wtf is advanced-loader-reverse-engineering?

This repository is a written analysis of a piece of malware, specifically an advanced multi stage loader that a security researcher going by the name StructBreaker examined and documented. A loader is a type of malicious program whose job is to get a bigger malicious payload running on a victim's computer while trying to avoid detection along the way. This particular loader is examined as it targets four different Windows system files: the process Shellhost.exe, and three system DLL files named amsi.dll, mstscax.dll, and clbcatq.dll. The write up walks through each target one at a time, using screenshots from tools called WinDbg and Ghidra, which are used to inspect running programs and analyze compiled code. Against Shellhost.exe, the loader uses a technique called module stomping, where it overwrites legitimate code inside a running, trusted process with its own hidden instructions, and the analysis points out garbled leftover text and deliberately broken instructions inside that hidden code. Against amsi.dll, a Windows security component, the loader fills a section with filler trap instructions and a single jump that leads to code designed to get around a Windows protection feature called Control Flow Guard, which normally restricts where a program's execution can jump to. Against mstscax.dll, the loader manually sets aside a small block of memory and fills in values that set up what is called a vtable, a technique connected to hijacking how Windows looks up certain software components. Against clbcatq.dll, the analysis describes memory and vtable manipulation aimed at reaching higher, system level privileges on the machine. The repository lists specific indicators someone could use to check whether their own systems show signs of this loader, including a particular Windows registry key, the exact DLLs and process named above, and the presence of the custom hidden code section. There is no code included in this repository, no downloadable tool, and no mention of a license. It reads as a documentation and research writeup rather than software meant to be installed or run.