CreateProcessAsUser的用法

    最近太忙了，忙着弄公司的产品，现在好不容易有点时间来写点东西，代码很乱，没有整理，只是提供思路

DWORD __stdcall INTER_GetExplorerToken(OUT PHANDLE  phExplorerToken )   
{  
    DWORD       dwStatus = ERROR_FILE_NOT_FOUND ;   
    BOOL        bRet = FALSE ;  
    HANDLE      hProcess = NULL ;  
    HANDLE      hProcessSnap = NULL ;  
    char        szExplorerPath[MAX_PATH] = { 0 } ;  
    char        FileName[MAX_PATH] = { 0 } ;  
    PROCESSENTRY32 pe32 = { 0 } ;  
    __try  
    {  
        GetWindowsDirectory( szExplorerPath , MAX_PATH ) ;  
        strcat( szExplorerPath , "//Explorer.EXE" ) ;    
        hProcessSnap = CreateToolhelp32Snapshot( TH32CS_SNAPPROCESS , 0 ) ;   
        if( hProcessSnap == INVALID_HANDLE_VALUE )    
        {  
            dwStatus = GetLastError() ;  
            __leave ;  
        }   
        pe32.dwSize = sizeof( PROCESSENTRY32 ) ;   
        if( !Process32First( hProcessSnap, &pe32 ))       
        {     
            dwStatus = GetLastError() ;   
            __leave ;   
        }   
        do {      
            hProcess = OpenProcess(  
                PROCESS_ALL_ACCESS ,  
                FALSE ,  
                pe32.th32ProcessID ) ;  
            if( NULL != hProcess )          
            {   
                DWORD (__stdcall *GMFNE)(HANDLE hProcess,  
                    HMODULE hModule,  
                    LPTSTR lpFilename,  
                    DWORD nSize);  
                HMODULE hPsapi=LoadLibrary("PSAPI");  
                if ( ! hPsapi )  
                {    
                    dwStatus = GetLastError() ;  
                    break ;    
                }   
                GMFNE=(DWORD (__stdcall *) (HANDLE, HMODULE,LPTSTR,DWORD))GetProcAddress(hPsapi,"GetModuleFileNameExA");  
                if ( GMFNE(hProcess , NULL , FileName , MAX_PATH) )  
                {  
                    if( !strcmpi( FileName , szExplorerPath ))   
                    {                                 
                  HANDLE  hToken ;  
                        if( OpenProcessToken( hProcess , TOKEN_ALL_ACCESS  , &hToken ))  
                        {                                 
                            * phExplorerToken = hToken ;  
                            dwStatus = 0 ;  
                        }  
                        break ;  
                    }  
                }  
                CloseHandle ( hProcess ) ;    
                hProcess = NULL ;  
            }  
 
        } while( Process32Next( hProcessSnap, &pe32 )) ;  
    }  
    __finally   
    {  
       if( NULL != hProcess )  
        {  
          CloseHandle( hProcess ) ;  
        }  
        if( NULL != hProcessSnap )  
        {  
           CloseHandle ( hProcessSnap ) ;  
        }  
    }    
    return dwStatus ;   
}  
void CMy08222008Dlg::OnButton1()
{
 // TODO: Add your control notification handler code here
 HANDLE hPtoken = NULL ;    
 INTER_GetExplorerToken( &hPtoken ) ;  
 PROCESS_INFORMATION pi;    
 STARTUPINFO si = { sizeof(STARTUPINFO),NULL,"",NULL,0,0,0,0,0,0,0,STARTF_USESHOWWINDOW,0,0,NULL,0,0,0};      
 si.wShowWindow = SW_SHOW;  
 si.lpDesktop = NULL;   
 ZeroMemory( &pi, sizeof(pi) );    
 CreateProcessAsUser( hPtoken ,"c://autoruns.exe",NULL ,     
  NULL,NULL,FALSE , NORMAL_PRIORITY_CLASS| CREATE_NEW_CONSOLE ,NULL,NULL,&si,&pi ) ;  
 
 
 Sleep(1000);  
 
 CloseHandle( pi.hProcess );  
 
 CloseHandle( pi.hThread ); 

}