Since we're logging NtCreateKey/NtOpenKey, we also need to log NtClose, which can be used on either file or registry handles

Add some more comments and refactor