Q. What if there is add esp, 0x10?
A. Convert 0x10 from hex to dec (16 in dec), then add 16 bytes of junk to align ESP. Something like rop += pack("<L", (0x42424242)) 4 times.

Q. if it ends with something like retn 0xcafe?
A. This will return to the current + 0xcafe (51966), meaning you need to add 51966 bytes of junk data to align ESP. Sometimes useful?

Q. CLC?
A. Clearing arithmetic, won’t affect ROP.

Q. iMul? Les?
A. Multiply. Load pointer.

Q. What are AL and BL?
A. AL will affect EAX, BL will affect EBX.

Q. For anything with extra POP xx followed by retn 0x0014 A. Always compensate the POP first, then followed by the next instruction, finally compensate the retn. Eg:
padding for POP
actual next line ROP
padding for retn