Inline API hooking

To hook an API, the malware generally prefers to modify the first few bytes (typically, this is five bytes) of the API assembly code and replace them with jmp <hooking_function> so that it can change the API arguments and maybe skip the call to this API and return a fake result (like an error or just NULL). The code change generally looks like this:

Before Hooking: 
API_START:
    mov edi, edi
    push ebp
    mov ebp, esp
    ...

After Hooking:
API_START:
    jmp hooking_function
    ...

So, the malware replaces the first five bytes (which, in this case, are three instructions) with one instruction, which is jmp to the hooked function. Windows supports API hooking and has added an extra instruction, mov edi, edi, which takes two bytes of space, which makes the function prologue 5 bytes in size. This makes API hooking a much easier task to perform.

The hooking_function saves the replaced five bytes at the beginning of the API and uses them to call the API back, for example...