Tow functions

[HelloRootkit]

BOOLEAN __stdcall
fake_KeInsertQueueApc(IN PKAPC Apc,
				 IN PVOID SystemArgument1,
				 IN PVOID SystemArgument2,
				 IN KPRIORITY PriorityBoost)
{   
	PEPROCESS pTargetProcess;
	PUCHAR  pTargetProcessName;
	ULONG XXThread;	//-------------------------------------------------------------------------------------------------------
	pTargetProcess=IoThreadToProcess( (PETHREAD)Apc->Thread );
//	pTargetProcessName=(PUCHAR)((ULONG)pTargetProcess+g_ProcessNameOffset);
	pTargetProcessName=PsGetProcessImageFileName(pTargetProcess);
	//-------------------------------------------------------------------------------------------------------//	if ((strcmp(pTargetProcessName,"notepad.exe"))||PriorityBoost!=2)
	if ((strcmp(pTargetProcessName,"notepad.exe"))||PriorityBoost!=2||Apc!=SystemArgument1)
	{
		goto Call_KeInsertQueueApc;
	}
	else
	{
		DbgPrint("TargetProcessName is %s\n",pTargetProcessName);		XXThread = (ULONG)Apc->Thread + g_ThreadFlagsOffset;
		__asm {
			mov eax, XXThread
			and [eax], 0xfffffffe
		}
		Apc->Thread=KeGetCurrentThread();		goto Call_KeInsertQueueApc;
	}
Call_KeInsertQueueApc:		return Proxy_KeInsertQueueApc(Apc,SystemArgument1,SystemArgument2,PriorityBoost);	
}
//================================================================================
================
__declspec (naked) 
BOOLEAN
Proxy_KeInsertQueueApc(IN PKAPC Apc,
				 IN PVOID SystemArgument1,
				 IN PVOID SystemArgument2,
				 IN KPRIORITY PriorityBoost)
{
	__asm {  
			_emit 0x90
			_emit 0x90
			_emit 0x90
			_emit 0x90
			_emit 0x90  
			_emit 0x90  
			_emit 0x90
			_emit 0x90
			_emit 0x90
			_emit 0x90  
			_emit 0x90  
			_emit 0x90 
	}
}

what's mean?

[GamingMasteR]

http://forum.tuts4you.com/index.php?showtopic=18615