when analyzing a url, only hook ntdll and kernel32 functions
added getcursorpos hook and updated dll for hook limitation