ropshell> use 911ddf2e16761643a47225f654d811e5 (download)
name         : ntdll.dll (i386/PE)
base address : 0x7c901000
total gadgets: 6968

ropshell> search add esp ?
found 2 gadgets
> 0x7c90e037 : add esp, 0x14; ret
> 0x7c9012e1 : add esp, 0xc; ret