ropshell> use a1f9191578ccf9869a952e47591e1708 (download) name : SystemSurvey.exe (i386/PE) base address : 0x401000 total gadgets: 21654
ropshell> suggest call > 0x00405375 : call eax > 0x004019f0 : call ebx > 0x00401cb2 : call ecx > 0x004051e8 : call edx > 0x00401e6c : call esi jmp > 0x0048ba20 : push esp; ret > 0x004288e6 : jmp eax > 0x004c988d : jmp ebx > 0x00414fed : jmp ecx > 0x0044ef3f : jmp edx load mem > 0x00428b64 : mov eax, [edx]; ret > 0x0040b7db : mov eax, [ecx]; cdq ; ret > 0x004253ff : mov eax, [esi]; pop esi; ret > 0x004db7a0 : mov eax, [ecx + 0x1c]; ret > 0x00462f5e : mov edx, [eax]; push 1; call edx; ret load reg > 0x004621c6 : pop eax; ret > 0x00402786 : pop ebx; ret > 0x0040418c : pop ecx; ret > 0x0048ba32 : pop edx; ret > 0x004015b0 : pop esi; ret pop pop ret > 0x004621c6 : pop eax; ret > 0x0051746b : pop eax; pop ebp; ret > 0x00516583 : pop eax; pop esi; pop ebp; ret > 0x00520ad3 : pop eax; pop esi; pop edi; pop ebp; ret > 0x004a72ea : pop ebp; pop edi; pop esi; pop ebx; pop ecx; ret sp lifting > 0x0047c540 : add esp, 0x1004; ret > 0x0047c540 : add esp, 0x1004; ret > 0x004835f1 : add esp, 0x204; ret > 0x004864ed : add esp, 0x30; ret > 0x00499eca : add esp, 0x408; ret stack pivoting > 0x004099dd : xchg eax, esp; ret > 0x005322a3 : mov esp, ebx; pop ebx; ret > 0x004013c0 : mov esp, ebp; pop ebp; ret > 0x004609f4 : mov esp, edi; dec [ebx - 0x1a74a13a]; pop ebp; ret > 0x0049f72f : xchg esp, edi; add al, [eax]; add [ebx], bh; ret write mem > 0x004d10d1 : add [ebx], eax; ret > 0x0044cdc4 : add [ebx], ecx; ret > 0x00438203 : adc [ebx], edi; ret > 0x0045cd51 : add [ebx], ebp; ret > 0x0040c8a2 : add [ecx], eax; ret