ropshell> use bb5cbffc096497506167bce1d9690ef2 (download)
name         : ntdll.dll (i386/PE)
base address : 0x7c901000
total gadgets: 6382

ropshell> suggest "write mem"
> 0x7c91c252 : add [edx], eax; pop ebp; ret
> 0x7c93a1c5 : adc [ebx + 0x33f703c7], ecx; ret
> 0x7c9650da : add [esi + 0x5d], ebx; ret 4
> 0x7c967dec : add [eax + 0x1c], ecx; pop ebp; ret 8
> 0x7c927b19 : add [edi + 0x5e], ebx; pop ebp; ret 0x10
> 0x7c9237a9 : add [esi], ebx; pop esi; pop ebx; pop ebp; ret 0x10
> 0x7c920604 : add [ebx], esi; rcr [edi + 0x5e], 0x5d; ret 0xc
> 0x7c91a892 : add [ecx], eax; xor eax, eax; pop edi; pop ebp; ret 8
> 0x7c9355cb : adc [edx], esi; rcr [edi + 0x5e], 0x5d; ret 8
> 0x7c95e08e : add [esi], edi; xor eax, eax; pop edi; pop esi; pop ebp; ret 8
> 0x7c9674d9 : add [eax + 0x3202eb01], esi; rcr [edi + 0x5e], 0x5d; ret 8
> 0x7c9136c1 : add [ebp + 0x88504], ecx; add [eax], al; pop ebp; ret 4
> 0x7c93d876 : adc [ecx + 0x7e9fffd], ebx; mov ebp, edi; jmp [esi - 1]
> 0x7c9361f7 : add [edi + 0xf], edx; test [eax - 0x4ffffe75], esp; add [edi + 0x5e], ebx; pop ebp; ret 4
> 0x7c967e1a : add [eax + 0x2c], edx; mov ecx, [ecx + 0xc]; add [eax + 0x5c], ecx; pop ebp; ret 8
> 0x7c967cd5 : adc [ebx + 0x75005078], eax; add ecx, [ecx + 0x48895448]; push eax; inc [eax + 0x58]; pop ebp; ret 8
> 0x7c91ec8a : add [edi], ecx; test [eax], bh; add al, [eax]; add [ebx - 0x9343], al; call [ebx + ecx*4]
> 0x7c91ec37 : add [ecx + 0xc], eax; mov esi, [ecx + 8]; mov [ecx + esi*4 + 0x10], edx; inc [ecx + 8]; pop esi; pop ebp; ret 0xc
> 0x7c921487 : add [edx], edi; add [eax], al; lea eax, [esi + 0x18]; push eax; push [ebp + 8]; push edi; call [edi + 0x18]