ropshell> use f1066e2543d511b6540dab8925034363 (download)
name         : ntdll.dll (i386/RAW)
base address : 0x0
total gadgets: 11366

ropshell> suggest "load mem"
> 0x00018b95 : mov edx, [ebx]; ret
> 0x00015520 : mov ebp, [eax]; ret
> 0x00072274 : mov eax, [edx + 4]; ret
> 0x000d839e : mov eax, [esi + 0x20]; pop esi; ret
> 0x0006de0d : mov eax, [ebp + 0x10]; pop ebp; ret
> 0x000dab34 : mov eax, [edx]; mov [ecx], eax; pop esi; ret
> 0x0007e5cd : mov ecx, [ebp + 0x18]; call ecx
> 0x000e3c70 : mov edx, [ecx + 0x14]; mov esp, ebp; pop ebp; ret
> 0x000b3f33 : mov ecx, [edx + 0x4c]; mov [eax], ecx; pop ebp; ret 0xc
> 0x000587b3 : mov eax, [ebx]; pop edi; pop esi; pop ebx; mov esp, ebp; pop ebp; ret 0xc
> 0x0007ab02 : movzx eax, [ecx]; add ecx, 2; mov [edx], ecx; pop ebp; ret
> 0x000c365f : mov ecx, [esi]; sub ecx, eax; mov eax, ecx; pop esi; pop ebp; ret 4
> 0x0007e60a : mov eax, [ecx + 8]; mov [edx], eax; mov eax, 2; ret 0x10
> 0x000d2b7f : mov eax, [esi]; shr eax, 8; mov [edi], eax; pop edi; pop esi; ret
> 0x000f3874 : mov edi, [eax + 0x1069]; pop edi; pop esi; pop ebx; mov esp, ebp; pop ebp; ret
> 0x000ca194 : mov ecx, [esi + 8]; mov [edi + 4], ecx; pop edi; pop esi; pop ebp; ret 8
> 0x000b3dd5 : mov edx, [ebp + 8]; mov eax, [ebp + 0xc]; bswap edx; bswap eax; pop ebp; ret 8
> 0x000f4108 : mov eax, [edi]; and [eax + 4], 1; pop edi; pop ebx; mov esp, ebp; pop ebp; ret
> 0x0007ab00 : mov ecx, [edx]; movzx eax, [ecx]; add ecx, 2; mov [edx], ecx; pop ebp; ret
> 0x000d8319 : movzx ecx, [edi]; add esi, ecx; mov [edx], edi; mov eax, esi; pop edi; pop esi; ret
> 0x000cfaef : mov eax, [ebx + 0x194]; mov [edx + 0x194], eax; pop edi; pop esi; pop ebx; pop ebp; ret 8
> 0x000d47cb : mov edx, [eax + 0x50]; mov eax, [edx + 8]; mov edx, [edx + 0xc]; ret
> 0x000f072a : mov ecx, [edi + 0x24]; shl esi, cl; add esi, [edi + 8]; mov eax, esi; pop edi; pop esi; ret