修改函数头5个字节Hook,不明白解决办法

// hook5bytes_.cpp : 定义 DLL 应用程序的入口点。
//

#include "stdafx.h"

#include <Windows.h>
#include <stdio.h>


#define HookModName  "user32.dll"
#define HookApiName  "MessageBoxW"



//修改API入口为jmp eax是程序能跳转到自己的函数
BYTE g_btNew5Bytes[5] = { 0xE9, 0x0, 0x0,0x0, 0x0};

//保存原API入口的5个字节
BYTE g_dwOld5Bytes[5] = { 0x0, 0x0, 0x0, 0x0, 0x0};


//API地址
void * m_AddrAPI;

//定义自己的API,参数表和原函数一致，MyHookAPI中调用的也一样
int WINAPI MyHookAPI(HWND hWnd,LPCWSTR lpText,LPCWSTR lpCaption,UINT uType);


BOOL APIENTRY DllMain( HANDLE hModule,DWORD  ul_reason_for_call,LPVOID lpReserved)
{
    if(ul_reason_for_call==DLL_PROCESS_ATTACH)        
    {
        
        //找到API地址
        HMODULE hModule = LoadLibrary(HookModName);
        m_AddrAPI = (void *)GetProcAddress( hModule,HookApiName);            

        /*修改5字节*/
        
        //保存原始字节
        ReadProcessMemory(INVALID_HANDLE_VALUE,m_AddrAPI, ( void * )g_dwOld5Bytes, sizeof( DWORD )+1, NULL );                                        
               
        DWORD dwNew = (DWORD)MyHookAPI - (DWORD)m_AddrAPI - 5;
        memcpy(&g_btNew5Bytes[1], &dwNew, 4);
                        
        WriteProcessMemory( INVALID_HANDLE_VALUE,m_AddrAPI,( void * )g_btNew5Bytes, sizeof( DWORD )+1, NULL ); 
        

    }

    return TRUE;
}
int _stdcall MyHookAPI(HWND hWnd,LPCWSTR lpText,LPCWSTR lpCaption,UINT uType)
{
            
    WriteProcessMemory( INVALID_HANDLE_VALUE,m_AddrAPI,( void * )g_dwOld5Bytes, sizeof( DWORD )+1, NULL );    
    ::MessageBoxW(hWnd,lpText,L"HOOK",uType);    
    WriteProcessMemory( INVALID_HANDLE_VALUE,m_AddrAPI,( void * )g_btNew5Bytes, sizeof( DWORD )+1, NULL );        
    return 0;
}