ropshell> use f503e4ae1d2faf5a499a8119610ab505 (download)
name         : BNUpdate.exe (i386/PE)
base address : 0x401000
total gadgets: 4767

ropshell> suggest "write mem"
> 0x004079ea : add [eax], ecx; ret
> 0x004171ad : add [ebx], eax; ret
> 0x0040719e : add [ebx], ebp; ret 0x6a
> 0x0040671a : adc [ebx + 0x68], edx; ret
> 0x0041539a : add [edi + 0x5e], ebx; ret
> 0x0041745b : add [ebx + 0x14], esi; mov eax, 1; ret 4
> 0x004044c5 : add [ebx + 0x850ffcf], ecx; pop esi; pop ebx; pop edi; ret
> 0x00407c3b : adc [ecx], eax; add [eax], al; add esp, 8; ret 0x10
> 0x00422739 : add [edx], ebp; push 0; push ecx; call edi
> 0x004219ca : add [edx + 0x3a], ebp; push esi; call edi
> 0x0040945f : add [edi + 0x2c], esi; pop edi; mov eax, 1; pop esi; ret
> 0x00411d03 : add [ebp + 2], esi; mov eax, edi; pop edi; pop esi; pop ebx; ret
> 0x00419231 : add [ebx + 0x5fc308c4], eax; pop esi; pop ebp; xor eax, eax; pop ebx; add esp, 8; ret
> 0x0041b9e6 : adc [esi + 4], edx; mov eax, edi; pop edi; mov [esi], ecx; pop esi; ret 8
> 0x0042103e : adc [ebp + 0x5f0d75d2], eax; pop esi; pop ebp; xor eax, eax; pop ebx; add esp, 0x20c; ret