Commit a number of changes based on an analysis of an RCS Scout sample protected with VMProtect.

It was discovered that RCS Scout was likely specifically targeting Cuckoo -- it calls a procedure early on that replaces the pointer in the TEB at the specific offset that cuckoomon uses to store its per-thread hook information struct.  The pointer RCS Scout installs points to a large buffer filled with 1s -- the effect of this is that the depth_count, regardless of any relayout of the hook_info struct would be set to 1.  In practice, this invisibly prevented cuckoomon from analyzing the malware.  For now, let's just change our TEB offset to avoid being targeted by this case.

RCS Scout also performs idle detection through the GetLastInputInfo API.  This API also returns a tick count that we should modify to preserve more consistent time.  While RCS Scout only wants to perform network activity when the user is active on the system, other malware may only want to act when the machine is idle.  For this reason we'll let the first two calls through showing no activity, and then fake activity.

Update the sleep skipping code in cuckoomon -- by default now we'll perform a more useful technique that combines the skipping of all sleeps in the first 5 seconds of execution with the clamping of sleeps thereafter.  Any sleeps between 30 seconds and 1 hour will be clamped down to 10 seconds and we'll instruct the tick count revealing functions to account for this difference in time.  You can force the skipping of all sleeps with force-sleepskip=1 or disable the skipping of sleeps completely with force-sleepskip=0. With force-sleepskip=1, the larger sleeps will be clamped instead of skipped in order to reduce API flooding.

Print setsockopt/ioctlsocket args as hex

Exclude the tests from the Debug build