ropshell> use ddfdc0ca6fbb9372402f9e6cb0ed1097 (download)
name         : ntdll.dll (x86_64/PE)
base address : 0x78e51000
total gadgets: 12000

ropshell> suggest "load reg"
> 0x78e54301 : pop rax; ret
> 0x78e51db8 : pop rbx; ret
> 0x78ec4a4c : pop rcx; ret
> 0x78eeb3c8 : pop rdx; ret
> 0x78e511de : pop rsi; ret
> 0x78e512dd : pop rdi; ret
> 0x78e52c3c : pop rbp; ret
> 0x78e541b8 : pop rsp; ret
> 0x78e588a9 : pop r8; ret
> 0x78e541b7 : pop r12; ret
> 0x78e5e3e7 : pop r13; ret
> 0x78e7fd49 : pop r14; ret
> 0x78e93c2f : pop r15; ret
> 0x78eedd91 : mov rax, [rsp + 8]; ret
> 0x78e6327f : mov rbx, [rsp + 0x10]; ret
> 0x78efd53f : mov rsi, [rsp + 0x10]; ret
> 0x78e6c5be : mov rdi, [rsp + 0x10]; ret
> 0x78eedd92 : mov eax, [rsp + 8]; ret
> 0x78e63280 : mov ebx, [rsp + 0x10]; ret
> 0x78efd540 : mov esi, [rsp + 0x10]; ret
> 0x78e6c5bf : mov edi, [rsp + 0x10]; ret
> 0x78e9b975 : mov rcx, [rsp]; call rax
> 0x78e9b6b4 : mov r11, [rsp + 8]; add rsp, 0x10; ret
> 0x78e77aaa : mov r12, [rsp + 0x20]; add rsp, 0x28; ret
> 0x78e8385a : mov r13, [rsp + 0x50]; add rsp, 0x68; ret
> 0x78e51c1b : mov r14, [rsp + 0x20]; add rsp, 0x38; ret
> 0x78e5d8b9 : mov r15, [rsp + 0x20]; add rsp, 0x48; ret
> 0x78e9b976 : mov ecx, [rsp]; call rax
> 0x78e8385b : mov ebp, [rsp + 0x50]; add rsp, 0x68; ret
> 0x78e77aab : mov esp, [rsp + 0x20]; add rsp, 0x28; ret
> 0x78ef2ee9 : mov rbp, [rsp + 0x10]; mov rdi, [rsp + 0x18]; ret
> 0x78e9b6b0 : mov r10, [rsp]; mov r11, [rsp + 8]; add rsp, 0x10; ret
> 0x78e9b6b1 : mov edx, [rsp]; mov r11, [rsp + 8]; add rsp, 0x10; ret
> 0x78ec0103 : mov r8, [rsp + 0xa8]; lea rdx, [rsp + 0x80]; mov rcx, rbx; call rax
> 0x78e67dec : mov rdx, [rsp + 0x78]; lea eax, [rdi + 1]; mov cl, 1; mov [rbp + 0x48], eax; mov r8d, [rbx + 4]; add r8, r14; call r8