Comments by STATUS_ACCESS_DENIED (Top 1 by date)

Reason for my vote of 2
There is one obvious error in the code (the first push in the placeholder code) and you write only a 32bit return address to that place. The less obvious problem that you simply copied from the original is that the target could hold the loader lock and you'd just get stuck forever in the best and bomb out in the worst case.