ropshell> use f1066e2543d511b6540dab8925034363 (download)
name         : ntdll.dll (i386/RAW)
base address : 0x0
total gadgets: 11366

ropshell> suggest
call
    > 0x00019966 : call eax
    > 0x0002402d : call ebx
    > 0x0003ba82 : call ecx
    > 0x0001b0be : call edx
    > 0x0002042c : call esi
jmp
    > 0x00015118 : push esp; ret
    > 0x0001bf3d : jmp eax
    > 0x00011afc : jmp ebx
    > 0x0006c015 : jmp ecx
    > 0x0006e2cf : jmp esi
load mem
    > 0x00018b95 : mov edx, [ebx]; ret
    > 0x00015520 : mov ebp, [eax]; ret
    > 0x00072274 : mov eax, [edx + 4]; ret
    > 0x000d839e : mov eax, [esi + 0x20]; pop esi; ret
    > 0x0006de0d : mov eax, [ebp + 0x10]; pop ebp; ret
load reg
    > 0x00067182 : pop eax; ret
    > 0x0002825b : pop ebx; ret
    > 0x000170e1 : pop ecx; ret
    > 0x00017a89 : pop edx; ret
    > 0x00022471 : pop esi; ret
pop pop ret
    > 0x00067182 : pop eax; ret
    > 0x0006eef2 : pop eax; pop ebp; ret
    > 0x00076eb2 : pop eax; pop esi; pop ebp; ret
    > 0x0006ee8c : pop eax; pop edi; pop esi; pop ebp; ret
    > 0x0007731b : pop eax; pop ebx; pop esi; pop edi; pop ebp; ret
sp lifting
    > 0x0006cf77 : add esp, 0x14; ret
    > 0x0006cf77 : add esp, 0x14; ret
stack pivoting
    > 0x0005a66b : xchg eax, esp; ret
    > 0x00189543 : mov esp, ebp; ret
    > 0x00031d63 : mov esp, ebx; pop ebx; ret
    > 0x0007e498 : lea esp, [esp + 0x80]; pop ecx; ret
    > 0x00069c96 : mov esp, esi; pop ebx; pop edi; pop esi; pop ebp; ret 0x10
write mem
    > 0x00067422 : add [ebx], eax; ret
    > 0x0003a016 : add [ebx], esi; ret
    > 0x00078e3c : add [ebx], edi; ret
    > 0x00181640 : add [ecx], esi; ret
    > 0x000304b2 : add [ecx], eax; pop edi; ret