<patternlist>
  <pattern>
     <data>0x5589e583ec</data> <!-- PUSH EBP : MOV EBP,ESP : SUB ESP, -->
     <codeboundary/>
     <possiblefuncstart/>
  </pattern>
  <pattern>
     <data>0x5589e581ec....0000</data> <!-- PUSH EBP : MOV EBP,ESP : SUB ESP,#bigconst -->
     <codeboundary/>
     <possiblefuncstart/>
  </pattern>
  <pattern>
     <data>0x5589e5..83ec</data> <!-- PUSH EBP : MOV EBP,ESP - 1-BYTE -  SUB ESP, -->
     <codeboundary/>
     <possiblefuncstart/>
  </pattern>
  <pattern>
     <data>0x5589e5....83ec</data> <!-- PUSH EBP : MOV EBP,ESP - 2-BYTES -  SUB ESP, -->
     <codeboundary/>
     <possiblefuncstart/>
  </pattern>
  <pattern>
     <data>0x5589e5 01010... 01010... </data> <!-- PUSH EBP : MOV EBP,ESP : PUSH : PUSH -->
     <codeboundary/>
     <possiblefuncstart/>
  </pattern>
  <pattern>
     <data>0x5589e58b 01...101 </data> <!-- PUSH EBP : MOV EBP,ESP : MOV ?,[EBP+#] -->
     <codeboundary/>
     <possiblefuncstart/>
  </pattern>

  <pattern>
     <data> 0x83 0xec  0.....00  100010.1 01...100 ..100100 0.....00 </data>        <!-- SUB ESP, C, MOV [ESP + value], reg OR MOV reg, [ESP + value] -->
     <funcstart after="defined" validcode="6" /> <!-- must be something defined right before this, or no memory -->
  </pattern>

  <pattern>
     <data> 0x81 0xec  ......00 0000.... 0x00 0x00  100010.1 01...100 ..100100 0.....00 </data>        <!-- SUB ESP, big C, MOV [ESP + value], reg OR MOV reg, [ESP + value] -->
     <funcstart after="defined" validcode="6" /> <!-- must be something defined right before this, or no memory -->
  </pattern>
  
  <pattern>
     <data> 0x5. 0x83 0xec  0.....00  100010.1 01...100 ..100100 0.....00 </data>        <!-- PUSH reg, SUB ESP, C, MOV [ESP + value], reg OR MOV reg, [ESP + value] -->
     <funcstart after="defined" validcode="6" /> <!-- must be something defined right before this, or no memory -->
  </pattern>
  
  <pattern>
     <data> 0x5. 0x81 0xec  ......00 0000.... 0x00 0x00 </data>        <!-- PUSH reg, SUB ESP, big C, -->
     <funcstart after="defined" validcode="6" /> <!-- must be something defined right before this, or no memory -->
  </pattern>
 
   <pattern>
     <data> 0x5. 0x5. 100000.1 0xec  ......00  </data>        <!-- PUSH reg; push reg; SUB ESP, C/big C -->
     <funcstart after="defined" validcode="6" /> <!-- must be something defined right before this, or no memory -->
  </pattern>
 
  <pattern>
     <data> 0x5. 0x5. 0x5. 100000.1 0xec  ......00  </data>        <!-- PUSH reg; PUSH reg; PUSH reg; push reg; SUB ESP, C/big C -->
     <funcstart after="defined" validcode="6" /> <!-- must be something defined right before this, or no memory -->
  </pattern>

  <pattern>
     <data> 0x5. 0x5. 0x5. 0x5. 100000.1 0xec  ......00  </data>        <!-- PUSH reg; PUSH reg; push reg; SUB ESP, C/big C -->
     <funcstart after="defined" validcode="6" /> <!-- must be something defined right before this, or no memory -->
  </pattern>
      
  <pattern>
     <data>0x8b 0x04 0x24 0xc3 </data> <!-- MOV  EAX,[ESP] / RET -->
     <funcstart label="__i686.get_pc_thunk.ax" validcode="function"/>
  </pattern>
  
  <pattern>
     <data>0x8b 0x1c 0x24 0xc3 </data> <!-- MOV  EBX,[ESP] / RET -->
     <funcstart label="__i686.get_pc_thunk.bx" validcode="function"/>
  </pattern>
  
