RtlCopySid
NTSTATUS __stdcall RtlCopySid(UINT64 DestinationSidLength, VOID *DestinationSid, VOID *SourceSid){
size_t v3;
v3 = 4 * *((unsigned __int8 *)SourceSid + 1) + 8;
if( v3 > (unsigned int)DestinationSidLength )
return -1073741789;
memmove(DestinationSid, SourceSid, v3);
return 0;
}Referenced by:
LocalGetAclForString
MiLoadHotPatchForUserSid
MiQueryLoadedPatches
NtQueryInformationToken
PspAssignProcessQuotaBlock
RtlAddAccessFilterAce
RtlAddProcessTrustLabelAce
RtlAddResourceAttributeAce
RtlpAddKnownObjectAce
SddlAddAccessFilterAce
SddlAddMandatoryAce
SddlAddProcessTrustLabelAce
SddlAddScopedPolicyIDAce
SeAuditProcessCreation
SeConvertStringSidToSid
SeQueryInformationToken
SeQueryUserSidToken
SepAdjustGroups
SepAllocateAndInitializeCachedHandleEntry
SepCreateSidValuesBlock
SepCreateTokenEx
SepDuplicateSid
SepGetLowBoxNumberEntry
SepGetSidValuesDump
SepInsertOrReferenceSharedSidEntries
SepSetTokenPackage