RtlDeriveCapabilitySidsFromName

NTSTATUS __stdcall RtlDeriveCapabilitySidsFromName(
        _UNICODE_STRING *CapName,
        VOID *CapabilityGroupSid,
        VOID *CapabilitySid){
  NTSTATUS result; 
  __int128 v6; 
  __int128 v7; 
  unsigned int v8; 
  unsigned int v9; 
  __int128 v10; 
  __int128 v11; 
  _UNICODE_STRING DestinationString; 
  UINT8 pbResult[16]; 
  __int128 v14; 

  DestinationString = 0i64;
  if( !CapName || !CapabilityGroupSid || !CapabilitySid )
    __fastfail(5u);
  *(_OWORD *)CapabilitySid = 0i64;
  *((_OWORD *)CapabilitySid + 1) = 0i64;
  *((_OWORD *)CapabilitySid + 2) = 0i64;
  *(_OWORD *)CapabilityGroupSid = 0i64;
  *((_OWORD *)CapabilityGroupSid + 1) = 0i64;
  *((_QWORD *)CapabilityGroupSid + 4) = 0i64;
  *((_DWORD *)CapabilityGroupSid + 10) = 0;
  result = RtlUpcaseUnicodeString(&DestinationString, CapName, 1u);
  if( result >= 0 )
  {
    SymCryptSha256((UINT8 *)DestinationString.Buffer, DestinationString.Length, pbResult);
    RtlInitializeSid(CapabilityGroupSid, (_SID_IDENTIFIER_AUTHORITY *)&RtlpNtAuthority, 9u);
    v6 = *(_OWORD *)pbResult;
    *((_DWORD *)CapabilityGroupSid + 2) = 32;
    v7 = v14;
    *(_OWORD *)((char *)CapabilityGroupSid + 12) = v6;
    *(_OWORD *)((char *)CapabilityGroupSid + 28) = v7;
    v8 = 0;
    while( 1 )
    {
      v9 = v8 + 1;
      if( (unsigned __int8)RtlEqualUnicodeString(
                              &DestinationString,
                              (PCUNICODE_STRING)&RtlpLegacyApplicationCapabilityNames[2 * v8],
                              0) )
        break;
      ++v8;
      if( v9 >= 0xC )
        goto LABEL_8;
    }
    RtlInitializeSid(CapabilitySid, (_SID_IDENTIFIER_AUTHORITY *)&RtlpAppPackageAuthority, 2u);
    *((_DWORD *)CapabilitySid + 2) = 3;
    *((_DWORD *)CapabilitySid + 3) = v9;
LABEL_8:
    RtlFreeAnsiString(&DestinationString);
    if( v8 == 12 )
    {
      RtlInitializeSid(CapabilitySid, (_SID_IDENTIFIER_AUTHORITY *)&RtlpAppPackageAuthority, 0xAu);
      v10 = *(_OWORD *)pbResult;
      *((_DWORD *)CapabilitySid + 2) = 3;
      v11 = v14;
      *((_DWORD *)CapabilitySid + 3) = 1024;
      *((_OWORD *)CapabilitySid + 1) = v10;
      *((_OWORD *)CapabilitySid + 2) = v11;
    }
    return 0;
  }
  return result;
}

Referenced by: