ropshell> use c4e990982a04fe8e8f1753421eab282b (download)
name         : tshark.exe (x86_64/PE)
base address : 0x140001000
total gadgets: 1034

ropshell> suggest "load reg"
> 0x14003e216 : pop rax; ret
> 0x1400205a1 : pop rbx; ret
> 0x140007061 : pop rsi; ret
> 0x1400013c4 : pop rdi; ret
> 0x14003ec96 : pop rbp; ret
> 0x14003eecf : pop rsp; pop rsi; ret
> 0x14003eece : pop r12; pop rsi; ret
> 0x14003eecc : pop r13; pop r12; pop rsi; ret
> 0x14003ec93 : pop r14; pop rsi; pop rbp; ret
> 0x14003eeca : pop r15; pop r13; pop r12; pop rsi; ret
> 0x1400252ea : mov eax, [rsp + 0x18]; pop rdi; ret
> 0x14003fa88 : mov rax, [rsp + 0x28]; add rsp, 0x48; ret
> 0x140040479 : mov rcx, [rsp + 0x38]; call rbp
> 0x14004047a : mov ecx, [rsp + 0x38]; call rbp
> 0x14003e5cf : mov rdx, [rsp + 0x50]; xor ecx, ecx; call [rip + 0x3ab4]; add rsp, 0x78; ret
> 0x14003e5d0 : mov edx, [rsp + 0x50]; xor ecx, ecx; call [rip + 0x3ab4]; add rsp, 0x78; ret
> 0x14003e5ca : mov r8, [rsp + 0x48]; mov rdx, [rsp + 0x50]; xor ecx, ecx; call [rip + 0x3ab4]; add rsp, 0x78; ret
> 0x14003de97 : mov rdi, [rsp]; mov [r9 + 4], rax; mov [r9 + 0xc], rdx; mov [r8], r9; add rsp, 8; ret
> 0x14003de98 : mov edi, [rsp]; mov [r9 + 4], rax; mov [r9 + 0xc], rdx; mov [r8], r9; add rsp, 8; ret
> 0x14003e5c5 : mov r9, [rsp + 0x40]; mov r8, [rsp + 0x48]; mov rdx, [rsp + 0x50]; xor ecx, ecx; call [rip + 0x3ab4]; add rsp, 0x78; ret