So i just compared NTterminateProcess between 32 and 64 bit version of a program, and the mov instruction which moves the syscall into eax is almost the same, both 5 byte, (both the B8 mov) but the only difference is that the last 2 byte in the 32 bit version is some random number which is not even used as the syscall number, for example opcode is its B8 - 2C000700, but the 64 bit is B8 - 2C000000, and that last part is not even used in the syscall number, the number in both of them is 2C, so whats the deal with that last 2-3 byte?
EDIT : yes it is in fact Wow64 process
EDIT 2 : heres the picture, as you can see some of them have something in the last 2 byte which is not part of syscall number, and for some reason only the ones that have their Zw shown have them, why!? also the rest of them are Zw functions as well, for example the black one is ZwQuerySystemInformation, but i dont get why its name is not showing! ( does it have anything to do with the last bytes of mov not having a number?)
(Picture taken in x32dbg)
77C61FF0 | B8 36000000 | mov eax,36 | 36:'6' 77C61FF5 | BA 508CC777 | mov edx,ntdll.77C78C50 | 77C61FFA | FFD2 | call edx | 77C61FFC | C2 1000 | ret 10 | 77C61FFF | 90 | nop | 77C62000 | B8 37000000 | mov eax,37 | 37:'7' 77C62005 | BA 508CC777 | mov edx,ntdll.77C78C50 | 77C6200A | FFD2 | call edx | 77C6200C | C2 0C00 | ret C | 77C6200F | 90 | nop | 77C62010 | B8 38000000 | mov eax,38 | 38:'8' 77C62015 | BA 508CC777 | mov edx,ntdll.77C78C50 | 77C6201A | FFD2 | call edx | 77C6201C | C2 1400 | ret 14 | 77C6201F | 90 | nop | 77C62020 | B8 39001B00 | mov eax,1B0039 | 77C62025 | BA 508CC777 | mov edx,ntdll.77C78C50 | 77C6202A | FFD2 | call edx | 77C6202C | C2 2800 | ret 28 | 77C6202F | 90 | nop | 77C62030 | B8 3A000000 | mov eax,3A | 3A:':' 77C62035 | BA 508CC777 | mov edx,ntdll.77C78C50 | 77C6203A | FFD2 | call edx | 77C6203C | C2 1400 | ret 14 | 77C6203F | 90 | nop | 77C62040 | B8 3B000000 | mov eax,3B | 3B:';' 77C62045 | BA 508CC777 | mov edx,ntdll.77C78C50 | 77C6204A | FFD2 | call edx | 77C6204C | C2 0C00 | ret C | 77C6204F | 90 | nop | 77C62050 | B8 3C000000 | mov eax,3C | 3C:'<' 77C62055 | BA 508CC777 | mov edx,ntdll.77C78C50 | 77C6205A | FFD2 | call edx | 77C6205C | C2 1C00 | ret 1C | 77C6205F | 90 | nop | 77C62060 | B8 3D000000 | mov eax,3D | 3D:'=' 77C62065 | BA 508CC777 | mov edx,ntdll.77C78C50 | 77C6206A | FFD2 | call edx | 77C6206C | C2 0800 | ret 8 | 77C6206F | 90 | nop | 77C62070 | B8 3E000300 | mov eax,3003E | 77C62075 | BA 508CC777 | mov edx,ntdll.77C78C50 | 77C6207A | FFD2 | call edx | 77C6207C | C2 0400 | ret 4 |