add initial files for NT API filter, this is to implement this filter as tool similar to UNIX strace, only core NTAPI are planned to support