  <pattern>
     <data>0x8b 0x0c 0x24 0xc3 </data> <!-- MOV  ECX,[ESP] / RET -->
     <funcstart label="__i686.get_pc_thunk.cx" validcode="function"/>
  </pattern>
  
  <pattern>
     <data>0x8b 0x14 0x24 0xc3 </data> <!-- MOV  EDX,[ESP] / RET -->
     <funcstart label="__i686.get_pc_thunk.dx" validcode="function"/>
  </pattern>
  
  <pattern>
     <data>0x8b 0x34 0x24 0xc3 </data> <!-- MOV  ESI,[ESP] / RET -->
     <funcstart label="__i686.get_pc_thunk.si" validcode="function"/>
  </pattern>

  <patternpairs totalbits="32" postbits="16">
    <prepatterns>
      <data>0x90</data> <!-- NOP filler -->
      <data>0xc3</data> <!-- RET -->
      <data>0xe9........</data> <!-- JMP big -->
      <data>0xeb..</data> <!-- JMP small -->
      <data>0x89f6</data> <!-- NOP (MOV ESI,ESI) -->
      <data>0x8d7600</data>  <!-- NOP (LEA ESI,[ESI]) -->
      <data>0x8d742600</data>  <!-- NOP (LEA ESI,[ESI]) -->
      <data>0x8db600000000</data> <!-- NOP (LEA ESI,[ESI]) -->
      <data>0x8dbf00000000</data> <!-- NOP (LEA EDI,[EDI]) -->
      <data>0x8dbc2700000000</data> <!-- NOP (LEA EDI,[EDI]) -->
      <data>0x8db42600000000</data> <!-- NOP (LEA ESI,[ESI]) -->
    </prepatterns>
    <postpatterns>
      <data>0x5589e5</data> <!-- PUSH EBP : MOV EBP,ESP -->
      <data>0x8d 0x4c ..100100 0x04 0x83 0xe4 0xf. </data> <!-- LEA ECX [ESP+4] / AND ESP -->
      <data>0x57 0x8d 0x7c ..100100 0x08 0x83 0xe4 0xf. </data> <!-- PUSH EDI / LEA EDI [ESP+8] / AND ESP -->
      
      <!-- ENDBR32 followed by above patterns -->
      <data>0xf3 0x0f 0x1e 0xfb 0x5589e5</data> <!-- PUSH EBP : MOV EBP,ESP -->
      <data>0xf3 0x0f 0x1e 0xfb 0x8d 0x4c ..100100 0x04 0x83 0xe4 0xf. </data> <!-- LEA ECX [ESP+4] / AND ESP -->
      <data>0xf3 0x0f 0x1e 0xfb 0x57 0x8d 0x7c ..100100 0x08 0x83 0xe4 0xf. </data> <!-- PUSH EDI / LEA EDI [ESP+8] / AND ESP -->
      
      <codeboundary/>
      <possiblefuncstart/>
    </postpatterns>
  </patternpairs>

  <patternpairs totalbits="32" postbits="16">
    <prepatterns>
      <data>0x90</data> <!-- NOP filler -->
      <data>0xc3</data> <!-- RET -->
      <data>0xe9........</data> <!-- JMP big -->
      <data>0xeb..</data> <!-- JMP small -->
      <data>0x89f6</data> <!-- NOP (MOV ESI,ESI) -->
      <data>0x8d7600</data>  <!-- NOP (LEA ESI,[ESI]) -->
      <data>0x8d742600</data>  <!-- NOP (LEA ESI,[ESI]) -->
      <data>0x8db600000000</data> <!-- NOP (LEA ESI,[ESI]) -->
      <data>0x8dbf00000000</data> <!-- NOP (LEA EDI,[EDI]) -->
      <data>0x8dbc2700000000</data> <!-- NOP (LEA EDI,[EDI]) -->
      <data>0x8db42600000000</data> <!-- NOP (LEA ESI,[ESI]) -->
    </prepatterns>
    <postpatterns>
      <data>0xf3 0x0f 0x1e 0xfb </data>                                         <!-- ENDBR32 -->
      <codeboundary/>
    </postpatterns>
  </patternpairs>

</patternlist>
