Completely rewrite the hooking of cuckoomon since it was incredibly brittle and suffered some fundamental flaws.  The main problems arose from its swapping of return addresses on the stack and keeping entirely too much state that could be corrupted.  For example, consider the case where an exception occurred in a hooked API -- the depth count for the thread would be left at its current value and the exception handler would unwind the stack and continue execution.  Because of the imbalance of the depth count, further hooks on that thread wouldn't be logged.  It also likely had issues with the restoring of win32 lasterror, as I was never able to resolve the non-crash failures of some malware when NtAllocateVirtualMemory was simply hooked, with no logging enabled.  The new hooking eliminates probably 90% of the hardcoded assembly by performing as much work as possibly in a simple C function.  Instead of having a per-thread depth count prone to imbalance, we now walk the stack frames to see if the API was called from our DLL ourselves.

Fixed some other minor bugs along the way -- the preservation of the mov instruction in native API functions was broken, for starters its check was placed inside the check for Windows 7, and the unsigned char vs char literal > 0x80 comparison would never match due to sign extension.  Also changed a WARN: pipe message to WARNING:.