A PoC for adding NtContinue to the CFG allowed list in order to make callback-based sleep obfuscation techniques work in a CFG protected process.
Use the markCFGValid_std function to call SetProcessValidCallTargets and the markCFGValid_nt function to call NtSetInformationVirtualMemory.
Sleep obfuscation code (left unchanged) from https://github.com/Cracked5pider/Ekko.
Supporting blog post: https://icebreaker.team/blogs/sleeping-with-control-flow-guard/