ropshell> use f4f9fc355b6c729eeb4d69186e0ba93e (download)
name         : msiexec.exe (x86_64/PE)
base address : 0x140001000
total gadgets: 1272

ropshell> suggest "load reg"
> 0x1400052f5 : pop rax; ret
> 0x140002805 : pop rbx; ret
> 0x140003ca5 : pop rsi; ret
> 0x140002a5a : pop rdi; ret
> 0x1400029a1 : pop rbp; ret
> 0x1400042c4 : pop rsp; ret
> 0x1400042c3 : pop r12; ret
> 0x1400046db : pop r13; ret
> 0x140003ca4 : pop r14; ret
> 0x14000a609 : pop r15; ret
> 0x140004986 : mov rsi, [rsp + 8]; ret
> 0x14000412b : mov rdi, [rsp + 0x20]; ret
> 0x140004987 : mov esi, [rsp + 8]; ret
> 0x14000412c : mov edi, [rsp + 0x20]; ret
> 0x1400026bc : mov rbx, [rsp + 8]; mov eax, r10d; ret
> 0x14000b183 : mov r11, [rsp + 8]; add rsp, 0x10; ret
> 0x14000b184 : mov ebx, [rsp + 8]; add rsp, 0x10; ret
> 0x140004464 : mov rcx, [rsp + 0x70]; call rbx
> 0x140004465 : mov ecx, [rsp + 0x70]; call rbx
> 0x14000aa8e : pop rcx; add [rax], al; int3 ; xor eax, eax; add rsp, 0x28; ret
> 0x140007717 : mov rdx, [rsp + 0x68]; mov rcx, r13; call rbx
> 0x14000b17f : mov r10, [rsp]; mov r11, [rsp + 8]; add rsp, 0x10; ret
> 0x140007718 : mov edx, [rsp + 0x68]; mov rcx, r13; call rbx
> 0x140009707 : mov eax, [rsp + 0x80]; mov [rsp + 0x20], eax; call rbx
> 0x140004121 : mov rbp, [rsp + 0x10]; mov rsi, [rsp + 0x18]; mov rdi, [rsp + 0x20]; ret
> 0x140004122 : mov ebp, [rsp + 0x10]; mov rsi, [rsp + 0x18]; mov rdi, [rsp + 0x20]; ret
> 0x1400099b8 : mov rax, [rsp + 0x70]; mov rcx, r14; mov [rsp + 0x20], rax; call rbx