通过　HOOK　PsCreateSystemThread　监控线程，入口函数特征码对比来过hs防护软件的保护，asm源码非常不错-HOOK PsCreateSystemThread through the monitoring thread, imported function signature hs been compared to the protection of protective software, asm source code is very good