tdeerenberg/InlineWhispers3
1
1
Fork 0
mirror of https://github.com/tdeerenberg/InlineWhispers3.git synced 2025-07-17 00:44:17 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
32f7b7662b37c8d69adf9d1010c0704226dfa661
InlineWhispers3/output/syscalls-asm.h
tdeerenberg 32f7b7662b Initial Commit
2025-04-08 16:23:06 +02:00

10133 lines
218 KiB
C
Raw Blame History

#pragma once
#include <windows.h>
#if _WIN64
#define Sw3ZwAccessCheck Sw3NtAccessCheck
__asm__("Sw3NtAccessCheck: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x090BDE162 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x090BDE162 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwWorkerFactoryWorkerReady Sw3NtWorkerFactoryWorkerReady
__asm__("Sw3NtWorkerFactoryWorkerReady: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0B198C761 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0B198C761 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwAcceptConnectPort Sw3NtAcceptConnectPort
__asm__("Sw3NtAcceptConnectPort: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x02ABE2B30 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x02ABE2B30 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwMapUserPhysicalPagesScatter Sw3NtMapUserPhysicalPagesScatter
__asm__("Sw3NtMapUserPhysicalPagesScatter: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x019A82701 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x019A82701 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwWaitForSingleObject Sw3NtWaitForSingleObject
__asm__("Sw3NtWaitForSingleObject: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0AA974ACB \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0AA974ACB \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwCallbackReturn Sw3NtCallbackReturn
__asm__("Sw3NtCallbackReturn: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0CA9EEB09 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0CA9EEB09 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwReadFile Sw3NtReadFile
__asm__("Sw3NtReadFile: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x052D55A76 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x052D55A76 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwDeviceIoControlFile Sw3NtDeviceIoControlFile
__asm__("Sw3NtDeviceIoControlFile: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x04AD55862 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x04AD55862 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwWriteFile Sw3NtWriteFile
__asm__("Sw3NtWriteFile: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x09E05AED2 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x09E05AED2 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwRemoveIoCompletion Sw3NtRemoveIoCompletion
__asm__("Sw3NtRemoveIoCompletion: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x002986257 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x002986257 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwReleaseSemaphore Sw3NtReleaseSemaphore
__asm__("Sw3NtReleaseSemaphore: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0F7649DAB \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0F7649DAB \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwReplyWaitReceivePort Sw3NtReplyWaitReceivePort
__asm__("Sw3NtReplyWaitReceivePort: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x07AF2887C \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x07AF2887C \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwReplyPort Sw3NtReplyPort
__asm__("Sw3NtReplyPort: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x022B42B28 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x022B42B28 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwSetInformationThread Sw3NtSetInformationThread
__asm__("Sw3NtSetInformationThread: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x014469558 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x014469558 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwSetEvent Sw3NtSetEvent
__asm__("Sw3NtSetEvent: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0CB6BEADD \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0CB6BEADD \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwClose Sw3NtClose
__asm__("Sw3NtClose: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0028DF4DD \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0028DF4DD \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwQueryObject Sw3NtQueryObject
__asm__("Sw3NtQueryObject: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x03EA6CBDE \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x03EA6CBDE \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwQueryInformationFile Sw3NtQueryInformationFile
__asm__("Sw3NtQueryInformationFile: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0583D26E6 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0583D26E6 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwOpenKey Sw3NtOpenKey
__asm__("Sw3NtOpenKey: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x02522D15D \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x02522D15D \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwEnumerateValueKey Sw3NtEnumerateValueKey
__asm__("Sw3NtEnumerateValueKey: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x011958D8E \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x011958D8E \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwFindAtom Sw3NtFindAtom
__asm__("Sw3NtFindAtom: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x048DE6F0C \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x048DE6F0C \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwQueryDefaultLocale Sw3NtQueryDefaultLocale
__asm__("Sw3NtQueryDefaultLocale: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0A6AAFC1D \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0A6AAFC1D \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwQueryKey Sw3NtQueryKey
__asm__("Sw3NtQueryKey: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x095157F77 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x095157F77 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwQueryValueKey Sw3NtQueryValueKey
__asm__("Sw3NtQueryValueKey: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x00FDA326C \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x00FDA326C \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwAllocateVirtualMemory Sw3NtAllocateVirtualMemory
__asm__("Sw3NtAllocateVirtualMemory: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x041D23933 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x041D23933 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwQueryInformationProcess Sw3NtQueryInformationProcess
__asm__("Sw3NtQueryInformationProcess: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x08F3D6E50 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x08F3D6E50 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwWaitForMultipleObjects32 Sw3NtWaitForMultipleObjects32
__asm__("Sw3NtWaitForMultipleObjects32: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0102CEE619 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0102CEE619 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwWriteFileGather Sw3NtWriteFileGather
__asm__("Sw3NtWriteFileGather: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0AD8D79AC \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0AD8D79AC \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwCreateKey Sw3NtCreateKey
__asm__("Sw3NtCreateKey: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0AAED834C \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0AAED834C \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwFreeVirtualMemory Sw3NtFreeVirtualMemory
__asm__("Sw3NtFreeVirtualMemory: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0CF4F2620 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0CF4F2620 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwImpersonateClientOfPort Sw3NtImpersonateClientOfPort
__asm__("Sw3NtImpersonateClientOfPort: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x06EF76164 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x06EF76164 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwReleaseMutant Sw3NtReleaseMutant
__asm__("Sw3NtReleaseMutant: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x03ED41482 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x03ED41482 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwQueryInformationToken Sw3NtQueryInformationToken
__asm__("Sw3NtQueryInformationToken: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x00B92515E \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x00B92515E \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwRequestWaitReplyPort Sw3NtRequestWaitReplyPort
__asm__("Sw3NtRequestWaitReplyPort: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x06AB04F60 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x06AB04F60 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwQueryVirtualMemory Sw3NtQueryVirtualMemory
__asm__("Sw3NtQueryVirtualMemory: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0C455F4EC \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0C455F4EC \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwOpenThreadToken Sw3NtOpenThreadToken
__asm__("Sw3NtOpenThreadToken: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0FCA9D433 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0FCA9D433 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwQueryInformationThread Sw3NtQueryInformationThread
__asm__("Sw3NtQueryInformationThread: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x01AB45A1F \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x01AB45A1F \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwOpenProcess Sw3NtOpenProcess
__asm__("Sw3NtOpenProcess: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x00FA30E32 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x00FA30E32 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwSetInformationFile Sw3NtSetInformationFile
__asm__("Sw3NtSetInformationFile: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0E3D831EF \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0E3D831EF \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwMapViewOfSection Sw3NtMapViewOfSection
__asm__("Sw3NtMapViewOfSection: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x034AD1A31 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x034AD1A31 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwAccessCheckAndAuditAlarm Sw3NtAccessCheckAndAuditAlarm
__asm__("Sw3NtAccessCheckAndAuditAlarm: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0923C6C70 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0923C6C70 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwUnmapViewOfSection Sw3NtUnmapViewOfSection
__asm__("Sw3NtUnmapViewOfSection: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x01C343EA5 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x01C343EA5 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwReplyWaitReceivePortEx Sw3NtReplyWaitReceivePortEx
__asm__("Sw3NtReplyWaitReceivePortEx: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0608F3450 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0608F3450 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwTerminateProcess Sw3NtTerminateProcess
__asm__("Sw3NtTerminateProcess: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0FDA3163F \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0FDA3163F \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwSetEventBoostPriority Sw3NtSetEventBoostPriority
__asm__("Sw3NtSetEventBoostPriority: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x02C9C407A \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x02C9C407A \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwReadFileScatter Sw3NtReadFileScatter
__asm__("Sw3NtReadFileScatter: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0C3B0CE2B \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0C3B0CE2B \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwOpenThreadTokenEx Sw3NtOpenThreadTokenEx
__asm__("Sw3NtOpenThreadTokenEx: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x02A9BE5CD \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x02A9BE5CD \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwOpenProcessTokenEx Sw3NtOpenProcessTokenEx
__asm__("Sw3NtOpenProcessTokenEx: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0091E59C7 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0091E59C7 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwQueryPerformanceCounter Sw3NtQueryPerformanceCounter
__asm__("Sw3NtQueryPerformanceCounter: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0BB0FC18B \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0BB0FC18B \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwEnumerateKey Sw3NtEnumerateKey
__asm__("Sw3NtEnumerateKey: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x01F997A62 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x01F997A62 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwOpenFile Sw3NtOpenFile
__asm__("Sw3NtOpenFile: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x054C29D70 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x054C29D70 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwDelayExecution Sw3NtDelayExecution
__asm__("Sw3NtDelayExecution: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x01C950239 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x01C950239 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwQueryDirectoryFile Sw3NtQueryDirectoryFile
__asm__("Sw3NtQueryDirectoryFile: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x023B4CD31 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x023B4CD31 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwQuerySystemInformation Sw3NtQuerySystemInformation
__asm__("Sw3NtQuerySystemInformation: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x00E6A1681 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x00E6A1681 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwOpenSection Sw3NtOpenSection
__asm__("Sw3NtOpenSection: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0D30CD39E \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0D30CD39E \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwQueryTimer Sw3NtQueryTimer
__asm__("Sw3NtQueryTimer: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0E44735E4 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0E44735E4 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwFsControlFile Sw3NtFsControlFile
__asm__("Sw3NtFsControlFile: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x050DFC2E8 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x050DFC2E8 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwWriteVirtualMemory Sw3NtWriteVirtualMemory
__asm__("Sw3NtWriteVirtualMemory: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x00992F8FD \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x00992F8FD \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwCloseObjectAuditAlarm Sw3NtCloseObjectAuditAlarm
__asm__("Sw3NtCloseObjectAuditAlarm: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0FE3CF8A8 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0FE3CF8A8 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwDuplicateObject Sw3NtDuplicateObject
__asm__("Sw3NtDuplicateObject: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x00A155AD8 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x00A155AD8 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwQueryAttributesFile Sw3NtQueryAttributesFile
