Normalization of Nt* Registry API Call Hive/Key Values in MAEC 4.0.1 Reports

This is a fix to normalize how registry hive and key values are captured in MEAC 4.0.1 reports. The native Nt* API calls use the syntax \Registry\<hive identifier>\Key, so this fix parses this out and properly converts into HKEY_LOCAL_MACHINE (etc.)\Key. Doing so allows for correlation across all registry calls, Nt* and Reg*, observed by Cuckoo and reported in the MAEC output.