Add a bunch of code to harden Cuckoo a bit against simplistic sandbox detection:

Add hooks for NtQueryAttributesFile and NtQueryFullAttributesFile (we will use these in some signatures later)
Fake the QEMU HARDDISK name
Skip protected processes when iterating with Process32First/Process32Next
Change default hook method to hotpatch + indirect jmp
Fake a 256GB hard disk size