__asm__("Sw3NtQueryAttributesFile: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0C6FC32EE \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0C6FC32EE \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwClearEvent Sw3NtClearEvent
__asm__("Sw3NtClearEvent: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x03CA6232C \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x03CA6232C \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwReadVirtualMemory Sw3NtReadVirtualMemory
__asm__("Sw3NtReadVirtualMemory: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x003971B07 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x003971B07 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwOpenEvent Sw3NtOpenEvent
__asm__("Sw3NtOpenEvent: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0973F90AD \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0973F90AD \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwAdjustPrivilegesToken Sw3NtAdjustPrivilegesToken
__asm__("Sw3NtAdjustPrivilegesToken: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0F3D6C176 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0F3D6C176 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwDuplicateToken Sw3NtDuplicateToken
__asm__("Sw3NtDuplicateToken: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0B5918530 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0B5918530 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwContinue Sw3NtContinue
__asm__("Sw3NtContinue: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0C2B521F9 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0C2B521F9 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwQueryDefaultUILanguage Sw3NtQueryDefaultUILanguage
__asm__("Sw3NtQueryDefaultUILanguage: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0358BF32A \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0358BF32A \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwQueueApcThread Sw3NtQueueApcThread
__asm__("Sw3NtQueueApcThread: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0C897152E \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0C897152E \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwYieldExecution Sw3NtYieldExecution
__asm__("Sw3NtYieldExecution: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0C8A3CA33 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0C8A3CA33 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwAddAtom Sw3NtAddAtom
__asm__("Sw3NtAddAtom: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x054C15D50 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x054C15D50 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwCreateEvent Sw3NtCreateEvent
__asm__("Sw3NtCreateEvent: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0014C04C4 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0014C04C4 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwQueryVolumeInformationFile Sw3NtQueryVolumeInformationFile
__asm__("Sw3NtQueryVolumeInformationFile: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0D949BA4D \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0D949BA4D \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwCreateSection Sw3NtCreateSection
__asm__("Sw3NtCreateSection: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0128C3419 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0128C3419 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwFlushBuffersFile Sw3NtFlushBuffersFile
__asm__("Sw3NtFlushBuffersFile: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x038B8FF1A \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x038B8FF1A \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwApphelpCacheControl Sw3NtApphelpCacheControl
__asm__("Sw3NtApphelpCacheControl: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0E38CFC0F \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0E38CFC0F \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwCreateProcessEx Sw3NtCreateProcessEx
__asm__("Sw3NtCreateProcessEx: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x015EB5512 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x015EB5512 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwCreateThread Sw3NtCreateThread
__asm__("Sw3NtCreateThread: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x00B4EDFFE \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x00B4EDFFE \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwIsProcessInJob Sw3NtIsProcessInJob
__asm__("Sw3NtIsProcessInJob: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x02FD7D983 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x02FD7D983 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwProtectVirtualMemory Sw3NtProtectVirtualMemory
__asm__("Sw3NtProtectVirtualMemory: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x03DA9534F \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x03DA9534F \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwQuerySection Sw3NtQuerySection
__asm__("Sw3NtQuerySection: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0A8602873 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0A8602873 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwResumeThread Sw3NtResumeThread
__asm__("Sw3NtResumeThread: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x03C85E6BB \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x03C85E6BB \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwTerminateThread Sw3NtTerminateThread
__asm__("Sw3NtTerminateThread: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x078DC366D \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x078DC366D \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwReadRequestData Sw3NtReadRequestData
__asm__("Sw3NtReadRequestData: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x023830CCF \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x023830CCF \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwCreateFile Sw3NtCreateFile
__asm__("Sw3NtCreateFile: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0F95E1C05 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0F95E1C05 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwQueryEvent Sw3NtQueryEvent
__asm__("Sw3NtQueryEvent: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x016830504 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x016830504 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwWriteRequestData Sw3NtWriteRequestData
__asm__("Sw3NtWriteRequestData: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0765FA36D \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0765FA36D \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwOpenDirectoryObject Sw3NtOpenDirectoryObject
__asm__("Sw3NtOpenDirectoryObject: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0203E2EA3 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0203E2EA3 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwAccessCheckByTypeAndAuditAlarm Sw3NtAccessCheckByTypeAndAuditAlarm
__asm__("Sw3NtAccessCheckByTypeAndAuditAlarm: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x052D57480 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x052D57480 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwWaitForMultipleObjects Sw3NtWaitForMultipleObjects
__asm__("Sw3NtWaitForMultipleObjects: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x01BE5DFD93 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x01BE5DFD93 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwSetInformationObject Sw3NtSetInformationObject
__asm__("Sw3NtSetInformationObject: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x03A150AA9 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x03A150AA9 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwCancelIoFile Sw3NtCancelIoFile
__asm__("Sw3NtCancelIoFile: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0B7194803 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0B7194803 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwTraceEvent Sw3NtTraceEvent
__asm__("Sw3NtTraceEvent: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x010843514 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x010843514 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwPowerInformation Sw3NtPowerInformation
__asm__("Sw3NtPowerInformation: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0E84EE6D5 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0E84EE6D5 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwSetValueKey Sw3NtSetValueKey
__asm__("Sw3NtSetValueKey: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x05BE22000 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x05BE22000 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwCancelTimer Sw3NtCancelTimer
__asm__("Sw3NtCancelTimer: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x099A2E129 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x099A2E129 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwSetTimer Sw3NtSetTimer
__asm__("Sw3NtSetTimer: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0E044CCFD \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0E044CCFD \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwAccessCheckByType Sw3NtAccessCheckByType
__asm__("Sw3NtAccessCheckByType: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0DF07D26F \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0DF07D26F \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwAccessCheckByTypeResultList Sw3NtAccessCheckByTypeResultList
__asm__("Sw3NtAccessCheckByTypeResultList: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x02EB0C9A3 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x02EB0C9A3 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwAccessCheckByTypeResultListAndAuditAlarm Sw3NtAccessCheckByTypeResultListAndAuditAlarm
__asm__("Sw3NtAccessCheckByTypeResultListAndAuditAlarm: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x09F339E5F \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x09F339E5F \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwAccessCheckByTypeResultListAndAuditAlarmByHandle Sw3NtAccessCheckByTypeResultListAndAuditAlarmByHandle
__asm__("Sw3NtAccessCheckByTypeResultListAndAuditAlarmByHandle: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0973CB876 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0973CB876 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwAcquireProcessActivityReference Sw3NtAcquireProcessActivityReference
__asm__("Sw3NtAcquireProcessActivityReference: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0569AADFA \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0569AADFA \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwAddAtomEx Sw3NtAddAtomEx
__asm__("Sw3NtAddAtomEx: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x00990B594 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x00990B594 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwAddBootEntry Sw3NtAddBootEntry
__asm__("Sw3NtAddBootEntry: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x049853376 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x049853376 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwAddDriverEntry Sw3NtAddDriverEntry
__asm__("Sw3NtAddDriverEntry: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x047EB7D28 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x047EB7D28 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwAdjustGroupsToken Sw3NtAdjustGroupsToken
__asm__("Sw3NtAdjustGroupsToken: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x01390DDCC \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x01390DDCC \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwAdjustTokenClaimsAndDeviceGroups Sw3NtAdjustTokenClaimsAndDeviceGroups
__asm__("Sw3NtAdjustTokenClaimsAndDeviceGroups: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x08DC0A159 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x08DC0A159 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwAlertResumeThread Sw3NtAlertResumeThread
__asm__("Sw3NtAlertResumeThread: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x01E86542F \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x01E86542F \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwAlertThread Sw3NtAlertThread
__asm__("Sw3NtAlertThread: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x040E00A35 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x040E00A35 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwAlertThreadByThreadId Sw3NtAlertThreadByThreadId
__asm__("Sw3NtAlertThreadByThreadId: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x022D6DD4D \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x022D6DD4D \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwAllocateLocallyUniqueId Sw3NtAllocateLocallyUniqueId
__asm__("Sw3NtAllocateLocallyUniqueId: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x07F8B431A \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x07F8B431A \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwAllocateReserveObject Sw3NtAllocateReserveObject
__asm__("Sw3NtAllocateReserveObject: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0E0BF00E2 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0E0BF00E2 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwAllocateUserPhysicalPages Sw3NtAllocateUserPhysicalPages
__asm__("Sw3NtAllocateUserPhysicalPages: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0A9B6BE16 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0A9B6BE16 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwAllocateUuids Sw3NtAllocateUuids
__asm__("Sw3NtAllocateUuids: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0AD9CDB79 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0AD9CDB79 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwAllocateVirtualMemoryEx Sw3NtAllocateVirtualMemoryEx
__asm__("Sw3NtAllocateVirtualMemoryEx: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x066E23835 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x066E23835 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwAlpcAcceptConnectPort Sw3NtAlpcAcceptConnectPort
__asm__("Sw3NtAlpcAcceptConnectPort: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0E54CDEE3 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0E54CDEE3 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwAlpcCancelMessage Sw3NtAlpcCancelMessage
__asm__("Sw3NtAlpcCancelMessage: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0B111222C \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0B111222C \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwAlpcConnectPort Sw3NtAlpcConnectPort
__asm__("Sw3NtAlpcConnectPort: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x030B61AE8 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x030B61AE8 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwAlpcConnectPortEx Sw3NtAlpcConnectPortEx
__asm__("Sw3NtAlpcConnectPortEx: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0A65FF889 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0A65FF889 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwAlpcCreatePort Sw3NtAlpcCreatePort
__asm__("Sw3NtAlpcCreatePort: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0E870C1EC \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0E870C1EC \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwAlpcCreatePortSection Sw3NtAlpcCreatePortSection
__asm__("Sw3NtAlpcCreatePortSection: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x09255EA9F \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x09255EA9F \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwAlpcCreateResourceReserve Sw3NtAlpcCreateResourceReserve
