intercepting the win32 calls that make the syscall is often enough