osek: analyze StartupHook