Understanding and Enhancing the Transferability of Adversarial Examples