We shouldn't pass CURRENT_PROCESS in the call to:
ffi_lib [FFI::CURRENT_PROCESS, :ntdll]
Passed CI in ad3662a6e