-------------------------------------------------------------------------------
Code zum abfangen:
Direkt einen Jump Befehl zur neuen Funktion einsetzen, gibt aber eine "Access Violation"! Warum

Hier die DLL zum Abfangen:

#include <windows.h>
#include <winreg.h>

typedef UINT (CALLBACK* REGCREATEKEYTYPE)(HKEY, LPCTSTR, PHKEY);

BOOL InterceptAPI(HMODULE hLocalModule,  const char* c_szDllName, const char* c_szApiName, DWORD dwReplaced);
LONG RegCreateKeyIC(HKEY hKey, LPCTSTR lpSubKey, PHKEY phkResult);
bool WINAPI DllMain(HINSTANCE hInst, DWORD dwReason, LPVOID reserved);

bool WINAPI DllMain(HINSTANCE hInst, DWORD dwReason, LPVOID reserved) {
	MessageBox(0, "entried dll", "InterceptAPI", 0);
    if (dwReason == DLL_PROCESS_ATTACH) {
		LoadLibrary("advapi32IC.dll");
        InterceptAPI(hInst, "advapi32.dll", "RegCreateKey", (DWORD) RegCreateKeyIC);
    }
    else if (dwReason == DLL_PROCESS_DETACH) {    
        MessageBox(0, "DLL_PROCESS_DETACH", "InterceptAPI", 0);
    }
    return true;
}

BOOL InterceptAPI(HMODULE hLocalModule,  const char* c_szDllName, const char* c_szApiName, DWORD dwReplaced) {
    DWORD dwOldProtect;
    DWORD dwAddressToIntercept = (DWORD)GetProcAddress(
            GetModuleHandle((char*)c_szDllName), (char*)c_szApiName);
    BYTE *pbTargetCode = (BYTE *) dwAddressToIntercept;
    BYTE *pbReplaced = (BYTE *) dwReplaced;

    VirtualProtect((void *) dwAddressToIntercept, 5, PAGE_WRITECOPY, &dwOldProtect);
    *pbTargetCode++ = 0xE9;        // jump rel32
    *((signed int *)(pbTargetCode)) = pbReplaced - (pbTargetCode +4);
    VirtualProtect((void *) dwAddressToIntercept, 5, PAGE_EXECUTE, &dwOldProtect);

    FlushInstructionCache(GetCurrentProcess(), NULL, NULL);
    return true;
}

/* Ersetzende Prozeduren */

LONG RegCreateKeyIC(HKEY hKey, LPCTSTR lpSubKey, PHKEY phkResult) {
	REGCREATEKEYTYPE pFunc = (REGCREATEKEYTYPE) GetProcAddress(GetModuleHandle("advapi32IC.dll"), "RegCreateKey");

	MessageBox(0, "Prozedur wurde aufgerufen", "RegCreateKey", 0);
	return pFunc(hKey, lpSubKey, phkResult);
}

Hier das simple Aufrufprogramm:

#include <windows.h>
#include <winreg.h>

int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nShowCmd) {
	PHKEY phkResult;	
	HINSTANCE hInstLib = LoadLibrary("C:\\RegIntercept.dll");
	DWORD dwLastError = GetLastError();
	if(!(GetModuleHandle("RegIntercept.dll"))) {
		MessageBox(0, "RegIntercept.dll wurde nicht im Speicher gefunden", "Fehler", MB_ICONWARNING);
	}
	//RegCreateKey(HKEY_CURRENT_USER, "Uli\\EINS", phkResult);

	return 0;
}