Inside AmsiOpenSession, there is a TEST instruction that sets the zero flag (ZF) , when the result of the AND operation is zero, and if the zero flag is 1 it will take the error branch because of the JZ instruction that will jump if ZF is 1 , but if everything is ok the error branching will never took , so what about forcing it by patching JZ to JNZ.
N.B : JZ is similar to JE and JNZ is similar to JNE :
You can see after patching JE to JNE using windbg , the Error branching is forced and AMSI is patched :
