Modify API arguments that were simply converting "ObjectAttributes" into a UNICODE_STRING, destroying any information about RootDirectory and causing it to be impossible to reconstruct full registry key names in some cases.  This commit takes the approach of introducing two pseudo-arguments to replace the single argument in the real API.  If this is undesirable, I can later create a new format string for BSON to encode an object containing the handle and utf8-encoded string.
Re-enable several hooks that are necessary for visibility into process injection -- commit message from a year ago that removed these didn't specify the need for their removal
Fix NtOpenProcess logging, would have logged the stack address of the pid variable instead of its value, no need to use P format string in the second log