关于hook createremotethread？？

handle winapi my_createremotethread（
  handle hprocess,
  lpsecurity_attributes lpthreadattributes,
  size_t dwstacksize,
  lpthread_start_routine lpstartaddress,
  lpvoid lpparameter,
  dword dwcreationflags,
  lpdword lpthreadid
);

//挂接createremotethread
detour_trampoline（handle winapi de_createremotethread（
                  handle hprocess,
                  lpsecurity_attributes lpthreadattributes,
                  size_t dwstacksize,
                  lpthread_start_routine lpstartaddress,
                  lpvoid lpparameter,
                  dword dwcreationflags,
                  lpdword lpthreadid
                  ), createremotethread);

在ｄｌｌｍain里加上
detourfunctionwithtrampoline（（pbyte)de_createremotethread, （pbyte)my_createremotethread);

下面是代理函数
handle winapi my_createremotethread（handle hprocess,
                                    lpsecurity_attributes lpthreadattributes,
                                    size_t dwstacksize,
                                    lpthread_start_routine lpstartaddress,
                                    lpvoid lpparameter,
                                    dword dwcreationflags,
                                    lpdword lpthreadid)
{
#ifdef kout_debug_string
    dword dwcaller;
    __asm push dword ptr [ebp+4]
    __asm pop  dword ptr [dwcaller]
    
    tchar path[1024];
    zeromemory（path,sizeof（tchar)*1024);
    hmodule hdll = modulefromaddress（（pvoid)dwcaller);
    getmodulefilename（hdll,path,1024*sizeof（tchar));

    kdbgprint（_t（"createremotethread %x call by:%s\n"),hprocess,path);
#endif

    //判断是否是创建远程线程
    if（hprocess==getcurrentprocess（)||hdll==g_hkernel32)
    {
        return de_createremotethread（hprocess,lpthreadattributes,dwstacksize,lpstartaddress,
            lpparameter,dwcreationflags,lpthreadid);
    }
    else
    {    
        *lpthreadid = 1017;
        return （handle)719;
    }
}