hooks: GetStartupInfoA/W, ZwCreateFile (todo: test more)