Going through the solution to understand what the winners have done. Forgive if this is a noob question but I did not understand how the solution for this question was answered

Q. Describe the API hooking mechanism used by the sample
Ans: The malware uses a data structure for each hooked function that looks like the following:

DWORD FunctionAddress 
DWORD HookFunctionAddress
BYTE  ModifiedOriginalFunctionStart[44]
DWORD Unknown
BYTE  Unknown
BYTE  OriginalFunctionStart[44]
DWORD Unknown
DWORD ModuleHandle
DWORD Unknown
BYTE  JumpCode[8]
DWORD CriticalSection[6]
DWORD CriticalSectionInitialized
BYTE  ModuleName[260]
DWORD Unknown[2]


If possible please refer the solution here
http://www.honeynet.org/files/1312123013_lutz_dot_schildt_at_googlemail_dot_com_Forensic%20Challenge%202011%20-%20Challenge%208.zip


Is there a place where I can understand this process via tutorials or examples if possible ?

Any help is highly appreciated.