[Improvement] Add AV bypass functions about richkware HOT 2 CLOSED

yes i think so too! i'm working on it! thanks and I'll check those repos!

from richkware.

The key elements to take into account when dealing with AV evasion are:

1. API hooks: the AV software hooks all "suspicious" API calls such as VirtualProtect functions to perform heuristical analysis of unknows software, you should intercept those hooks and remove/bypass them;
2. Memory encryption: apart from poly/meta-morphic engines, overriding malloc/calloc functions to include a built-in stack encryption is a nice feature, especially if the key is dinamically generated;
3. Random mutations: if changing the code structure can help to deal with static analysis, the overall "functionality" remains the same, so here comes the turning point, introduce randomly activating payloads/util functions, to disguise attackers

from richkware.