ropshell> use bf27cb0e70701b1211030c01e1063174 (download)
name         : ntdll.dll (i386/PE)
base address : 0x6a201000
total gadgets: 11361

ropshell> suggest "load mem"
> 0x6a21a9e5 : mov edx, [ebx]; ret
> 0x6a20a580 : mov ebp, [eax]; ret
> 0x6a297564 : mov eax, [edx + 4]; ret
> 0x6a2f01a0 : mov eax, [esi + 0x20]; pop esi; ret
> 0x6a2931ad : mov eax, [ebp + 0x10]; pop ebp; ret
> 0x6a2f0917 : mov eax, [ecx]; pop edi; pop esi; pop ebx; pop ebp; ret 0x10
> 0x6a2f1c2b : mov eax, [edx]; mov [ecx], eax; pop esi; ret
> 0x6a2a3cbd : mov ecx, [ebp + 0x18]; call ecx
> 0x6a27572e : mov eax, [edi + 0x20]; pop ebx; pop edi; pop esi; pop ebp; ret 0x10
> 0x6a2d8413 : mov ecx, [edx + 0x4c]; mov [eax], ecx; pop ebp; ret 0xc
> 0x6a23e160 : mov eax, [ebx]; pop edi; pop esi; pop ebx; mov esp, ebp; pop ebp; ret 0xc
> 0x6a2c6cff : mov eax, [esi]; cld ; call [esi - 1]
> 0x6a2e2d2f : mov ecx, [esi]; sub ecx, eax; mov eax, ecx; pop esi; pop ebp; ret 4
> 0x6a2a3cfa : mov eax, [ecx + 8]; mov [edx], eax; mov eax, 2; ret 0x10
> 0x6a23a577 : mov ecx, [esi + 4]; mov [edx + 0x1a0], ecx; pop esi; pop ebp; ret 4
> 0x6a2d83a5 : mov edx, [ebp + 8]; mov eax, [ebp + 0xc]; bswap edx; bswap eax; pop ebp; ret 8
> 0x6a2d8034 : mov eax, [edi]; mov [esi], eax; mov [edi], esi; pop edi; pop esi; pop ebx; ret
> 0x6a29fd1a : mov ecx, [edx]; movzx eax, [ecx]; add ecx, 2; mov [edx], ecx; pop ebp; ret
> 0x6a2f011b : movzx ecx, [edi]; add esi, ecx; mov [edx], edi; mov eax, esi; pop edi; pop esi; ret
> 0x6a2eade9 : mov eax, [ebx + 0x194]; mov [edx + 0x194], eax; pop edi; pop esi; pop ebx; pop ebp; ret 8
> 0x6a2edc8b : mov edx, [eax + 0x50]; mov eax, [edx + 8]; mov edx, [edx + 0xc]; ret
> 0x6a2560ab : mov ecx, [edi + 4]; shl esi, cl; add esi, [edi + 0xc]; mov eax, esi; pop edi; pop esi; ret
> 0x6a299341 : mov ebp, [ecx]; push -0x19; mov [ecx], gs; push -0x75; call [ebp - 0x75]