A PoC for adding NtContinue to CFG allowed list in order to make Ekko work in a CFG protected process - View it on GitHub