ropshell> use d7c7e50f2d5d32b260ed380c475fc37f (download)
name         : ntdll.dll (i386/PE)
base address : 0x4b281000
total gadgets: 12633

ropshell> suggest "load mem"
> 0x4b29ed35 : mov edx, [ebx]; ret
> 0x4b29b6c0 : mov ebp, [eax]; ret
> 0x4b2f9c64 : mov eax, [edx + 4]; ret
> 0x4b366e09 : mov eax, [esi + 0x20]; pop esi; ret
> 0x4b2f57bd : mov eax, [ebp + 0x10]; pop ebp; ret
> 0x4b367580 : mov eax, [ecx]; pop edi; pop esi; pop ebx; pop ebp; ret 0x10
> 0x4b36950b : mov eax, [edx]; mov [ecx], eax; pop esi; ret
> 0x4b3071dd : mov ecx, [ebp + 0x18]; call ecx
> 0x4b33ea93 : mov ecx, [edx + 0x4c]; mov [eax], ecx; pop ebp; ret 0xc
> 0x4b34f6bf : mov ecx, [esi]; sub ecx, eax; mov eax, ecx; pop esi; pop ebp; ret 4
> 0x4b30721a : mov eax, [ecx + 8]; mov [edx], eax; mov eax, 2; ret 0x10
> 0x4b35e8e4 : mov eax, [esi]; shr eax, 8; mov [edi], eax; pop edi; pop esi; ret
> 0x4b356254 : mov ecx, [esi + 8]; mov [edi + 4], ecx; pop edi; pop esi; pop ebp; ret 8
> 0x4b33e935 : mov edx, [ebp + 8]; mov eax, [ebp + 0xc]; bswap edx; bswap eax; pop ebp; ret 8
> 0x4b33e517 : mov eax, [edi]; mov [esi], eax; mov [edi], esi; pop edi; pop esi; pop ebx; ret
> 0x4b302304 : mov ecx, [edx]; movzx eax, [ecx]; add ecx, 2; mov [edx], ecx; pop ebp; ret
> 0x4b366d84 : movzx ecx, [edi]; add esi, ecx; mov [edx], edi; mov eax, esi; pop edi; pop esi; ret
> 0x4b35c0f9 : mov eax, [ebx + 0x194]; mov [edx + 0x194], eax; pop edi; pop esi; pop ebx; pop ebp; ret 8
> 0x4b362ffb : mov edx, [eax + 0x50]; mov eax, [edx + 8]; mov edx, [edx + 0xc]; ret
> 0x4b37e42d : mov ecx, [edi + 4]; shl esi, cl; add esi, [edi + 0xc]; mov eax, esi; pop edi; pop esi; ret
> 0x4b2c78c1 : mov ebx, [eax + 1]; add [ecx - 0x216cbba], cl; add eax, [eax]; add [ebp - 0xf77b], cl; call [eax - 0x18]