ropshell> use d3a21f576bd28cf1ab5ef85f67746df5 (download)
name         : msctf_.dll (i386/PE)
base address : 0x10001000
total gadgets: 10164

ropshell> suggest "write mem"
> 0x1000fec8 : add [eax], edx; ret
> 0x10072826 : add [ebx], eax; ret
> 0x1003ead2 : add [ebx], edi; ret
> 0x100615df : add [edx], edi; ret
> 0x1002d5ba : add [edi], ecx; cwde ; ret
> 0x100c92b0 : add [eax + 0x5d10004b], edx; ret 0x1c
> 0x100c9352 : add [eax + 0x5d10004b], ebp; ret 0x14
> 0x1004149e : add [ebx + 0x5d5b5ec3], ecx; ret 4
> 0x1006f0aa : add [esi + 3], eax; ret
> 0x10056af0 : add [esi + 0x5b], ebx; ret
> 0x10080db2 : add [edi + 0x5d], ebx; ret 4
> 0x1005622b : add [edi + 0x16], esi; mov eax, 0x100; ret
> 0x1003dc2c : add [ebp + 0x5f0675c0], eax; pop esi; pop ebp; ret 4
> 0x1009be3c : add [edx], eax; add [ebx + 0x5d5e5fc7], cl; ret 4
> 0x100487a5 : add [eax + 0x5b5e5f01], esi; mov esp, ebp; pop ebp; ret 0x14
> 0x100c75e2 : add [ebx + 0x7500107d], eax; adc eax, [ebp - 0x7cf78b37]; ret
> 0x1004bf3f : add [edx + 2], esi; mov eax, [ecx]; ret
> 0x100491bc : add [esi + 4], edi; pop edi; pop esi; pop ebp; ret 8
> 0x100d8668 : add [ebp + 5], esi; movzx eax, dl; inc eax; ret
> 0x100c9184 : add [eax], ebx; dec ebx; add [eax], dl; pop ebp; ret 0x14
> 0x10053bab : add [eax], ecx; daa ; add [eax], dl; pop ebp; ret 0x14
> 0x100c91c0 : add [eax], esi; dec ebx; add [eax], dl; pop ebp; ret 0x18
> 0x100bb90d : add [ebx], esi; call [ecx - 0x75]
> 0x100c926e : add [eax + 0x4b], ecx; add [eax], dl; pop ebp; ret 0x18
> 0x100c914e : add [eax + 0x4b], edi; add [eax], dl; pop ebp; ret 0x14
> 0x1004020f : add [ebp + 0x48e80c4e], ecx; sub dh, bh; dec [ebx]; ret
> 0x10066206 : add [eax], edi; cld ; call [esi - 0x75]
> 0x1006f38a : adc [edx], ebp; std ; call [ecx + 0x51]
> 0x100129a1 : adc [ecx], eax; add [eax], al; pop esi; pop ebx; mov esp, ebp; pop ebp; ret
> 0x1008578b : adc [ecx], ebx; std ; dec [ebx - 0x743ca21b]; call [ebp - 0x75]
> 0x1009633b : add [edx + 0x10], eax; xor eax, eax; mov ecx, [edx + 0x10]; cmp ecx, [edx - 0xc]; setg al; pop ebp; ret 8