ropshell> use d3a21f576bd28cf1ab5ef85f67746df5 (download)
name         : msctf_.dll (i386/PE)
base address : 0x10001000
total gadgets: 10164

ropshell> suggest "stack pivoting"
> 0x1001897d : xchg eax, esp; ret
> 0x1001079c : mov esp, ebp; pop ebp; ret
> 0x10067316 : xchg esp, edi; call [ebx - 0x75]
> 0x100a52cd : lea esp, [edi + edi*8 - 1]; call [eax + 0x6a]
> 0x1002b138 : lea esp, [ebp + edi*8 - 1]; call [ecx + 0x68]
> 0x10047edf : push ecx; pop esp; mov [ecx + 0xa0], edx; mov [ecx + 0xa4], edx; mov [ecx + 0xb8], edx; pop ebp; ret 4
> 0x100451ab : leave ; ret