Feature request: Support LZNT1 (de)compression used in Windows' RtlDecompressBuffer and NTFS

[joseph-hannon]

Summary

On Windows malware will often compress embedded shellcode/payloads and then use RtlDecompressBuffer to decompress it, with LZNT1 decompression. NTFS also uses this compression method. Here is an example of a pure Python implementation.

[notdeclan]

Agreed this would be nice

[a3957273]

Reopening as #1675 only handles decompression, whereas this ticket also requests compression.