Make auto attach to child processes work for x64.
Put entry breakpoint at start of the function instead of after prologue.

This makes things work even in case the function has been hotpatched,
since all analysis of the stack happens before any instructions have
been executed in the target function, so no chance of stack modifications.
Hook CreateProcessAsUser in advapi as well as kernel32
Refactor to simplify the hook installation logic.
Cleanup a few nits.