通过异步过程调用 APC 来实现内核枚举进程 。-Thread Monitor presents a view of process and thread execution with a bit more granularity than TaskManager, and uses the sparsely documented Asynchronous Procedure Call (APC) mechanism tocommunicate the kernels creation and