通过枚举ntdll.dll的导出表，先是判断是不是Nt开头的，是的话再判断第一要语句是不是mov eax,是的话再取得索引号。-By enumerating the ntdll.dll export table, first determine Nt is the beginning, is to determine if re-statement is not the first to mov eax, this is the case then get the index number.