ropshell> use 2baf5bfad99c4c4431432c9df390c739 (download)
name         : ntkrnlpa.exe (i386/PE)
base address : 0x401000
total gadgets: 8015

ropshell> suggest "load reg"
> 0x00446d12 : pop eax; ret
> 0x0040fa1f : pop ebx; ret
> 0x0046739c : pop ecx; ret
> 0x00403940 : pop edx; ret
> 0x0040b3e3 : pop esi; ret
> 0x00417dd9 : pop edi; ret
> 0x004278b9 : pop ebp; ret
> 0x00453319 : popal ; ret
> 0x00463c23 : mov eax, [esp + 4]; ret
> 0x004293f1 : pop esp; adc [eax + eax], al; ret 8
> 0x0042ad98 : mov edx, [esp + 0xc]; wrmsr ; ret 0xc
> 0x0046e9a6 : mov ebx, [esp + 0xc]; add esp, 0x10; ret
> 0x00464296 : mov ecx, [esp + 4]; sub eax, ecx; ret
> 0x0046ea5e : mov esi, [esp + 8]; add esp, 0xc; ret
> 0x0046ea5a : mov edi, [esp + 4]; mov esi, [esp + 8]; add esp, 0xc; ret
> 0x0046ea57 : mov ebp, [esp]; mov edi, [esp + 4]; mov esi, [esp + 8]; add esp, 0xc; ret