hooks: GetStartupInfoA/W, ZwCreateFile (todo: test more), highlight threadstarts