toucan-system/pmcma — pull request #4 by pruby (2011-11-08 04:41:09+00:00)
Title: Observed issue with "mov byte ptr [esp+eax+18h], dl" being interpreted as a read instruction

The key here is the "byte ptr" - uses two of the type keywords there instead of just one. This was not matching either instruction previously.