ropshell> use b729ba1592acacb47f2b06dd3d5753fa (download)
name         : Flash6.ocx (i386/PE)
base address : 0x10001000
total gadgets: 18015

ropshell> suggest "load reg"
> 0x100016f0 : pop eax; ret
> 0x100010f3 : pop ebx; ret
> 0x10002fd7 : pop ecx; ret
> 0x1006b630 : pop edx; ret 4
> 0x1000111a : pop esi; ret
> 0x100017b8 : pop edi; ret
> 0x10001c84 : pop ebp; ret
> 0x10081580 : pop esp; ret
> 0x10021e52 : popal ; add al, 0; ret
> 0x10067178 : mov eax, [esp + 0xc]; ret
> 0x1009d3d6 : mov ecx, [esp + 4]; sub eax, ecx; ret
> 0x1008e638 : mov edx, [esp + 4]; mov [edx], eax; ret
> 0x100426bc : mov ebp, [esp + 0x858]; push ebp; push ecx; push eax; call [eax + 0x18]
> 0x10061a0f : mov edi, [esp + 0x14]; push esi; push ebx; and [eax + edi], 0; call ebp
> 0x100801ae : mov esi, [esp + 0x10]; mov ecx, esi; mov eax, [esi]; call [eax + 0x24]
> 0x10083194 : mov ebx, [esp + 0x14]; push ebp; push esi; mov ecx, [ebx - 0x70]; push edi; mov eax, [ecx]; call [eax + 0x18]