API Interception for Windows core programming

This is the API used to replace the process.

static void WINAPI MySleep(int i){//((MyTest)g_sleep)(i);MessageBoxA(NULL, "1","1",MB_OK);}void MyHook(){PSTR pszKernel= "kernel32.dll";PSTR pszSleepName= "Sleep";PSTR pszMessageBoxA = "MessageBoxA";PSTR pszUser32= "user32.dll";HMODULE hExeMod= GetModuleHandle(NULL);HMODULE hKernelMod= GetModuleHandleA(pszKernel);HMODULE hUser32= GetModuleHandleA(pszUser32);PROC pfnNew = (PROC)MySleep;PROC pfnOld = g_sleep = GetProcAddress(hKernelMod, pszSleepName);ULONG ulsize;PIMAGE_IMPORT_DESCRIPTOR pImportDesc = (PIMAGE_IMPORT_DESCRIPTOR)ImageDirectoryEntryToData(hExeMod,TRUE,IMAGE_DIRECTORY_ENTRY_IMPORT,&ulsize);while(pImportDesc->Name){PSTR pszModName = (PSTR)((PBYTE)hExeMod + pImportDesc->Name);if (strlen(pszModName) != 0){PIMAGE_THUNK_DATA pThunk = (PIMAGE_THUNK_DATA)((PBYTE)hExeMod + pImportDesc->FirstThunk);while (pThunk->u1.Function){PROC* ppFn =(PROC*)&pThunk->u1.Function;if(*ppFn == pfnOld){MEMORY_BASIC_INFORMATION mbi;VirtualQuery(ppFn,&mbi,sizeof(mbi));VirtualProtect(mbi.BaseAddress,mbi.RegionSize,PAGE_READWRITE,&mbi.Protect);*ppFn = pfnNew;DWORD dwOldProtect;VirtualProtect(mbi.BaseAddress,mbi.RegionSize,mbi.Protect,&dwOldProtect);break;}pThunk++;}}pImportDesc++;}}