ropshell> use d7eef2c46a9880f21be01511024b53ab (download)
name         : MSCOMCTL.OCX (i386/PE)
base address : 0x27581000
total gadgets: 20271

ropshell> suggest "write mem"
> 0x275dfca3 : add [eax], ecx; ret
> 0x27590eb1 : adc [ebx], edi; ret
> 0x276193af : add [ebx], ebp; ret
> 0x2761c958 : add [eax + 0x3b], ebx; ret
> 0x27615913 : add [eax + 0xc], ecx; ret 0xc
> 0x27595f95 : add [ebx + 0x5d5e5fc7], ecx; ret 8
> 0x27584cc9 : add [edx + 0x27], ebx; ret
> 0x275946fe : adc [esi + 0x5d], ebx; ret 0x10
> 0x275f2984 : add [edi + 0x3b], ebx; ret
> 0x275c0c24 : adc [ebx], esi; fstp x[ebx]; ret
> 0x27581ad0 : adc [esi], ebp; xchg eax, edx; ret
> 0x2759b647 : add [edx], esi; fmul [eax - 0x3fccb7a2]; pop esi; pop ebx; ret 8
> 0x275cd9f3 : add [edx], ebp; push eax; call edi
> 0x275e5a7f : add [edx + 0x12], ebp; call edi
> 0x2760f65a : add [esi + 0xa], eax; call ebx
> 0x27622a0a : add [ebp + 0x5053e045], ecx; call esi
> 0x275ea798 : add [ecx], ebp; inc ecx; or [edi + 0x5e], bl; ret 8
> 0x27618fb6 : adc [eax + 0x54], ebp; jmp [edx + 0x27]
> 0x2761bbab : add [ecx], eax; add [eax], al; call edi
> 0x2759e7c9 : adc [eax + 0x51], edx; call [edx + 0x1c]
> 0x275d4fdc : add [ecx + 0x53], edx; call [eax + 0xc]
> 0x2759197d : add [esi + 0x50], edx; call [ecx + 0x18]
> 0x275c8526 : add [edi + 0x57], edx; push [ebp - 4]; call ebx
> 0x275c2ff9 : add [ebp + 0x4745dc0], eax; push ebp; push eax; call edi
> 0x27594f45 : add [ebx + 0x1c], eax; push [esi + 0x6c]; call edi
> 0x275e5f31 : add [ebp + 4], esi; mov eax, [ecx + edx*4 + 0x48]; ret 4
> 0x27607675 : add [edi], ecx; test [edi], ah; add eax, [eax]; add dh, dh; ret
> 0x27591baf : add [eax], edx; add [eax], al; push [esi + 0xa0]; call edi
> 0x275985b4 : adc [ecx], edx; add [eax], al; push [esi + 0xa0]; call edi
> 0x27623de5 : add [edx], eax; add [eax], al; push esi; call [esi + 0x68]
> 0x275d603e : add [ebx + 0x27589388], edi; push edx; push ebx; push eax; call [ecx + 0x14]
> 0x27581ac7 : adc [edx + 0xaa00ad], ecx; ror [ecx], 5; adc [esi], ebp; xchg eax, edx; ret
> 0x275a4e13 : adc [edx + eax], esi; add [ecx - 0x1c33a], al; call [eax + 0x56]
> 0x27625aca : add [ebx], eax; push eax; push edi; push [ebp - 0x14]; mov [ebp - 0x20], eax; call esi
> 0x27595fb8 : add [ebx + 0x56], edx; push edi; push ecx; mov [ebp - 0x10], ecx; call [eax + 0x48]