_declspec(naked) NTSTATUS callgatex64(int id, ...) {
    DWORD savedEBP;
    DWORD savedESP;

    __asm
    {
        pop     ecx;

        mov     savedEBP, ebp;
        mov     savedESP, esp;

        pop     eax;
        mov[esp + 0x4], ecx;
        pop     ecx;
        push    ecx;
        push    ecx;
        add     esp, 0x8;
        xor     ecx, ecx;

        call    DWORD ptr fs : [0xC0]; //syscall

        mov     ebx, dword ptr[esp];
        //push  ebx;
        //push  ebx;

        mov     ebp, savedEBP;
        mov     esp, savedESP;

        push    ebx;
        ret;
    }
}

_declspec(naked) NTSTATUS callgatex86(int id, ...) {
    DWORD savedEBP;
    DWORD savedESP;

    __asm {
        pop     ecx;

        mov     savedEBP, ebp;
        mov     savedESP, esp;

        pop     eax;
        mov[esp + 0x4], ecx;
        pop     ecx;
        push    ecx;
        push    ecx;
        add     esp, 0x8;
        xor     ecx, ecx;
        mov     edx, __FINAL;
        push    edx;
        mov     edx, esp;

        _emit   0x0f;       //sysenter
        _emit   0x34;

__FINAL:
        mov     ebx, dword ptr[esp];
        //push  ebx;
        //push  ebx;

        mov     ebp, savedEBP;
        mov     esp, savedESP;

        push    ebx;
        ret;
    }
}

_declspec(naked) int isWOW64() {
    __asm {
        mov     eax, fs:[0xC0];
        ret;
    }
}

NTSTATUS __stdcall ZwProtectVirtualMemory(int sdtIndex, HANDLE ProcessHandle, PVOID* BaseAddress, PULONG ProtectSize,
                                          ULONG NewProtect, PULONG OldProtect) {
    if (isWOW64()) {
        return callgatex64(sdtIndex, 5, 0, ProcessHandle, BaseAddress, ProtectSize, NewProtect, OldProtect);
    } else {
        return callgatex86(sdtIndex, 5, 0, ProcessHandle, BaseAddress, ProtectSize, NewProtect, OldProtect);
    }
}