__asm__("Sw3NtAlpcCreateResourceReserve: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0289B3A33 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0289B3A33 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwAlpcCreateSectionView Sw3NtAlpcCreateSectionView
__asm__("Sw3NtAlpcCreateSectionView: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x092C4A77E \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x092C4A77E \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwAlpcCreateSecurityContext Sw3NtAlpcCreateSecurityContext
__asm__("Sw3NtAlpcCreateSecurityContext: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0F66FF3E6 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0F66FF3E6 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwAlpcDeletePortSection Sw3NtAlpcDeletePortSection
__asm__("Sw3NtAlpcDeletePortSection: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x00A81CAD2 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x00A81CAD2 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwAlpcDeleteResourceReserve Sw3NtAlpcDeleteResourceReserve
__asm__("Sw3NtAlpcDeleteResourceReserve: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x006D95411 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x006D95411 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwAlpcDeleteSectionView Sw3NtAlpcDeleteSectionView
__asm__("Sw3NtAlpcDeleteSectionView: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0EE48D7EF \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0EE48D7EF \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwAlpcDeleteSecurityContext Sw3NtAlpcDeleteSecurityContext
__asm__("Sw3NtAlpcDeleteSecurityContext: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x094CC5A8D \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x094CC5A8D \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwAlpcDisconnectPort Sw3NtAlpcDisconnectPort
__asm__("Sw3NtAlpcDisconnectPort: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0E037E7BC \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0E037E7BC \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwAlpcImpersonateClientContainerOfPort Sw3NtAlpcImpersonateClientContainerOfPort
__asm__("Sw3NtAlpcImpersonateClientContainerOfPort: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0E477EFE8 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0E477EFE8 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwAlpcImpersonateClientOfPort Sw3NtAlpcImpersonateClientOfPort
__asm__("Sw3NtAlpcImpersonateClientOfPort: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x05CB4552A \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x05CB4552A \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwAlpcOpenSenderProcess Sw3NtAlpcOpenSenderProcess
__asm__("Sw3NtAlpcOpenSenderProcess: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0693F9773 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0693F9773 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwAlpcOpenSenderThread Sw3NtAlpcOpenSenderThread
__asm__("Sw3NtAlpcOpenSenderThread: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x014884C37 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x014884C37 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwAlpcQueryInformation Sw3NtAlpcQueryInformation
__asm__("Sw3NtAlpcQueryInformation: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x05CC45E55 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x05CC45E55 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwAlpcQueryInformationMessage Sw3NtAlpcQueryInformationMessage
__asm__("Sw3NtAlpcQueryInformationMessage: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x027123CAB \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x027123CAB \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwAlpcRevokeSecurityContext Sw3NtAlpcRevokeSecurityContext
__asm__("Sw3NtAlpcRevokeSecurityContext: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x016B20D3A \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x016B20D3A \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwAlpcSendWaitReceivePort Sw3NtAlpcSendWaitReceivePort
__asm__("Sw3NtAlpcSendWaitReceivePort: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0ED760C6B \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0ED760C6B \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwAlpcSetInformation Sw3NtAlpcSetInformation
__asm__("Sw3NtAlpcSetInformation: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0178A1718 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0178A1718 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwAreMappedFilesTheSame Sw3NtAreMappedFilesTheSame
__asm__("Sw3NtAreMappedFilesTheSame: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0B1909816 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0B1909816 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwAssignProcessToJobObject Sw3NtAssignProcessToJobObject
__asm__("Sw3NtAssignProcessToJobObject: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x008946A49 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x008946A49 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwAssociateWaitCompletionPacket Sw3NtAssociateWaitCompletionPacket
__asm__("Sw3NtAssociateWaitCompletionPacket: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x07B5C01B1 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x07B5C01B1 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwCallEnclave Sw3NtCallEnclave
__asm__("Sw3NtCallEnclave: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x03AAA5638 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x03AAA5638 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwCancelIoFileEx Sw3NtCancelIoFileEx
__asm__("Sw3NtCancelIoFileEx: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0E51A3345 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0E51A3345 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwCancelSynchronousIoFile Sw3NtCancelSynchronousIoFile
__asm__("Sw3NtCancelSynchronousIoFile: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x055DC6B49 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x055DC6B49 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwCancelTimer2 Sw3NtCancelTimer2
__asm__("Sw3NtCancelTimer2: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0B03B31EC \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0B03B31EC \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwCancelWaitCompletionPacket Sw3NtCancelWaitCompletionPacket
__asm__("Sw3NtCancelWaitCompletionPacket: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x029AC4F7E \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x029AC4F7E \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwCommitComplete Sw3NtCommitComplete
__asm__("Sw3NtCommitComplete: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x04EB13672 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x04EB13672 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwCommitEnlistment Sw3NtCommitEnlistment
__asm__("Sw3NtCommitEnlistment: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x033BB262D \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x033BB262D \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwCommitRegistryTransaction Sw3NtCommitRegistryTransaction
__asm__("Sw3NtCommitRegistryTransaction: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x01E58D104 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x01E58D104 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwCommitTransaction Sw3NtCommitTransaction
__asm__("Sw3NtCommitTransaction: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0D8822BC6 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0D8822BC6 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwCompactKeys Sw3NtCompactKeys
__asm__("Sw3NtCompactKeys: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x059B04422 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x059B04422 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwCompareObjects Sw3NtCompareObjects
__asm__("Sw3NtCompareObjects: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x081ADB90F \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x081ADB90F \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwCompareSigningLevels Sw3NtCompareSigningLevels
__asm__("Sw3NtCompareSigningLevels: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0A21BE2CE \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0A21BE2CE \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwCompareTokens Sw3NtCompareTokens
__asm__("Sw3NtCompareTokens: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x077D6695B \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x077D6695B \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwCompleteConnectPort Sw3NtCompleteConnectPort
__asm__("Sw3NtCompleteConnectPort: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x064F16F6E \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x064F16F6E \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwCompressKey Sw3NtCompressKey
__asm__("Sw3NtCompressKey: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x088CD5F92 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x088CD5F92 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwConnectPort Sw3NtConnectPort
__asm__("Sw3NtConnectPort: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x058F15B7E \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x058F15B7E \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwConvertBetweenAuxiliaryCounterAndPerformanceCounter Sw3NtConvertBetweenAuxiliaryCounterAndPerformanceCounter
__asm__("Sw3NtConvertBetweenAuxiliaryCounterAndPerformanceCounter: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0E7D6389A \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0E7D6389A \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwCreateDebugObject Sw3NtCreateDebugObject
__asm__("Sw3NtCreateDebugObject: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x00E33E64F \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x00E33E64F \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwCreateDirectoryObject Sw3NtCreateDirectoryObject
__asm__("Sw3NtCreateDirectoryObject: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x018A42619 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x018A42619 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwCreateDirectoryObjectEx Sw3NtCreateDirectoryObjectEx
__asm__("Sw3NtCreateDirectoryObjectEx: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0B0BCC246 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0B0BCC246 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwCreateEnclave Sw3NtCreateEnclave
__asm__("Sw3NtCreateEnclave: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0135CE116 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0135CE116 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwCreateEnlistment Sw3NtCreateEnlistment
__asm__("Sw3NtCreateEnlistment: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x079E37869 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x079E37869 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwCreateEventPair Sw3NtCreateEventPair
__asm__("Sw3NtCreateEventPair: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x01235DE6F \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x01235DE6F \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwCreateIRTimer Sw3NtCreateIRTimer
__asm__("Sw3NtCreateIRTimer: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x005963FDE \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x005963FDE \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwCreateIoCompletion Sw3NtCreateIoCompletion
__asm__("Sw3NtCreateIoCompletion: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x00F296DB8 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x00F296DB8 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwCreateJobObject Sw3NtCreateJobObject
__asm__("Sw3NtCreateJobObject: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x09655BEE9 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x09655BEE9 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwCreateJobSet Sw3NtCreateJobSet
__asm__("Sw3NtCreateJobSet: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x00716F85D \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x00716F85D \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwCreateKeyTransacted Sw3NtCreateKeyTransacted
__asm__("Sw3NtCreateKeyTransacted: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x060BC2262 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x060BC2262 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwCreateKeyedEvent Sw3NtCreateKeyedEvent
__asm__("Sw3NtCreateKeyedEvent: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x04F0D5284 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x04F0D5284 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwCreateLowBoxToken Sw3NtCreateLowBoxToken
__asm__("Sw3NtCreateLowBoxToken: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x01A5200DF \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x01A5200DF \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwCreateMailslotFile Sw3NtCreateMailslotFile
__asm__("Sw3NtCreateMailslotFile: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0393CB028 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0393CB028 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwCreateMutant Sw3NtCreateMutant
__asm__("Sw3NtCreateMutant: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0D10CD69F \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0D10CD69F \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwCreateNamedPipeFile Sw3NtCreateNamedPipeFile
__asm__("Sw3NtCreateNamedPipeFile: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x01E5CE906 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x01E5CE906 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwCreatePagingFile Sw3NtCreatePagingFile
__asm__("Sw3NtCreatePagingFile: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0E5659673 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0E5659673 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwCreatePartition Sw3NtCreatePartition
__asm__("Sw3NtCreatePartition: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x00B4E678C \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x00B4E678C \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwCreatePort Sw3NtCreatePort
__asm__("Sw3NtCreatePort: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0E570FAE3 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0E570FAE3 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwCreatePrivateNamespace Sw3NtCreatePrivateNamespace
__asm__("Sw3NtCreatePrivateNamespace: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x017332B6A \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x017332B6A \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwCreateProcess Sw3NtCreateProcess
__asm__("Sw3NtCreateProcess: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x019A80240 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x019A80240 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwCreateProfile Sw3NtCreateProfile
__asm__("Sw3NtCreateProfile: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x074B7122C \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x074B7122C \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwCreateProfileEx Sw3NtCreateProfileEx
__asm__("Sw3NtCreateProfileEx: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0409A1C4F \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0409A1C4F \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwCreateRegistryTransaction