ropshell> use a27f2d7915fd455a2c4147e4b70bbd98 (download)
name         : EQNEDT32.EXE (i386/PE)
base address : 0x401000
total gadgets: 4450

ropshell> suggest "write mem"
> 0x0044e15d : add [eax], edi; pop esi; adc eax, -1; ret
> 0x0044fc23 : add [edx], ebp; call esi
> 0x0044fa5c : add [eax + 0x30], ebp; xor eax, [ebp]; push 1; call esi
> 0x0044ea75 : add [edi], ecx; test esp, [edx - 0x7b000000]; push [ebp + 0x12]; call esi
> 0x0044c651 : add [ebp + 0xb], esi; xor eax, eax; mov al, [esp + 4]; pop ebx; add esp, 8; ret
> 0x0044ed30 : add [ebx + 0x2890849], ecx; xor eax, eax; mov [edx + 4], ebx; pop ebx; mov [edx + 8], ecx; add esp, 0x18; ret
> 0x00410ba1 : adc [ecx], eax; add [eax], al; mov eax, [ebp - 0xc]; xor ecx, ecx; mov cl, [eax + 0x410beb]; jmp [0]