Addition of AMSI and ETW Bypass

[adityatelange]

Why it does not make sense to add one directly?

• A static, hardcoded bypass will likely be detected quickly by modern EDR/AV solutions.
• This makes the tool noisier, easier to fingerprint, and potentially less useful in red team operations.
• The one hardcoded in ruby version does not work on lastest patched windows.
• Intead it makes sence allowing operators to pass their own scripts.

What is the better option?

• Tool already allows operators to pass their own scripts via loadps and runps commands.
• I am thinking of implementing obfuscation while running commands (which I have to some extent in dev environment and works fine on all of methods published by Matt Graebers).