depends.exe notes that the win4beta calls CreateFontA()
    - can we track down where this is called from, and possibly tweak what's sent to it?
        - CheatEngine's Search > Find Memory Code seems semi-capable?  maybe?

    - the "mammon's tales to his grandson" writeup about notepad.exe says to use W32DASM  
        - however, that's dead: http://answers.google.com/answers/threadview?id=132829
    - but there are others: http://www.geocities.com/~sangcho/others.html

    X does SysInternals' ProcMon log it?
        > configure symbols something like this? http://natesstuff.spaces.live.com/blog/cns!927B27E35FC3B535!426.entry
        > you need to download this first, to get dbghelp.dll: http://www.microsoft.com/whdc/devtools/debugging/default.mspx

    - try http://www.rohitab.com/apimonitor/