Sw3NtCreateRegistryTransaction
__asm__("Sw3NtCreateRegistryTransaction: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0CC9E2602 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0CC9E2602 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwCreateResourceManager Sw3NtCreateResourceManager
__asm__("Sw3NtCreateResourceManager: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x035E66124 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x035E66124 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwCreateSemaphore Sw3NtCreateSemaphore
__asm__("Sw3NtCreateSemaphore: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0742656EA \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0742656EA \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwCreateSymbolicLinkObject Sw3NtCreateSymbolicLinkObject
__asm__("Sw3NtCreateSymbolicLinkObject: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x010BD4667 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x010BD4667 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwCreateThreadEx Sw3NtCreateThreadEx
__asm__("Sw3NtCreateThreadEx: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x052B396EE \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x052B396EE \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwCreateTimer Sw3NtCreateTimer
__asm__("Sw3NtCreateTimer: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x07DC783AF \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x07DC783AF \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwCreateTimer2 Sw3NtCreateTimer2
__asm__("Sw3NtCreateTimer2: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0D2BA19AC \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0D2BA19AC \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwCreateToken Sw3NtCreateToken
__asm__("Sw3NtCreateToken: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x071D583B5 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x071D583B5 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwCreateTokenEx Sw3NtCreateTokenEx
__asm__("Sw3NtCreateTokenEx: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0786322BE \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0786322BE \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwCreateTransaction Sw3NtCreateTransaction
__asm__("Sw3NtCreateTransaction: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x01774D223 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x01774D223 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwCreateTransactionManager Sw3NtCreateTransactionManager
__asm__("Sw3NtCreateTransactionManager: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x011B13D28 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x011B13D28 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwCreateUserProcess Sw3NtCreateUserProcess
__asm__("Sw3NtCreateUserProcess: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x09E34A7BB \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x09E34A7BB \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwCreateWaitCompletionPacket Sw3NtCreateWaitCompletionPacket
__asm__("Sw3NtCreateWaitCompletionPacket: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0B96399DE \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0B96399DE \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwCreateWaitablePort Sw3NtCreateWaitablePort
__asm__("Sw3NtCreateWaitablePort: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0A4B64F29 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0A4B64F29 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwCreateWnfStateName Sw3NtCreateWnfStateName
__asm__("Sw3NtCreateWnfStateName: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x074924D47 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x074924D47 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwCreateWorkerFactory Sw3NtCreateWorkerFactory
__asm__("Sw3NtCreateWorkerFactory: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x001151588 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x001151588 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwDebugActiveProcess Sw3NtDebugActiveProcess
__asm__("Sw3NtDebugActiveProcess: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x025952408 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x025952408 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwDebugContinue Sw3NtDebugContinue
__asm__("Sw3NtDebugContinue: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0D670918C \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0D670918C \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwDeleteAtom Sw3NtDeleteAtom
__asm__("Sw3NtDeleteAtom: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x034A2D02B \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x034A2D02B \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwDeleteBootEntry Sw3NtDeleteBootEntry
__asm__("Sw3NtDeleteBootEntry: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x009841114 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x009841114 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwDeleteDriverEntry Sw3NtDeleteDriverEntry
__asm__("Sw3NtDeleteDriverEntry: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x003920900 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x003920900 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwDeleteFile Sw3NtDeleteFile
__asm__("Sw3NtDeleteFile: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x004B5CCE7 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x004B5CCE7 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwDeleteKey Sw3NtDeleteKey
__asm__("Sw3NtDeleteKey: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x01A4EC31C \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x01A4EC31C \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwDeleteObjectAuditAlarm Sw3NtDeleteObjectAuditAlarm
__asm__("Sw3NtDeleteObjectAuditAlarm: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0CC93EE5E \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0CC93EE5E \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwDeletePrivateNamespace Sw3NtDeletePrivateNamespace
__asm__("Sw3NtDeletePrivateNamespace: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x011BDE62F \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x011BDE62F \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwDeleteValueKey Sw3NtDeleteValueKey
__asm__("Sw3NtDeleteValueKey: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x02E9B310C \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x02E9B310C \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwDeleteWnfStateData Sw3NtDeleteWnfStateData
__asm__("Sw3NtDeleteWnfStateData: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x062DD908C \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x062DD908C \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwDeleteWnfStateName Sw3NtDeleteWnfStateName
__asm__("Sw3NtDeleteWnfStateName: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x004CB81D3 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x004CB81D3 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwDisableLastKnownGood Sw3NtDisableLastKnownGood
__asm__("Sw3NtDisableLastKnownGood: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x007B88DAE \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x007B88DAE \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwDisplayString Sw3NtDisplayString
__asm__("Sw3NtDisplayString: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0FACDACF0 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0FACDACF0 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwDrawText Sw3NtDrawText
__asm__("Sw3NtDrawText: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0A2DD8D4F \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0A2DD8D4F \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwEnableLastKnownGood Sw3NtEnableLastKnownGood
__asm__("Sw3NtEnableLastKnownGood: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x029BA1D12 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x029BA1D12 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwEnumerateBootEntries Sw3NtEnumerateBootEntries
__asm__("Sw3NtEnumerateBootEntries: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0F965FEF2 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0F965FEF2 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwEnumerateDriverEntries Sw3NtEnumerateDriverEntries
__asm__("Sw3NtEnumerateDriverEntries: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x00126F94D \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x00126F94D \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwEnumerateSystemEnvironmentValuesEx Sw3NtEnumerateSystemEnvironmentValuesEx
__asm__("Sw3NtEnumerateSystemEnvironmentValuesEx: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0F160323B \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0F160323B \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwEnumerateTransactionObject Sw3NtEnumerateTransactionObject
__asm__("Sw3NtEnumerateTransactionObject: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x084B9B415 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x084B9B415 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwExtendSection Sw3NtExtendSection
__asm__("Sw3NtExtendSection: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0F76CD7F2 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0F76CD7F2 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwFilterBootOption Sw3NtFilterBootOption
__asm__("Sw3NtFilterBootOption: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0048823DD \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0048823DD \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwFilterToken Sw3NtFilterToken
__asm__("Sw3NtFilterToken: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x00D950306 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x00D950306 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwFilterTokenEx Sw3NtFilterTokenEx
__asm__("Sw3NtFilterTokenEx: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x00691504E \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x00691504E \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwFlushBuffersFileEx Sw3NtFlushBuffersFileEx
__asm__("Sw3NtFlushBuffersFileEx: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x04DA38117 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x04DA38117 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwFlushInstallUILanguage Sw3NtFlushInstallUILanguage
__asm__("Sw3NtFlushInstallUILanguage: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0C415F3C9 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0C415F3C9 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwFlushInstructionCache Sw3NtFlushInstructionCache
__asm__("Sw3NtFlushInstructionCache: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x069BE1567 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x069BE1567 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwFlushKey Sw3NtFlushKey
__asm__("Sw3NtFlushKey: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x08491A72B \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x08491A72B \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwFlushProcessWriteBuffers Sw3NtFlushProcessWriteBuffers
__asm__("Sw3NtFlushProcessWriteBuffers: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0405C4CC4 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0405C4CC4 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwFlushVirtualMemory Sw3NtFlushVirtualMemory
__asm__("Sw3NtFlushVirtualMemory: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x00D964559 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x00D964559 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwFlushWriteBuffer Sw3NtFlushWriteBuffer
__asm__("Sw3NtFlushWriteBuffer: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x01282CC22 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x01282CC22 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwFreeUserPhysicalPages Sw3NtFreeUserPhysicalPages
__asm__("Sw3NtFreeUserPhysicalPages: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0FF61E8E2 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0FF61E8E2 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwFreezeRegistry Sw3NtFreezeRegistry
__asm__("Sw3NtFreezeRegistry: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x002DA7A2B \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x002DA7A2B \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwFreezeTransactions Sw3NtFreezeTransactions
__asm__("Sw3NtFreezeTransactions: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x04BDBA8CD \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x04BDBA8CD \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwGetCachedSigningLevel Sw3NtGetCachedSigningLevel
__asm__("Sw3NtGetCachedSigningLevel: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0989B1BA4 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0989B1BA4 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwGetCompleteWnfStateSubscription Sw3NtGetCompleteWnfStateSubscription
__asm__("Sw3NtGetCompleteWnfStateSubscription: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x00A922E03 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x00A922E03 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwGetContextThread Sw3NtGetContextThread
__asm__("Sw3NtGetContextThread: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0E84FA6ED \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0E84FA6ED \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwGetCurrentProcessorNumber Sw3NtGetCurrentProcessorNumber
__asm__("Sw3NtGetCurrentProcessorNumber: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x007AAEEF2 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x007AAEEF2 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwGetCurrentProcessorNumberEx Sw3NtGetCurrentProcessorNumberEx
__asm__("Sw3NtGetCurrentProcessorNumberEx: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x07F57B303 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x07F57B303 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwGetDevicePowerState Sw3NtGetDevicePowerState
__asm__("Sw3NtGetDevicePowerState: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x08D9DED10 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x08D9DED10 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwGetMUIRegistryInfo Sw3NtGetMUIRegistryInfo
__asm__("Sw3NtGetMUIRegistryInfo: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x084BFA417 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x084BFA417 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwGetNextProcess Sw3NtGetNextProcess
__asm__("Sw3NtGetNextProcess: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x005AB0E34 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x005AB0E34 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwGetNextThread Sw3NtGetNextThread
__asm__("Sw3NtGetNextThread: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x01C304109 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x01C304109 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwGetNlsSectionPtr Sw3NtGetNlsSectionPtr
__asm__("Sw3NtGetNlsSectionPtr: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0B512DB0E \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0B512DB0E \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwGetNotificationResourceManager Sw3NtGetNotificationResourceManager
__asm__("Sw3NtGetNotificationResourceManager: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x029BEF3F6 