title: understanding system call dispatcher for windows?
body: <p>I am trying to do some reversing to find out a function call behind the scene. </p>
  
  <p>While debugging using windbg I came across a call, </p>
  
  <pre><code>mov     edx,offset SharedUserData!SystemCallStub
  call    dword ptr [edx]
  </code></pre>
  
  <p>call leads to code below,</p>
  
  <p>ntdll!KiFastSystemCall:</p>
  
  <pre><code>8bd4        mov     edx,esp
  0f34        sysenter
  </code></pre>
  
  <p>According to <a href="http://www.nynaeve.net/?p=48" rel="nofollow">this</a> documentation, <strong>eax contains the system call ordinal.</strong>
  and the value in eax is 11CC.</p>
  
  <p>I am trying to figure out, what actually is this function which will be called. Does anyone has any idea how can I proceed further?</p>