use PsSetLoadImageNotifyRoutine to monitor dll load
when dll load , scan it's IAT