ropshell> use 1ab5406f33d8be8febd070750080329a (download)
name         : win32k.sys (i386/PE)
base address : 0xbf800380
total gadgets: 16986

ropshell> suggest "jmp"
> 0xbf8b8a17 : push esp; ret
> 0xbf86aae5 : jmp eax
> 0xbf8f0d99 : jmp ecx
> 0xbf8ad743 : jmp edx
> 0xbf89f80d : jmp edi
> 0xbf8b627f : jmp ebp
> 0xbf8e2613 : jmp esp
> 0xbf80110b : jmp [eax]
> 0xbf806958 : jmp [ebx]
> 0xbf811dd8 : jmp [ecx]
> 0xbf831315 : jmp [edx]
> 0xbf907160 : jmp [esi]
> 0xbf8980a7 : jmp [esp + eax]