Restore clean syscalls by unhooking ntdll

EDRs patch userland ntdll functions; mapping a fresh copy from disk removes their hooks before you make sensitive calls.