This novel way of using NtQueueApcThreadEx by abusing the ApcRoutine and SystemArgument[0-3] parameters by passing a random pop r32; ret gadget can be used for stealthy code injection.
I'm trying to get this to work for x64 shellcode. The gadget pop r64; ret has the same opcodes as pop r32; ret (afaik, could be mistaken). However, if I add x64 calc shellcode and compile it for x64, it doesn't seem to work. Any idea why, or what else needs to be adjusted?