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x029BEF3F6 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwGetWriteWatch Sw3NtGetWriteWatch
__asm__("Sw3NtGetWriteWatch: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0E749E9DF \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0E749E9DF \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwImpersonateAnonymousToken Sw3NtImpersonateAnonymousToken
__asm__("Sw3NtImpersonateAnonymousToken: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x06FD97754 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x06FD97754 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwImpersonateThread Sw3NtImpersonateThread
__asm__("Sw3NtImpersonateThread: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x089284184 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x089284184 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwInitializeEnclave Sw3NtInitializeEnclave
__asm__("Sw3NtInitializeEnclave: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x06AB60A7C \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x06AB60A7C \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwInitializeNlsFiles Sw3NtInitializeNlsFiles
__asm__("Sw3NtInitializeNlsFiles: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x096B3A70C \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x096B3A70C \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwInitializeRegistry Sw3NtInitializeRegistry
__asm__("Sw3NtInitializeRegistry: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x012990011 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x012990011 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwInitiatePowerAction Sw3NtInitiatePowerAction
__asm__("Sw3NtInitiatePowerAction: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x08C178E87 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x08C178E87 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwIsSystemResumeAutomatic Sw3NtIsSystemResumeAutomatic
__asm__("Sw3NtIsSystemResumeAutomatic: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x01EB92B2E \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x01EB92B2E \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwIsUILanguageComitted Sw3NtIsUILanguageComitted
__asm__("Sw3NtIsUILanguageComitted: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0161A2485 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0161A2485 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwListenPort Sw3NtListenPort
__asm__("Sw3NtListenPort: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0A23199FE \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0A23199FE \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwLoadDriver Sw3NtLoadDriver
__asm__("Sw3NtLoadDriver: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0E447D09E \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0E447D09E \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwLoadEnclaveData Sw3NtLoadEnclaveData
__asm__("Sw3NtLoadEnclaveData: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0BD034913 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0BD034913 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwLoadHotPatch Sw3NtLoadHotPatch
__asm__("Sw3NtLoadHotPatch: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0E4BF28EC \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0E4BF28EC \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwLoadKey Sw3NtLoadKey
__asm__("Sw3NtLoadKey: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0C13CC0A4 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0C13CC0A4 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwLoadKey2 Sw3NtLoadKey2
__asm__("Sw3NtLoadKey2: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x065FDAE60 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x065FDAE60 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwLoadKeyEx Sw3NtLoadKeyEx
__asm__("Sw3NtLoadKeyEx: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x00B98CCC7 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x00B98CCC7 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwLockFile Sw3NtLockFile
__asm__("Sw3NtLockFile: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x01AD9107E \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x01AD9107E \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwLockProductActivationKeys Sw3NtLockProductActivationKeys
__asm__("Sw3NtLockProductActivationKeys: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x04AD7A349 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x04AD7A349 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwLockRegistryKey Sw3NtLockRegistryKey
__asm__("Sw3NtLockRegistryKey: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0172102BE \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0172102BE \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwLockVirtualMemory Sw3NtLockVirtualMemory
__asm__("Sw3NtLockVirtualMemory: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0B1ADA932 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0B1ADA932 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwMakePermanentObject Sw3NtMakePermanentObject
__asm__("Sw3NtMakePermanentObject: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x012BC4C11 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x012BC4C11 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwMakeTemporaryObject Sw3NtMakeTemporaryObject
__asm__("Sw3NtMakeTemporaryObject: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x074591ABA \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x074591ABA \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwManagePartition Sw3NtManagePartition
__asm__("Sw3NtManagePartition: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x00C9C6847 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x00C9C6847 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwMapCMFModule Sw3NtMapCMFModule
__asm__("Sw3NtMapCMFModule: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x054DC6E5C \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x054DC6E5C \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwMapUserPhysicalPages Sw3NtMapUserPhysicalPages
__asm__("Sw3NtMapUserPhysicalPages: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x09EA0B300 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x09EA0B300 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwMapViewOfSectionEx Sw3NtMapViewOfSectionEx
__asm__("Sw3NtMapViewOfSectionEx: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0169D6260 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0169D6260 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwModifyBootEntry Sw3NtModifyBootEntry
__asm__("Sw3NtModifyBootEntry: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0099D1D02 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0099D1D02 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwModifyDriverEntry Sw3NtModifyDriverEntry
__asm__("Sw3NtModifyDriverEntry: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x031E02178 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x031E02178 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwNotifyChangeDirectoryFile Sw3NtNotifyChangeDirectoryFile
__asm__("Sw3NtNotifyChangeDirectoryFile: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x024B4D4EF \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x024B4D4EF \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwNotifyChangeDirectoryFileEx Sw3NtNotifyChangeDirectoryFileEx
__asm__("Sw3NtNotifyChangeDirectoryFileEx: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0C05A2120 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0C05A2120 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwNotifyChangeKey Sw3NtNotifyChangeKey
__asm__("Sw3NtNotifyChangeKey: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0AA9AA900 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0AA9AA900 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwNotifyChangeMultipleKeys Sw3NtNotifyChangeMultipleKeys
__asm__("Sw3NtNotifyChangeMultipleKeys: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0B433BF47 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0B433BF47 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwNotifyChangeSession Sw3NtNotifyChangeSession
__asm__("Sw3NtNotifyChangeSession: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0178CD9D0 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0178CD9D0 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwOpenEnlistment Sw3NtOpenEnlistment
__asm__("Sw3NtOpenEnlistment: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0C9E33DA4 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0C9E33DA4 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwOpenEventPair Sw3NtOpenEventPair
__asm__("Sw3NtOpenEventPair: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x05EE36E41 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x05EE36E41 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwOpenIoCompletion Sw3NtOpenIoCompletion
__asm__("Sw3NtOpenIoCompletion: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0C2EDE2B3 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0C2EDE2B3 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwOpenJobObject Sw3NtOpenJobObject
__asm__("Sw3NtOpenJobObject: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x00738FD36 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x00738FD36 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwOpenKeyEx Sw3NtOpenKeyEx
__asm__("Sw3NtOpenKeyEx: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0FC7F0902 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0FC7F0902 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwOpenKeyTransacted Sw3NtOpenKeyTransacted
__asm__("Sw3NtOpenKeyTransacted: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0D09DB644 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0D09DB644 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwOpenKeyTransactedEx Sw3NtOpenKeyTransactedEx
__asm__("Sw3NtOpenKeyTransactedEx: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0E8D8A821 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0E8D8A821 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwOpenKeyedEvent Sw3NtOpenKeyedEvent
__asm__("Sw3NtOpenKeyedEvent: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x048CA4B5C \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x048CA4B5C \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwOpenMutant Sw3NtOpenMutant
__asm__("Sw3NtOpenMutant: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0CD8FA06E \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0CD8FA06E \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwOpenObjectAuditAlarm Sw3NtOpenObjectAuditAlarm
__asm__("Sw3NtOpenObjectAuditAlarm: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x09E30605C \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x09E30605C \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwOpenPartition Sw3NtOpenPartition
__asm__("Sw3NtOpenPartition: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0DB441A16 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0DB441A16 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwOpenPrivateNamespace Sw3NtOpenPrivateNamespace
__asm__("Sw3NtOpenPrivateNamespace: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0CACEFD5D \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0CACEFD5D \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwOpenProcessToken Sw3NtOpenProcessToken
__asm__("Sw3NtOpenProcessToken: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x00396888F \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x00396888F \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwOpenRegistryTransaction Sw3NtOpenRegistryTransaction
__asm__("Sw3NtOpenRegistryTransaction: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x00A1D34B5 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x00A1D34B5 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwOpenResourceManager Sw3NtOpenResourceManager
__asm__("Sw3NtOpenResourceManager: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x00A929FB0 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x00A929FB0 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwOpenSemaphore Sw3NtOpenSemaphore
__asm__("Sw3NtOpenSemaphore: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0D8880239 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0D8880239 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwOpenSession Sw3NtOpenSession
__asm__("Sw3NtOpenSession: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x09E05BC99 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x09E05BC99 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwOpenSymbolicLinkObject Sw3NtOpenSymbolicLinkObject
__asm__("Sw3NtOpenSymbolicLinkObject: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x00406029B \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x00406029B \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwOpenThread Sw3NtOpenThread
__asm__("Sw3NtOpenThread: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0020050BE \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0020050BE \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwOpenTimer Sw3NtOpenTimer
__asm__("Sw3NtOpenTimer: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x004130C89 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x004130C89 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwOpenTransaction Sw3NtOpenTransaction
__asm__("Sw3NtOpenTransaction: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0D20DF2D3 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0D20DF2D3 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwOpenTransactionManager Sw3NtOpenTransactionManager
__asm__("Sw3NtOpenTransactionManager: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0192279D1 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0192279D1 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwPlugPlayControl Sw3NtPlugPlayControl
__asm__("Sw3NtPlugPlayControl: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x00791E1C3 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x00791E1C3 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwPrePrepareComplete Sw3NtPrePrepareComplete
__asm__("Sw3NtPrePrepareComplete: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x02CD0DB5C \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x02CD0DB5C \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwPrePrepareEnlistment Sw3NtPrePrepareEnlistment
__asm__("Sw3NtPrePrepareEnlistment: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x00CB6CCC5 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x00CB6CCC5 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwPrepareComplete Sw3NtPrepareComplete
__asm__("Sw3NtPrepareComplete: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x048D1B28E \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x048D1B28E \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwPrepareEnlistment Sw3NtPrepareEnlistment
__asm__("Sw3NtPrepareEnlistment: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0098CC9DB \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0098CC9DB \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwPrivilegeCheck Sw3NtPrivilegeCheck
__asm__("Sw3NtPrivilegeCheck: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x01AB5D195 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x01AB5D195 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwPrivilegeObjectAuditAlarm Sw3NtPrivilegeObjectAuditAlarm
__asm__("Sw3NtPrivilegeObjectAuditAlarm: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0D2D5D440 