.
KeInsertQueueApc(*(PKAPC*)SystemArgument1, SystemArgument2, NULL, 0); KeTestAlertThread(UserMode); ExFreePoolWithTag(Apc, POOL_TAG); return; } Pretty much all it does is take the first SystemArgument, and treat is as an APC to queue to its thread. Seeing as we have provided our injecting APC as the