WIN32 挂起创建进程 CREATE_SUSPENDED

#include "stdafx.h"
#include <WINDOWS.H>

int main(int argc, char* argv[])
{
    
    SECURITY_ATTRIBUTES sa_p;
    sa_p.nLength = sizeof(sa_p);
    sa_p.lpSecurityDescriptor = NULL;
    sa_p.bInheritHandle = TRUE;
    
    SECURITY_ATTRIBUTES sa_t;
    sa_t.nLength = sizeof(sa_t);
    sa_t.lpSecurityDescriptor = NULL;
    sa_t.bInheritHandle = TRUE;
    
    STARTUPINFOA si;
    PROCESS_INFORMATION pi;
    ZeroMemory(&si, sizeof(si));
    si.cb = sizeof(si);
    ZeroMemory(&pi, sizeof(pi));
    
    //si.dwFlags = STARTF_USESHOWWINDOW;  // 指定wShowWindow成员有效
    //si.wShowWindow = TRUE;          // 此成员设为TRUE的话则显示新建进程的主窗口，
    
    char s1[50] = {0};
    char s2[255] = {0};
    char szBuffer[256] = {0};
    //TCHAR stcAppName[] = TEXT("C://Program Files//Internet Explorer//iexplore.exe");
    TCHAR stcAppName[] = TEXT("C:\\Windows\\SysWOW64\\notepad.exe");

    BOOL res1 = CreateProcess(NULL,stcAppName,&sa_p,&sa_t,TRUE,CREATE_SUSPENDED,NULL,NULL,&si,&pi);
    if (!res1)
    {
        DWORD dwcode = GetLastError();
        printf("%x\n",dwcode);
    }
    //打印入口值
    CONTEXT contx;
    contx.ContextFlags = CONTEXT_FULL;
    int    code = GetThreadContext(pi.hThread,&contx);    
    printf("入口点：%x\n",contx.Eax);

    //获取ImageBase
    char* baseAddress = (CHAR *) contx.Ebx+8;                                
    memset(szBuffer,0,256);                                
    ReadProcessMemory(pi.hProcess,baseAddress,szBuffer,4,NULL);    

    ResumeThread(pi.hThread);
    
    getchar();
    printf("Hello World!\n");
    return 0;
}