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0D2D5D440 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwPrivilegedServiceAuditAlarm Sw3NtPrivilegedServiceAuditAlarm
__asm__("Sw3NtPrivilegedServiceAuditAlarm: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0D6B931EE \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0D6B931EE \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwPropagationComplete Sw3NtPropagationComplete
__asm__("Sw3NtPropagationComplete: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0ACB0C7BE \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0ACB0C7BE \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwPropagationFailed Sw3NtPropagationFailed
__asm__("Sw3NtPropagationFailed: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x02196A18A \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x02196A18A \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwPulseEvent Sw3NtPulseEvent
__asm__("Sw3NtPulseEvent: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0020513EF \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0020513EF \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwQueryAuxiliaryCounterFrequency Sw3NtQueryAuxiliaryCounterFrequency
__asm__("Sw3NtQueryAuxiliaryCounterFrequency: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x077470AC1 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x077470AC1 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwQueryBootEntryOrder Sw3NtQueryBootEntryOrder
__asm__("Sw3NtQueryBootEntryOrder: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x08B9E7C9A \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x08B9E7C9A \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwQueryBootOptions Sw3NtQueryBootOptions
__asm__("Sw3NtQueryBootOptions: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x00A9BE4C6 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x00A9BE4C6 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwQueryDebugFilterState Sw3NtQueryDebugFilterState
__asm__("Sw3NtQueryDebugFilterState: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x032903C34 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x032903C34 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwQueryDirectoryFileEx Sw3NtQueryDirectoryFileEx
__asm__("Sw3NtQueryDirectoryFileEx: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x07682ACD0 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x07682ACD0 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwQueryDirectoryObject Sw3NtQueryDirectoryObject
__asm__("Sw3NtQueryDirectoryObject: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x04B637DD9 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x04B637DD9 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwQueryDriverEntryOrder Sw3NtQueryDriverEntryOrder
__asm__("Sw3NtQueryDriverEntryOrder: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x09B396272 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x09B396272 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwQueryEaFile Sw3NtQueryEaFile
__asm__("Sw3NtQueryEaFile: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0FDDC2DE8 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0FDDC2DE8 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwQueryFullAttributesFile Sw3NtQueryFullAttributesFile
__asm__("Sw3NtQueryFullAttributesFile: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x008B96472 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x008B96472 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwQueryInformationAtom Sw3NtQueryInformationAtom
__asm__("Sw3NtQueryInformationAtom: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0D13DB435 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0D13DB435 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwQueryInformationByName Sw3NtQueryInformationByName
__asm__("Sw3NtQueryInformationByName: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0B8D9C539 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0B8D9C539 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwQueryInformationEnlistment Sw3NtQueryInformationEnlistment
__asm__("Sw3NtQueryInformationEnlistment: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0D651E9F2 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0D651E9F2 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwQueryInformationJobObject Sw3NtQueryInformationJobObject
__asm__("Sw3NtQueryInformationJobObject: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0DB44F9DA \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0DB44F9DA \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwQueryInformationPort Sw3NtQueryInformationPort
__asm__("Sw3NtQueryInformationPort: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0A538AABB \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0A538AABB \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwQueryInformationResourceManager Sw3NtQueryInformationResourceManager
__asm__("Sw3NtQueryInformationResourceManager: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x01EB789B6 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x01EB789B6 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwQueryInformationTransaction Sw3NtQueryInformationTransaction
__asm__("Sw3NtQueryInformationTransaction: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x076EC1431 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x076EC1431 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwQueryInformationTransactionManager Sw3NtQueryInformationTransactionManager
__asm__("Sw3NtQueryInformationTransactionManager: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x029B0E7E0 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x029B0E7E0 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwQueryInformationWorkerFactory Sw3NtQueryInformationWorkerFactory
__asm__("Sw3NtQueryInformationWorkerFactory: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x00C5218CF \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x00C5218CF \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwQueryInstallUILanguage Sw3NtQueryInstallUILanguage
__asm__("Sw3NtQueryInstallUILanguage: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0A8365A2B \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0A8365A2B \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwQueryIntervalProfile Sw3NtQueryIntervalProfile
__asm__("Sw3NtQueryIntervalProfile: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x09E3C579E \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x09E3C579E \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwQueryIoCompletion Sw3NtQueryIoCompletion
__asm__("Sw3NtQueryIoCompletion: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x08C96EA06 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x08C96EA06 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwQueryLicenseValue Sw3NtQueryLicenseValue
__asm__("Sw3NtQueryLicenseValue: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x07A91453E \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x07A91453E \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwQueryMultipleValueKey Sw3NtQueryMultipleValueKey
__asm__("Sw3NtQueryMultipleValueKey: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x00AFB1769 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x00AFB1769 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwQueryMutant Sw3NtQueryMutant
__asm__("Sw3NtQueryMutant: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0963399A0 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0963399A0 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwQueryOpenSubKeys Sw3NtQueryOpenSubKeys
__asm__("Sw3NtQueryOpenSubKeys: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0EEBBE53D \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0EEBBE53D \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwQueryOpenSubKeysEx Sw3NtQueryOpenSubKeysEx
__asm__("Sw3NtQueryOpenSubKeysEx: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x00B87C6D3 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x00B87C6D3 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwQueryPortInformationProcess Sw3NtQueryPortInformationProcess
__asm__("Sw3NtQueryPortInformationProcess: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0772C96B0 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0772C96B0 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwQueryQuotaInformationFile Sw3NtQueryQuotaInformationFile
__asm__("Sw3NtQueryQuotaInformationFile: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x010947812 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x010947812 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwQuerySecurityAttributesToken Sw3NtQuerySecurityAttributesToken
__asm__("Sw3NtQuerySecurityAttributesToken: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0C95FC9FE \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0C95FC9FE \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwQuerySecurityObject Sw3NtQuerySecurityObject
__asm__("Sw3NtQuerySecurityObject: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x08BB5B9FB \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x08BB5B9FB \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwQuerySecurityPolicy Sw3NtQuerySecurityPolicy
__asm__("Sw3NtQuerySecurityPolicy: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x091ABB6F7 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x091ABB6F7 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwQuerySemaphore Sw3NtQuerySemaphore
__asm__("Sw3NtQuerySemaphore: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x08716AD59 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x08716AD59 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwQuerySymbolicLinkObject Sw3NtQuerySymbolicLinkObject
__asm__("Sw3NtQuerySymbolicLinkObject: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x086B9BEF5 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x086B9BEF5 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwQuerySystemEnvironmentValue Sw3NtQuerySystemEnvironmentValue
__asm__("Sw3NtQuerySystemEnvironmentValue: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0069D86B6 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0069D86B6 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwQuerySystemEnvironmentValueEx Sw3NtQuerySystemEnvironmentValueEx
__asm__("Sw3NtQuerySystemEnvironmentValueEx: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0002A4CFF \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0002A4CFF \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwQuerySystemInformationEx Sw3NtQuerySystemInformationEx
__asm__("Sw3NtQuerySystemInformationEx: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x010EA582A \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x010EA582A \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwQueryTimerResolution Sw3NtQueryTimerResolution
__asm__("Sw3NtQueryTimerResolution: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x012081297 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x012081297 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwQueryWnfStateData Sw3NtQueryWnfStateData
__asm__("Sw3NtQueryWnfStateData: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0C685D537 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0C685D537 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwQueryWnfStateNameInformation Sw3NtQueryWnfStateNameInformation
__asm__("Sw3NtQueryWnfStateNameInformation: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x018037A0F \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x018037A0F \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwQueueApcThreadEx Sw3NtQueueApcThreadEx
__asm__("Sw3NtQueueApcThreadEx: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x055B8097C \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x055B8097C \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwRaiseException Sw3NtRaiseException
__asm__("Sw3NtRaiseException: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x00892543F \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x00892543F \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwRaiseHardError Sw3NtRaiseHardError
__asm__("Sw3NtRaiseHardError: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0D651D7C2 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0D651D7C2 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwReadOnlyEnlistment Sw3NtReadOnlyEnlistment
__asm__("Sw3NtReadOnlyEnlistment: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x069D16043 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x069D16043 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwRecoverEnlistment Sw3NtRecoverEnlistment
__asm__("Sw3NtRecoverEnlistment: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x071EE9685 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x071EE9685 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwRecoverResourceManager Sw3NtRecoverResourceManager
__asm__("Sw3NtRecoverResourceManager: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x069B70354 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x069B70354 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwRecoverTransactionManager Sw3NtRecoverTransactionManager
__asm__("Sw3NtRecoverTransactionManager: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x06BB46528 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x06BB46528 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwRegisterProtocolAddressInformation Sw3NtRegisterProtocolAddressInformation
__asm__("Sw3NtRegisterProtocolAddressInformation: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x01FB52134 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x01FB52134 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwRegisterThreadTerminatePort Sw3NtRegisterThreadTerminatePort
__asm__("Sw3NtRegisterThreadTerminatePort: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0AA3EA3A2 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0AA3EA3A2 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwReleaseKeyedEvent Sw3NtReleaseKeyedEvent
__asm__("Sw3NtReleaseKeyedEvent: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x07EE15774 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x07EE15774 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwReleaseWorkerFactoryWorker Sw3NtReleaseWorkerFactoryWorker
__asm__("Sw3NtReleaseWorkerFactoryWorker: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x094A3F471 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x094A3F471 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwRemoveIoCompletionEx Sw3NtRemoveIoCompletionEx
__asm__("Sw3NtRemoveIoCompletionEx: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x06CCEA288 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x06CCEA288 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwRemoveProcessDebug Sw3NtRemoveProcessDebug
__asm__("Sw3NtRemoveProcessDebug: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x04024538C \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x04024538C \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwRenameKey Sw3NtRenameKey
__asm__("Sw3NtRenameKey: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x06AFA85AD \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x06AFA85AD \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwRenameTransactionManager Sw3NtRenameTransactionManager
__asm__("Sw3NtRenameTransactionManager: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0633CAD60 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0633CAD60 