Hooking replacement and augmented API functions is disclosed. In one embodiment, an alternative implementation of one or more API functions is hooked into the operating system through utilization of a replacement API table. The functions that have been replaced, augmented, or otherwise modified have entries in the table pointing to their new implementation. The entries for functions that have not been change continue to point to their existing implementation. A bit array is also disclosed to track desired messages, as compared to undesired messages, where each bit of the array corresponds to a type of message. The table can be variably sized, and can support nested and re-entrant calls.