说明：  通过　HOOK　PsCreateSystemThread　监控线程，入口函数特征码对比来过hs防护软件的保护，asm源码非常不错
(HOOK PsCreateSystemThread through the monitoring thread, imported function signature hs been compared to the protection of protective software, asm source code is very good)