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwReplaceKey Sw3NtReplaceKey
__asm__("Sw3NtReplaceKey: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x05EE37B7F \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x05EE37B7F \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwReplacePartitionUnit Sw3NtReplacePartitionUnit
__asm__("Sw3NtReplacePartitionUnit: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0F778C9F1 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0F778C9F1 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwReplyWaitReplyPort Sw3NtReplyWaitReplyPort
__asm__("Sw3NtReplyWaitReplyPort: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x062F05F50 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x062F05F50 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwRequestPort Sw3NtRequestPort
__asm__("Sw3NtRequestPort: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x06EF0676E \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x06EF0676E \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwResetEvent Sw3NtResetEvent
__asm__("Sw3NtResetEvent: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x08A2195B2 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x08A2195B2 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwResetWriteWatch Sw3NtResetWriteWatch
__asm__("Sw3NtResetWriteWatch: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x01C429076 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x01C429076 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwRestoreKey Sw3NtRestoreKey
__asm__("Sw3NtRestoreKey: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x07EAA1F50 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x07EAA1F50 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwResumeProcess Sw3NtResumeProcess
__asm__("Sw3NtResumeProcess: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0D12F37BA \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0D12F37BA \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwRevertContainerImpersonation Sw3NtRevertContainerImpersonation
__asm__("Sw3NtRevertContainerImpersonation: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x05EC85E5F \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x05EC85E5F \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwRollbackComplete Sw3NtRollbackComplete
__asm__("Sw3NtRollbackComplete: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0964B681E \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0964B681E \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwRollbackEnlistment Sw3NtRollbackEnlistment
__asm__("Sw3NtRollbackEnlistment: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x00F96E984 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x00F96E984 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwRollbackRegistryTransaction Sw3NtRollbackRegistryTransaction
__asm__("Sw3NtRollbackRegistryTransaction: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x02CA8701B \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x02CA8701B \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwRollbackTransaction Sw3NtRollbackTransaction
__asm__("Sw3NtRollbackTransaction: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x00D450DD4 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x00D450DD4 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwRollforwardTransactionManager Sw3NtRollforwardTransactionManager
__asm__("Sw3NtRollforwardTransactionManager: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x005C180D2 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x005C180D2 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwSaveKey Sw3NtSaveKey
__asm__("Sw3NtSaveKey: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x066FE5744 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x066FE5744 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwSaveKeyEx Sw3NtSaveKeyEx
__asm__("Sw3NtSaveKeyEx: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x031BBFDCF \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x031BBFDCF \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwSaveMergedKeys Sw3NtSaveMergedKeys
__asm__("Sw3NtSaveMergedKeys: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x02AB6171D \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x02AB6171D \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwSecureConnectPort Sw3NtSecureConnectPort
__asm__("Sw3NtSecureConnectPort: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0DE4DC7A0 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0DE4DC7A0 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwSerializeBoot Sw3NtSerializeBoot
__asm__("Sw3NtSerializeBoot: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0329C2233 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0329C2233 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwSetBootEntryOrder Sw3NtSetBootEntryOrder
__asm__("Sw3NtSetBootEntryOrder: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x073CD5B57 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x073CD5B57 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwSetBootOptions Sw3NtSetBootOptions
__asm__("Sw3NtSetBootOptions: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x017953D01 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x017953D01 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwSetCachedSigningLevel Sw3NtSetCachedSigningLevel
__asm__("Sw3NtSetCachedSigningLevel: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0207226C3 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0207226C3 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwSetCachedSigningLevel2 Sw3NtSetCachedSigningLevel2
__asm__("Sw3NtSetCachedSigningLevel2: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0E3526281 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0E3526281 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwSetContextThread Sw3NtSetContextThread
__asm__("Sw3NtSetContextThread: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x034963C39 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x034963C39 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwSetDebugFilterState Sw3NtSetDebugFilterState
__asm__("Sw3NtSetDebugFilterState: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0229809D4 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0229809D4 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwSetDefaultHardErrorPort Sw3NtSetDefaultHardErrorPort
__asm__("Sw3NtSetDefaultHardErrorPort: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x024B75F38 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x024B75F38 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwSetDefaultLocale Sw3NtSetDefaultLocale
__asm__("Sw3NtSetDefaultLocale: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x043DE7109 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x043DE7109 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwSetDefaultUILanguage Sw3NtSetDefaultUILanguage
__asm__("Sw3NtSetDefaultUILanguage: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0A91B6FBA \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0A91B6FBA \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwSetDriverEntryOrder Sw3NtSetDriverEntryOrder
__asm__("Sw3NtSetDriverEntryOrder: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0218D1735 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0218D1735 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwSetEaFile Sw3NtSetEaFile
__asm__("Sw3NtSetEaFile: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x03E6540BD \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x03E6540BD \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwSetHighEventPair Sw3NtSetHighEventPair
__asm__("Sw3NtSetHighEventPair: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x074CC93A2 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x074CC93A2 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwSetHighWaitLowEventPair Sw3NtSetHighWaitLowEventPair
__asm__("Sw3NtSetHighWaitLowEventPair: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x00EB0323D \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x00EB0323D \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwSetIRTimer Sw3NtSetIRTimer
__asm__("Sw3NtSetIRTimer: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x027973716 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x027973716 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwSetInformationDebugObject Sw3NtSetInformationDebugObject
__asm__("Sw3NtSetInformationDebugObject: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x068559059 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x068559059 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwSetInformationEnlistment Sw3NtSetInformationEnlistment
__asm__("Sw3NtSetInformationEnlistment: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0099B2C2D \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0099B2C2D \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwSetInformationJobObject Sw3NtSetInformationJobObject
__asm__("Sw3NtSetInformationJobObject: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0FF54C7D8 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0FF54C7D8 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwSetInformationKey Sw3NtSetInformationKey
__asm__("Sw3NtSetInformationKey: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0AE9B3988 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0AE9B3988 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwSetInformationResourceManager Sw3NtSetInformationResourceManager
__asm__("Sw3NtSetInformationResourceManager: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x00531159C \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x00531159C \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwSetInformationSymbolicLink Sw3NtSetInformationSymbolicLink
__asm__("Sw3NtSetInformationSymbolicLink: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0F357F3C1 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0F357F3C1 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwSetInformationToken Sw3NtSetInformationToken
__asm__("Sw3NtSetInformationToken: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x07355266E \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x07355266E \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwSetInformationTransaction Sw3NtSetInformationTransaction
__asm__("Sw3NtSetInformationTransaction: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x04886065F \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x04886065F \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwSetInformationTransactionManager Sw3NtSetInformationTransactionManager
__asm__("Sw3NtSetInformationTransactionManager: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0BB65C7A8 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0BB65C7A8 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwSetInformationVirtualMemory Sw3NtSetInformationVirtualMemory
__asm__("Sw3NtSetInformationVirtualMemory: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0FB90F506 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0FB90F506 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwSetInformationWorkerFactory Sw3NtSetInformationWorkerFactory
__asm__("Sw3NtSetInformationWorkerFactory: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0DB4AD3C5 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0DB4AD3C5 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwSetIntervalProfile Sw3NtSetIntervalProfile
__asm__("Sw3NtSetIntervalProfile: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0F4BF6DBB \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0F4BF6DBB \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwSetIoCompletion Sw3NtSetIoCompletion
__asm__("Sw3NtSetIoCompletion: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x03EA41FF3 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x03EA41FF3 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwSetIoCompletionEx Sw3NtSetIoCompletionEx
__asm__("Sw3NtSetIoCompletionEx: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0A156DDD2 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0A156DDD2 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwSetLdtEntries Sw3NtSetLdtEntries
__asm__("Sw3NtSetLdtEntries: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x02A81C395 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x02A81C395 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwSetLowEventPair Sw3NtSetLowEventPair
__asm__("Sw3NtSetLowEventPair: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x05EB2462B \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x05EB2462B \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwSetLowWaitHighEventPair Sw3NtSetLowWaitHighEventPair
__asm__("Sw3NtSetLowWaitHighEventPair: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x02232329B \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x02232329B \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwSetQuotaInformationFile Sw3NtSetQuotaInformationFile
__asm__("Sw3NtSetQuotaInformationFile: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0DE5F0418 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0DE5F0418 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwSetSecurityObject Sw3NtSetSecurityObject
__asm__("Sw3NtSetSecurityObject: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0FA40C2CC \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0FA40C2CC \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwSetSystemEnvironmentValue Sw3NtSetSystemEnvironmentValue
__asm__("Sw3NtSetSystemEnvironmentValue: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x03C972B1C \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x03C972B1C \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwSetSystemEnvironmentValueEx Sw3NtSetSystemEnvironmentValueEx
__asm__("Sw3NtSetSystemEnvironmentValueEx: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0978AC356 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0978AC356 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwSetSystemInformation Sw3NtSetSystemInformation
__asm__("Sw3NtSetSystemInformation: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0349A4F8F \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0349A4F8F \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwSetSystemPowerState Sw3NtSetSystemPowerState
__asm__("Sw3NtSetSystemPowerState: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x01CA3F6D2 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x01CA3F6D2 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwSetSystemTime Sw3NtSetSystemTime
__asm__("Sw3NtSetSystemTime: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x086A2D69F \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x086A2D69F \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwSetThreadExecutionState Sw3NtSetThreadExecutionState
__asm__("Sw3NtSetThreadExecutionState: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x09D966489 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x09D966489 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwSetTimer2 Sw3NtSetTimer2
__asm__("Sw3NtSetTimer2: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x01DA4DA2D \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x01DA4DA2D \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwSetTimerEx Sw3NtSetTimerEx
__asm__("Sw3NtSetTimerEx: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x026B9998E \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x026B9998E \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwSetTimerResolution