<patternlist endianness="le">
  <patternpairs itemsize="16" alignment="1">
    <prepatterns>
      <data>0x90</data> <!-- NOP filler -->
      <data>0xc3</data> <!-- RET -->
      <data>0xe9........0000</data> <!-- JMP big + align 2 -->
      <data>0xe9........</data> <!-- JMP big -->
      <data>0xeb..</data> <!-- JMP small -->
      <data>0x89f6</data> <!-- NOP (MOV ESI,ESI) -->
      <data>0x8d7600</data>  <!-- NOP (LEA ESI,[ESI]) -->
      <data>0x8d742600</data>  <!-- NOP (LEA ESI,[ESI]) -->
      <data>0x8db600000000</data> <!-- NOP (LEA ESI,[ESI]) -->
      <data>0x8dbf00000000</data> <!-- NOP (LEA EDI,[EDI]) -->
      <data>0x8dbc2700000000</data> <!-- NOP (LEA EDI,[EDI]) -->
      <data>0x8db42600000000</data> <!-- NOP (LEA ESI,[ESI]) -->
      <data>0x00000000</data> <!-- align -->
    </prepatterns>
    <postpatterns>
      <data>0x55 0x89e5 0x81ec....0000</data> <!-- PUSH EBP : MOV EBP,ESP : SUB ESP,#bigconst -->
      <data>0x55 0x89e5 01010... 01010... </data> <!-- PUSH EBP : MOV EBP,ESP : PUSH : PUSH -->
      <data>0x55 0x89e5 0x8b 01...101 </data> <!-- PUSH EBP : MOV EBP,ESP : MOV ?,[EBP+#] -->
      <data>0x55 0x89e5 0x83ec</data> <!-- PUSH EBP : MOV EBP,ESP : SUB ESP, -->
      <data>0x55 0x89e5.. 0x83ec</data> <!-- PUSH EBP : MOV EBP,ESP - 1-BYTE -  SUB ESP, -->
      <data>0x55 0x89e5.... 0x83ec</data> <!-- PUSH EBP : MOV EBP,ESP - 2-BYTES -  SUB ESP, -->
      <data>0x55 0x89e5</data> <!-- PUSH EBP : MOV EBP,ESP -->
      <data>0x8d 0x4c ..100100 0x04 0x83 0xe4 0xf. </data> <!-- LEA ECX [ESP+4] / AND ESP -->
      <data>0x57 0x8d 0x7c ..100100 0x08 0x83 0xe4 0xf. </data> <!-- PUSH EDI / LEA EDI [ESP+8] / AND ESP -->
      <data>0x55 01010...  0x89 11...... 01010...</data> <!-- push ebp, push, mov, push-->
      <data>0x55 01010...  0x31 11...... 01010...</data> <!-- push ebp, push, xor, push-->
      <data>01010... 01010... 01010...</data> <!-- push, push, push -->
      <funcstart after="function"/>
    </postpatterns>
  </patternpairs>

  <pattern>
     <data>0x5589e583ec</data> <!-- PUSH EBP : MOV EBP,ESP : SUB ESP, -->
     <codeboundary/>
     <possiblefuncstart/>
  </pattern>
  <pattern>
     <data>0x5589e581ec....0000</data> <!-- PUSH EBP : MOV EBP,ESP : SUB ESP,#bigconst -->
     <codeboundary/>
     <possiblefuncstart/>
  </pattern>
  <pattern>
     <data>0x5589e5..83ec</data> <!-- PUSH EBP : MOV EBP,ESP - 1-BYTE -  SUB ESP, -->
     <codeboundary/>
     <possiblefuncstart/>
  </pattern>
  <pattern>
     <data>0x5589e5....83ec</data> <!-- PUSH EBP : MOV EBP,ESP - 2-BYTES -  SUB ESP, -->
     <codeboundary/>
     <possiblefuncstart/>
  </pattern>
  <pattern>
     <data>0x5589e5 01010... 01010... </data> <!-- PUSH EBP : MOV EBP,ESP : PUSH : PUSH -->
     <codeboundary/>
     <possiblefuncstart/>
  </pattern>
  <pattern>
     <data>0x5589e58b 01...101 </data> <!-- PUSH EBP : MOV EBP,ESP : MOV ?,[EBP+#] -->
     <codeboundary/>
     <possiblefuncstart/>
  </pattern>


  <pattern>
     <data>0x8b 0x04 0x24 0xc3 </data> <!-- MOV  EAX,[ESP] / RET -->
     <funcstart label="__i686.get_pc_thunk.ax" validcode="function"/>
  </pattern>
  
  <pattern>
     <data>0x8b 0x1c 0x24 0xc3 </data> <!-- MOV  EBX,[ESP] / RET -->
     <funcstart label="__i686.get_pc_thunk.bx" validcode="function"/>
  </pattern>
  
  <pattern>
     <data>0x8b 0x0c 0x24 0xc3 </data> <!-- MOV  ECX,[ESP] / RET -->
     <funcstart label="__i686.get_pc_thunk.cx" validcode="function"/>
  </pattern>
  
  <pattern>
     <data>0x8b 0x14 0x24 0xc3 </data> <!-- MOV  EDX,[ESP] / RET -->
     <funcstart label="__i686.get_pc_thunk.dx" validcode="function"/>
  </pattern>
  
  <pattern>
     <data>0x8b 0x34 0x24 0xc3 </data> <!-- MOV  ESI,[ESP] / RET -->
     <funcstart label="__i686.get_pc_thunk.si" validcode="function"/>
  </pattern>

</patternlist>
