Feature request: Support LZNT1 (de)compression used in Windows' RtlDecompressBuffer and NTFS

### Summary
On Windows malware will often compress embedded shellcode/payloads and then use [RtlDecompressBuffer ](https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/content/ntifs/nf-ntifs-rtlcompressbuffer) to decompress it, with LZNT1 decompression. NTFS also uses this compression method. [Here ](https://github.com/google/rekall/blob/e57446eb8ecbcf5019c1a978f469955a5078c829/rekall-core/rekall/plugins/filesystems/lznt1.py)is an example of a pure Python implementation.