ropshell> use b729ba1592acacb47f2b06dd3d5753fa (download)
name         : Flash6.ocx (i386/PE)
base address : 0x10001000
total gadgets: 18015

ropshell> suggest "write mem"
> 0x100149d6 : add [eax], edx; ret
> 0x1001811c : add [ebx], edi; ret
> 0x1007b147 : add [ebx], ebp; ret
> 0x1001419a : add [edx], edi; ret
> 0x100312f6 : add [eax + 0x3a], ebx; ret
> 0x10026d4d : add [eax + 0x5ef27508], ecx; ret
> 0x100467d7 : adc [eax + 0x100b2a60], edi; ret
> 0x1006209f : add [ecx + 0x5e], ebx; ret
> 0x10032e09 : adc [ecx + 0x5e590002], ebp; ret
> 0x100209fd : add [esi + 0x5d], ebx; ret
> 0x100947be : add [edi + 0x5b], ebx; ret
> 0x1005580d : add [ebp + 0xce8244d], ecx; ret
> 0x10071663 : add [esi], eax; pop edi; pop esi; ret 8
> 0x1006a66f : add [esi + 0x16a8], ecx; pop esi; ret
> 0x10086517 : add [eax], ebx; pop ebx; add esp, 0x400; ret
> 0x1008e846 : add [edi], ecx; scasd eax, es:[edi]; ret 0x3d
> 0x10012d01 : adc [ebx + 0x41890840], ecx; add al, 0x5d; ret
> 0x100986d5 : add [ecx + 0x5b], eax; add esp, 0xc; ret 4
> 0x100621f9 : add [esi + 0x78], eax; pop esi; pop ebp; ret
> 0x100304f9 : add [esi + 0xc], edi; pop edi; pop esi; ret 8
> 0x1008177b : adc [ebx], esi; add [eax], al; pop esi; ret
> 0x1006a66e : adc [ecx], eax; mov gs, [eax + 0x5e000016]; ret
> 0x100412cb : add [edx], esi; rcr [esi + 0x5f], 0xc9; ret 4
> 0x1007185d : adc [edi], eax; add [eax], al; pop esi; ret
> 0x10021b08 : adc [ebx + 0x5959ffff], esi; pop edi; pop esi; pop ebp; ret 0xc
> 0x100254d5 : add [edx + 1], ebp; call [eax + 8]; ret
> 0x1001a0f9 : add [ebp + 4], esi; xor al, al; pop esi; ret
> 0x10026142 : add [edx], ebp; call [eax + 4]
> 0x1003e48a : adc [eax], esi; std ; call [ecx + 0x51]
> 0x10075133 : adc [edx], ebx; stc ; call [edi - 0x18]
> 0x1007ec41 : adc [eax + 0x51], edx; call [edx + 0x1c]
> 0x1008234c : adc [esi + 0x50], edx; call [edx + 0x34]
> 0x1005043f : add [esi], edi; sub [esi + 4], edi; pop edi; pop esi; pop ebx; ret
> 0x100519cd : add [eax], ebp; add [eax], 0; call [eax + 0x78]
> 0x10054470 : add [ebx + 0x51003c61], eax; mov [ecx + 0x14], 4; call [eax + 8]; ret
> 0x1001d3db : adc [edx + 0xff00ff], edi; and [eax], edx; and [ecx], edx; pop esi; ret
> 0x10080060 : add [eax], ecx; adc [eax + 0x6a], dl; call [esi - 1]
> 0x10097e8b : adc [ebx], eax; lds edx, [edi + 0x50]; call [edx + 4]
> 0x1004bc04 : add [edx], eax; add [eax], al; push [esi + 0x30]; call edi
> 0x10052817 : add [eax + 0xa], ebp; add [eax], 0; call [eax + 0x78]
> 0x100592db : add [ebp + 0x37459c0], eax; mov [ebp - 1], bl; push [ebp - 0x2c]; call esi
> 0x100850a8 : add [ebp + 0x55], edx; lea eax, [esp + 0x30]; push ebx; push eax; call edi
> 0x1000ae5d : add [ebp + 3], edi; push 1; pop esi; mov ecx, [ebp - 8]; mov eax, [ecx]; call [eax + 0xc]