To add to the mentions of anti-cheat software, there are also multiple binary packers/protectors, such as VMProtect[1], which use system calls directly to protect and/or obfuscate themselves.

[1]: https://lifeinhex.com/use-of-syscall-and-sysenter-in-vmprote...