Sw3NtSetTimerResolution
__asm__("Sw3NtSetTimerResolution: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x03CAB3C3D \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x03CAB3C3D \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwSetUuidSeed Sw3NtSetUuidSeed
__asm__("Sw3NtSetUuidSeed: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0F1CF72F3 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0F1CF72F3 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwSetVolumeInformationFile Sw3NtSetVolumeInformationFile
__asm__("Sw3NtSetVolumeInformationFile: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x00A9CC2BA \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x00A9CC2BA \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwSetWnfProcessNotificationEvent Sw3NtSetWnfProcessNotificationEvent
__asm__("Sw3NtSetWnfProcessNotificationEvent: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x03924D47D \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x03924D47D \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwShutdownSystem Sw3NtShutdownSystem
__asm__("Sw3NtShutdownSystem: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x090BC8003 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x090BC8003 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwShutdownWorkerFactory Sw3NtShutdownWorkerFactory
__asm__("Sw3NtShutdownWorkerFactory: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x08C02BABA \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x08C02BABA \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwSignalAndWaitForSingleObject Sw3NtSignalAndWaitForSingleObject
__asm__("Sw3NtSignalAndWaitForSingleObject: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x07CA8145F \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x07CA8145F \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwSinglePhaseReject Sw3NtSinglePhaseReject
__asm__("Sw3NtSinglePhaseReject: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x03E850E39 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x03E850E39 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwStartProfile Sw3NtStartProfile
__asm__("Sw3NtStartProfile: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0CC9D0F3B \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0CC9D0F3B \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwStopProfile Sw3NtStopProfile
__asm__("Sw3NtStopProfile: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x010B49B84 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x010B49B84 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwSubscribeWnfStateChange Sw3NtSubscribeWnfStateChange
__asm__("Sw3NtSubscribeWnfStateChange: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0CC5EFDC4 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0CC5EFDC4 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwSuspendProcess Sw3NtSuspendProcess
__asm__("Sw3NtSuspendProcess: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0C6BBDF57 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0C6BBDF57 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwSuspendThread Sw3NtSuspendThread
__asm__("Sw3NtSuspendThread: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x014B83629 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x014B83629 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwSystemDebugControl Sw3NtSystemDebugControl
__asm__("Sw3NtSystemDebugControl: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x047D16953 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x047D16953 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwTerminateEnclave Sw3NtTerminateEnclave
__asm__("Sw3NtTerminateEnclave: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x00EC2F49E \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x00EC2F49E \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwTerminateJobObject Sw3NtTerminateJobObject
__asm__("Sw3NtTerminateJobObject: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x07EA07C3D \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x07EA07C3D \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwTestAlert Sw3NtTestAlert
__asm__("Sw3NtTestAlert: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0F2C58F34 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0F2C58F34 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwThawRegistry Sw3NtThawRegistry
__asm__("Sw3NtThawRegistry: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x024AE2623 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x024AE2623 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwThawTransactions Sw3NtThawTransactions
__asm__("Sw3NtThawTransactions: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0CC1ED09E \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0CC1ED09E \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwTraceControl Sw3NtTraceControl
__asm__("Sw3NtTraceControl: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0BF914486 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0BF914486 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwTranslateFilePath Sw3NtTranslateFilePath
__asm__("Sw3NtTranslateFilePath: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0721347BE \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0721347BE \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwUmsThreadYield Sw3NtUmsThreadYield
__asm__("Sw3NtUmsThreadYield: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x007BB766F \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x007BB766F \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwUnloadDriver Sw3NtUnloadDriver
__asm__("Sw3NtUnloadDriver: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x018AB3010 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x018AB3010 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwUnloadKey Sw3NtUnloadKey
__asm__("Sw3NtUnloadKey: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0082969B1 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0082969B1 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwUnloadKey2 Sw3NtUnloadKey2
__asm__("Sw3NtUnloadKey2: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0B92132FC \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0B92132FC \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwUnloadKeyEx Sw3NtUnloadKeyEx
__asm__("Sw3NtUnloadKeyEx: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x07B98ADC5 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x07B98ADC5 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwUnlockFile Sw3NtUnlockFile
__asm__("Sw3NtUnlockFile: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x009990733 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x009990733 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwUnlockVirtualMemory Sw3NtUnlockVirtualMemory
__asm__("Sw3NtUnlockVirtualMemory: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x00A5B00DB \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x00A5B00DB \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwUnmapViewOfSectionEx Sw3NtUnmapViewOfSectionEx
__asm__("Sw3NtUnmapViewOfSectionEx: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x09A91C446 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x09A91C446 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwUnsubscribeWnfStateChange Sw3NtUnsubscribeWnfStateChange
__asm__("Sw3NtUnsubscribeWnfStateChange: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0D344D0DD \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0D344D0DD \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwUpdateWnfStateData Sw3NtUpdateWnfStateData
__asm__("Sw3NtUpdateWnfStateData: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x066C9F2FE \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x066C9F2FE \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwVdmControl Sw3NtVdmControl
__asm__("Sw3NtVdmControl: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x09F93E505 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x09F93E505 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwWaitForAlertByThreadId Sw3NtWaitForAlertByThreadId
__asm__("Sw3NtWaitForAlertByThreadId: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0ACB3E812 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0ACB3E812 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwWaitForDebugEvent Sw3NtWaitForDebugEvent
__asm__("Sw3NtWaitForDebugEvent: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x01085371E \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x01085371E \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwWaitForKeyedEvent Sw3NtWaitForKeyedEvent
__asm__("Sw3NtWaitForKeyedEvent: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0B73DA6BB \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0B73DA6BB \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwWaitForWorkViaWorkerFactory Sw3NtWaitForWorkViaWorkerFactory
__asm__("Sw3NtWaitForWorkViaWorkerFactory: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x044954E00 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x044954E00 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwWaitHighEventPair Sw3NtWaitHighEventPair
__asm__("Sw3NtWaitHighEventPair: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x08315B9B2 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x08315B9B2 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwWaitLowEventPair Sw3NtWaitLowEventPair
__asm__("Sw3NtWaitLowEventPair: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0F4B1D4EF \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0F4B1D4EF \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwAcquireCMFViewOwnership Sw3NtAcquireCMFViewOwnership
__asm__("Sw3NtAcquireCMFViewOwnership: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x04E131538 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x04E131538 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwCancelDeviceWakeupRequest Sw3NtCancelDeviceWakeupRequest
__asm__("Sw3NtCancelDeviceWakeupRequest: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x041CF4952 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x041CF4952 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwClearAllSavepointsTransaction Sw3NtClearAllSavepointsTransaction
__asm__("Sw3NtClearAllSavepointsTransaction: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x05D0961A3 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x05D0961A3 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwClearSavepointTransaction Sw3NtClearSavepointTransaction
__asm__("Sw3NtClearSavepointTransaction: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0A206BCAF \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0A206BCAF \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwRollbackSavepointTransaction Sw3NtRollbackSavepointTransaction
__asm__("Sw3NtRollbackSavepointTransaction: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x08099DE55 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x08099DE55 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwSavepointTransaction Sw3NtSavepointTransaction
__asm__("Sw3NtSavepointTransaction: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0174CD316 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0174CD316 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwSavepointComplete Sw3NtSavepointComplete
__asm__("Sw3NtSavepointComplete: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0E9569349 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0E9569349 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwCreateSectionEx Sw3NtCreateSectionEx
__asm__("Sw3NtCreateSectionEx: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x08694D44E \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x08694D44E \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwCreateCrossVmEvent Sw3NtCreateCrossVmEvent
__asm__("Sw3NtCreateCrossVmEvent: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0C60CCF98 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0C60CCF98 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwGetPlugPlayEvent Sw3NtGetPlugPlayEvent
__asm__("Sw3NtGetPlugPlayEvent: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0124DF03B \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0124DF03B \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwListTransactions Sw3NtListTransactions
__asm__("Sw3NtListTransactions: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x00F5D17D7 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x00F5D17D7 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwMarshallTransaction Sw3NtMarshallTransaction
__asm__("Sw3NtMarshallTransaction: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x074AA567B \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x074AA567B \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwPullTransaction Sw3NtPullTransaction
__asm__("Sw3NtPullTransaction: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0C881EE55 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0C881EE55 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwReleaseCMFViewOwnership Sw3NtReleaseCMFViewOwnership
__asm__("Sw3NtReleaseCMFViewOwnership: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0808559CF \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0808559CF \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwWaitForWnfNotifications Sw3NtWaitForWnfNotifications
__asm__("Sw3NtWaitForWnfNotifications: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0C5893EE2 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0C5893EE2 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwStartTm Sw3NtStartTm
__asm__("Sw3NtStartTm: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0539E1B22 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0539E1B22 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwSetInformationProcess Sw3NtSetInformationProcess
__asm__("Sw3NtSetInformationProcess: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x06739AA60 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x06739AA60 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwRequestDeviceWakeup Sw3NtRequestDeviceWakeup
__asm__("Sw3NtRequestDeviceWakeup: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x045A10570 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x045A10570 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwRequestWakeupLatency Sw3NtRequestWakeupLatency
__asm__("Sw3NtRequestWakeupLatency: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x001095ECC \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x001095ECC \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwQuerySystemTime Sw3NtQuerySystemTime
__asm__("Sw3NtQuerySystemTime: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0E96EBE5E \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0E96EBE5E \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwManageHotPatch Sw3NtManageHotPatch
__asm__("Sw3NtManageHotPatch: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0B0AD6FE9 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0B0AD6FE9 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#define Sw3ZwContinueEx Sw3NtContinueEx
__asm__("Sw3NtContinueEx: \n\
mov [rsp +8], rcx \n\
mov [rsp+16], rdx \n\
mov [rsp+24], r8 \n\
mov [rsp+32], r9 \n\
sub rsp, 0x28 \n\
mov ecx, 0x0F34DB5F2 \n\
call SW3_GetSyscallAddress \n\
mov r11, rax \n\
mov ecx, 0x0F34DB5F2 \n\
call SW3_GetSyscallNumber \n\
add rsp, 0x28 \n\
mov rcx, [rsp+8] \n\
mov rdx, [rsp+16] \n\
mov r8, [rsp+24] \n\
mov r9, [rsp+32] \n\
mov r10, rcx \n\
jmp r11 \n\
");
#endif
Reference in New Issue View Git Blame Copy Permalink