A system comprising: a processor; a memory (114; 202) coupled to the processor; a kernel-mode component (106; 206) configured to be operated by the processor to: receive notification of loading of a user-mode process (110; 208) by the system, build an asynchronous procedure call, APC, to be executed by a main thread of the user-mode process, and queue the APC to the main thread of the user-mode process; and a user-mode component (112; 214) associated with the kernel-mode component and configured to be operated by the processor to hook (132; 210; 316) a function of the user-mode process, wherein the APC includes: a kernel routine which calls instructions for: allocating a portion of the memory at a location adjacent to the user-mode process, and storing instructions for requesting loading of the user-mode component in the allocated portion, and a user routine which calls instructions for requesting loading of the user-mode component, wherein the APC is executed by the main thread of the user-mode process during the loading of the user-mode process, wherein the user-mode component, when loaded responsive to the user routine, hooks the function by modifying a single instruction or set of machine-sized instructions associated with the function to jump to the location adjacent to the user-mode process, and wherein the single instruction or set of machine-sized instructions of the function, when executed, performs the jump, which results in loading (136; 406) of the user-mode component to receive data associated with the function and to provide that data to the kernel-mode component. a processor; a memory (114; 202) coupled to the processor; a kernel-mode component (106; 206) configured to be operated by the processor to: receive notification of loading of a user-mode process (110; 208) by the system, build an asynchronous procedure call, APC, to be executed by a main thread of the user-mode process, and queue the APC to the main thread of the user-mode process; and receive notification of loading of a user-mode process (110; 208) by the system, build an asynchronous procedure call, APC, to be executed by a main thread of the user-mode process, and queue the APC to the main thread of the user-mode process; and a user-mode component (112; 214) associated with the kernel-mode component and configured to be operated by the processor to hook (132; 210; 316) a function of the user-mode process, wherein the APC includes: a kernel routine which calls instructions for: allocating a portion of the memory at a location adjacent to the user-mode process, and storing instructions for requesting loading of the user-mode component in the allocated portion, and a user routine which calls instructions for requesting loading of the user-mode component, a kernel routine which calls instructions for: allocating a portion of the memory at a location adjacent to the user-mode process, and storing instructions for requesting loading of the user-mode component in the allocated portion, and allocating a portion of the memory at a location adjacent to the user-mode process, and storing instructions for requesting loading of the user-mode component in the allocated portion, and a user routine which calls instructions for requesting loading of the user-mode component, wherein the APC is executed by the main thread of the user-mode process during the loading of the user-mode process, wherein the user-mode component, when loaded responsive to the user routine, hooks the function by modifying a single instruction or set of machine-sized instructions associated with the function to jump to the location adjacent to the user-mode process, and wherein the single instruction or set of machine-sized instructions of the function, when executed, performs the jump, which results in loading (136; 406) of the user-mode component to receive data associated with the function and to provide that data to the kernel-mode component.