Restore clean syscalls by unhooking ntdll

Userland EDR hooks live in the loaded ntdll. Map a pristine copy from disk (or a suspended process) and overwrite the hooked .text section so your calls run unmonitored.

// concept: read \K