Detection of RLPack using normalized code bytes

A variant of RLPack packer exists that can be detected by code sequence. However, to do that, it requires the code to be processed by a code normalizer. Such normalizer would strip all instruction operands and replaced all JUMPS/CALLS by a dummy byte (e.g. 0xCC).

Example of code before normalization:
```
6a10 (push 00000010)
eb 42 (jmp ___label1)
6840c10001 (push 0100c140)
e8f6030000 (call __label2)
33db (xor ebx, ebx)
eb 42 (jmp ___label3)
895dfc (mov [ebp-04], ebx)
64a118000000 (mov eax, fs:nt!TEB.Self)
eb 42 (jmp ___label4)
8b7004 (mov esi, [eax+04])
895de4 (mov [ebp-1c], ebx)
eb 42 (jmp ___label5)
bfa4d70001 (mov edi, 0100d7a4)
```
The same code after normalization:
```
6a (push)
cc (jmp replaced)
68 (push imm32)
e8 (call rel32
33db (xor ebx, ebx)
cc (jmp replaced)
895d (mov [ebp-XX], ebx)
64a1 (mov eax, fs:[imm32])
cc (jmp replaced)
8b70 (mov esi, [eax+XX])
895d (mov [ebp-XX], ebx)
cc (jmp replaced)
bf (mov edi, imm32)```

The issue names no files, tests, or entry points. Start by locating the machine-code analysis or packer-detection entry point, then compare its inputs with the supplied RLPack normalization examples. Done means normalized code can be matched to the described RLPack sequence and the behavior is covered by an appropriate test.

Written by the indexing model from the issue text.