SepDuplicateSid

INT64 __fastcall SepDuplicateSid(VOID *ExistingSid, VOID **NewSid){
  int v4; 
  ULONG v5; 
  void *PoolWithTag; 
  VOID *v7; 
  INT64 result; 
  if( !NewSid )
    return 3221225485i64;
  v4 = *((unsigned __int8 *)ExistingSid + 1);
  *NewSid = 0i64;
  v5 = 4 * v4 + 8;
  PoolWithTag = ExAllocatePoolWithTag(PagedPool, v5, 0x69536553ui64);
  v7 = PoolWithTag;
  if( !PoolWithTag )
    return 3221225626i64;
  RtlCopySid(v5, PoolWithTag, ExistingSid);
  result = 0i64;
  *NewSid = v7;
  return result;
}

Referenced by: