Big set of updates:

Change default hook type to indirect jump, it has better compatibility with prologue-stealing protectors that fail to relocate instructions properly
Improve the reliability of hook installation in live processes -- freeze all other threads during hook installation
Fix a ridiculous cuckoomon bug that was preventing it from logging anything when run in the context of a SYSTEM process (or any other process with a different %TEMP% than the analyzer), visible with the Dyre banking trojan
Add hooking of CryptAcquireContext[A,W], and InternetGetConnectedState
Disable hooking of CreateWindowEx[A,W] while I try to resolve yet another cuckoomon bug
Move all runtime API resolution to a single function called at init time, since it's not safe to resolve APIs in hooked functions that may hold the loader lock
Fix types of several function prototypes specifying const 'out' pointers
Fix the pipe usage of UrlDownloadToFileW -- it was missing the length argument and thus couldn't have worked properly and would possibly just crash
Display the Flags arguments for HttpOpenRequest* and DnsQuery* as hex
Comment out the UNMAP pipe message, as it's not used at all by the analyzer
Convert some alloca usage to calloc
Preempt the installation of malware's APC injection instead of use CreateRemoteThread
Don't inject at NtOpenThread time
Notify of the SetContextThread before it happens so we can inject first, ditto for RtlCreateUserThread
Add a backtrace_disable flag to the hook info so we can do some inspection without triggering infinite recursion
If we're in debug mode, write out the logs to files instead of just reporting send errors
Add %p as a format string for pipe()
If we're not in debug mode, then make failure to read the cuckoomon config a critical error