ropshell> use c4e990982a04fe8e8f1753421eab282b (download)
name         : tshark.exe (x86_64/PE)
base address : 0x140001000
total gadgets: 1034
ropshell> suggest
call
    > 0x14003f06f : call rbx
    > 0x14003f139 : call rsi
    > 0x1400182e5 : call rdi
    > 0x14004047e : call rbp
    > 0x14003f138 : call r14
jmp
    > 0x140001541 : jmp rax
    > 0x14002badd : jmp rcx
    > 0x14001f421 : jmp rsi
    > 0x140020310 : jmp [rax]
    > 0x1400404bf : jmp [rsi - 0x7d]
load mem
    > 0x14003ee15 : mov rsi, [r11 + 0x28]; mov rsp, r11; pop rdi; ret
    > 0x14003ee16 : mov esi, [rbx + 0x28]; mov rsp, r11; pop rdi; ret
    > 0x14003ee11 : mov rbx, [r11 + 0x20]; mov rsi, [r11 + 0x28]; mov rsp, r11; pop rdi; ret
    > 0x14003de94 : mov rax, [r8]; mov rdi, [rsp]; mov [r9 + 4], rax; mov [r9 + 0xc], rdx; mov [r8], r9; add rsp, 8; ret
load reg
    > 0x14003e216 : pop rax; ret
    > 0x1400205a1 : pop rbx; ret
    > 0x140007061 : pop rsi; ret
    > 0x1400013c4 : pop rdi; ret
    > 0x14003ec96 : pop rbp; ret
pop pop ret
    > 0x14003e216 : pop rax; ret
    > 0x14003eece : pop r12; pop rsi; ret
    > 0x14003eecc : pop r13; pop r12; pop rsi; ret
    > 0x14003f166 : pop r12; pop rdi; pop rbp; pop rbx; ret
    > 0x14002059c : pop r12; pop rdi; pop rsi; pop rbp; pop rbx; ret
sp lifting
    > 0x14003fd80 : add rsp, 0x18; ret
    > 0x14003fd80 : add rsp, 0x18; ret
    > 0x14003e115 : add rsp, 0x28; ret
    > 0x14003e0aa : add rsp, 0x38; ret
    > 0x1400402fd : add rsp, 0x458; ret
stack pivoting
    > 0x14003ee19 : mov rsp, r11; pop rdi; ret
    > 0x14003ee1a : mov esp, ebx; pop rdi; ret
    > 0x14003e5d5 : leave ; call [rip + 0x3ab4]; add rsp, 0x78; ret
write mem
    > 0x14003e791 : add [rcx], ebp; add [rax], al; add rsp, 0x28; ret