Fix AMD64 get_syscall_arg()

Accoriding to syscall(2) the fourth syscall parameter is passed in
r10 and not rcx. This causes strange behavior when attempting to
trace calls like linkat().

For $ ./ministrace ln ministrace link

Fourth parameter read from r10
linkat(-100, "ministrace", -100, "link", 0) = 0

Fourth parameter read from rcx
linkat(-100, "ministrace", -100, "", 0) = 0