SepDuplicateSid

NTSTATUS __stdcall SepDuplicateSid(VOID *ExistingSid, VOID **NewSid){
  int v4; 
  unsigned int v5; 
  VOID **PoolWithTag; 
  VOID **v7; 
  NTSTATUS result; 

  if( !NewSid )
    return -1073741811;
  v4 = *((unsigned __int8 *)ExistingSid + 1);
  *NewSid = 0i64;
  v5 = 4 * v4 + 8;
  PoolWithTag = ExAllocatePoolWithTag(1ui64, v5, 1767073107i64);
  v7 = PoolWithTag;
  if( !PoolWithTag )
    return -1073741670;
  RtlCopySid(v5, PoolWithTag, ExistingSid);
  result = 0;
  *NewSid = v7;
  return result;
}

Referenced by:

SepDuplicateToken
SepDuplicateTokenUserAndGroups
SepSetTokenTrust
SepSetTokenUserAndGroups