ropshell> use d924c371dec38ef931be57fae9b57aae (download)
name         : ntdll.dll (i386/PE)
base address : 0x6a201000
total gadgets: 9150

ropshell> suggest "load mem"
> 0x6a20a2d5 : mov edx, [ebx]; ret
> 0x6a20f690 : mov ebp, [eax]; ret
> 0x6a2ca88b : mov eax, [edx + 0x20]; ret
> 0x6a2caa63 : mov eax, [esi + 0x38]; pop esi; ret
> 0x6a26e72d : mov eax, [ebp + 0x10]; pop ebp; ret
> 0x6a2e29f9 : mov eax, [ecx + 0x14]; add eax, edx; ret
> 0x6a23cec0 : mov eax, [edx]; mov edx, [edx + 4]; ret
> 0x6a27e5dd : mov ecx, [ebp + 0x18]; call ecx
> 0x6a2b48d3 : mov ecx, [edx + 0x4c]; mov [eax], ecx; pop ebp; ret 0xc
> 0x6a27aee4 : movzx eax, [ecx]; add ecx, 2; mov [edx], ecx; pop ebp; ret
> 0x6a2bd4af : mov ecx, [esi]; sub ecx, eax; mov eax, ecx; pop esi; pop ebp; ret 4
> 0x6a225878 : mov eax, [esi]; add [ebx + 0x5b5e5fc6], cl; mov esp, ebp; pop ebp; ret 8
> 0x6a218869 : mov eax, [ebx]; mov [ecx + eax], 0; pop ebx; pop edi; pop esi; pop ebp; ret 0x14
> 0x6a2c1864 : mov ecx, [esi + 8]; mov [edi + 4], ecx; pop edi; pop esi; pop ebp; ret 8
> 0x6a2b46b7 : mov eax, [edi]; mov [esi], eax; mov [edi], esi; pop edi; pop esi; pop ebx; ret
> 0x6a27aee2 : mov ecx, [edx]; movzx eax, [ecx]; add ecx, 2; mov [edx], ecx; pop ebp; ret
> 0x6a2ca86d : movzx ecx, [edi]; add esi, ecx; mov [edx], edi; mov eax, esi; pop edi; pop esi; ret
> 0x6a2c233f : mov ecx, [ebx + 0x8bec45]; mov eax, [eax]; mov [ebp - 0x1c], eax; xor eax, eax; inc eax; ret
> 0x6a25ce6c : mov eax, [edi + 4]; sub eax, esi; mov [ecx], esi; pop edi; mov [edx], eax; pop esi; ret