [ebp + 0xc]; mov eax, esi; pop esi; pop ebp; ret 8
> 0x0003715c : mov ecx, [ebx]; push ebx; call [ecx + 4]
> 0x00084da7 : mov edi, [ecx]; push ecx; call [edi + 0x24]
> 0x0004b61c : mov eax, [edx + 0x28]; call [eax + 4]
> 0x0000a4d3 : mov edx, [esi]; mov ecx, esi; call [edx + 0x38]
> 0x000175ec : mov edx, [edi]; mov ecx, edi; call [edx + 0x40]
> 0x0007e899 : mov esi, [ebx]; push eax; push [ebp + 8]; call edi
> 0x00027da4 : mov eax, [ebx + 0x18]; pop edi; and eax, esi; pop esi; pop ebx; pop ebp; ret 4
> 0x0005d0e9 : mov ecx, [esi + 0x68]; and [ecx + 8], 0; pop esi; pop ebp; ret 4
> 0x00063fd2 : mov ecx, [edi]; push 1; push ebx; push edi; call [ecx + 0x50]
> 0x00069e8b : mov eax, [edi + 0x14]; push [eax + ebx*8]; call esi
> 0x0008cdad : mov ecx, [eax + 4]; or [eax], 2; mov [eax + 4], ecx; ret
> 0x00007417 : mov edx, [ebp + 0x10]; pop edi; pop esi; pop ebx; mov [edx], ecx; pop ebp; ret 0xc
> 0x0007ec1b : mov edi, [ebp + 8]; push edx; push ecx; call [eax + 0x7c]
> 0x0006c2f0 : mov ebx, [esi + 4]; push eax; mov ecx, [eax]; call [ecx + 8]
> 0x00057237 : mov ebx, [ebp + 8]; push eax; push ebx; push [ebp - 0x24c]; call [esi + 0x10]
> 0x00077c17 : mov ecx, [edx + 1]; add [ebx - 0x769b0bb3], cl; or eax, 0; pop ecx; mov esp, ebp; pop ebp; ret
> 0x00068645 : mov edx, [ecx + 0xc]; sub eax, edx; mov [ecx + 0x14], eax; xor eax, eax; inc eax; ret
> 0x00010c2e : mov esi, [ebx + 0x8a4]; push esi; mov eax, [esi]; call [eax + 4]
> 0x0002c988 : mov edi, [eax + 0x1c]; mov esi, edx; push edi; mov [ebp - 4], eax; call ebx
> 0x00073e34 : mov esi, [eax + 0x80]; mov eax, [eax]; push eax; mov edx, [eax]; call [edx + 0x4c]
> 0x0001519d : mov ecx, [edi + 0x11f4]; push esi; push [edi + 0x10b8]; mov eax, [ecx]; push ecx; call [eax + 8]