From 535ce3e6d383ae429ac0dce78bf48f5f10a16534 Mon Sep 17 00:00:00 2001
From: James <49045138+ghidracadabra@users.noreply.github.com>
Date: Mon, 6 Apr 2026 14:18:36 -0400
Subject: [PATCH] GP-6657 add x86 win func start patterns

---
 Ghidra/Processors/x86/data/patterns/x86win_patterns.xml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/Ghidra/Processors/x86/data/patterns/x86win_patterns.xml b/Ghidra/Processors/x86/data/patterns/x86win_patterns.xml
index c048c9f334..909bc73024 100644
--- a/Ghidra/Processors/x86/data/patterns/x86win_patterns.xml
+++ b/Ghidra/Processors/x86/data/patterns/x86win_patterns.xml
@@ -10,6 +10,7 @@
     </prepatterns>
     <postpatterns>
       <data>0x558bec</data>  <!-- PUSH EBP : MOV EBP,ESP -->
+      <data>0x5589e5</data>  <!-- PUSH EBP : MOV EBP,ESP -->
       <data>0x83ec 0.....00 </data> <!-- SUBESP#small -->
       <data>0x6aff68........64a100000000 </data> <!-- PUSH-1 PUSHFUNC MOVEAXFS[0] -->
       <data>0x568bf1 </data> <!-- PUSHESI MOVESIECX -->
@@ -29,6 +30,7 @@
       <data>0x53568bf0</data> <!-- PUSH EBX : PUSH ESI : MOV ESI,EAX -->
       <data>0x56578bf9</data> <!-- PUSH ESI : PUSH EDI : MOV EDI,ECX -->
       <data>0x56578bf1</data> <!-- PUSH ESI : PUSH EDI : MOV ESI,ECX -->
+      <data>0x55575653</data> <!-- PUSH EBP : PUSH EDI : PUSH ESI : PUSH EBX -->
 
       <funcstart/>
     </postpatterns>