[QUESTION] What is purpose of the assembly code _SyscallNtCreateFile in Syscalls.asm

[funte]

r77-rootkit/Unhook/Syscalls.asm

Line 17 in 3ff9fd8

SyscallNtCreateFile proc

_SyscallNtCreateFile PROC
	mov		eax, -1
	ret
_SyscallNtCreateFile ENDP

[bytecode77]

That is for the EDR unhooking module. Because the real NtCreateFile is monitored by antivirus software, it cannot be called because it would trigger a detection. That's why unhooking uses these syscall stubs to unhook ntdll, to get rid of all EDR hooks without the unhooking routine itself triggering a detection.

And the code snippet you show is a dummy that is never actually called - I do not implement EDR unhooking in Windows x86 edition. 32-bit Windows is fully supported, but I don't port every single feature there.