RtlInitializeSid

NTSTATUS __stdcall RtlInitializeSid(VOID *Sid, _SID_IDENTIFIER_AUTHORITY *IdentifierAuthority, UINT8 SubAuthorityCount){
  if( SubAuthorityCount > 0xFu )
    return -1073741811;
  *((_BYTE *)Sid + 1) = SubAuthorityCount;
  *(_BYTE *)Sid = 1;
  *(_SID_IDENTIFIER_AUTHORITY *)((char *)Sid + 2) = *IdentifierAuthority;
  return 0;
}

Referenced by:

CMFCreateSecurityDescriptor
CmGetRegKeySecurityDescriptor
CmpAdminSystemSecurityDescriptor
CmpHiveRootSecurityDescriptor
CmpInitializeTrustedInstallerSid
DrvDbGetSecurityDescriptor
ExpFirmwareAccessAppContainerCheck
InitializeSidLookupTable
IopCreateUmdfDirectory
NtSetUuidSeed
ObpVerifyCreatorAccessCheck
PiAuAllocateAndInitializeSid
PiAuCheckClientInteractive
PnpGetEnumSecurityDescriptor
PnpGetPropertiesSecurityDescriptor
PopCreateHiberFileSecurityDescriptor
PopCreateTimebrokerServiceSid
PopNetInitialize
RtlCapabilityCheck
RtlDeriveCapabilitySidsFromName
RtlGetAppContainerParent
RtlInitializeSidEx
RtlpCapabilityCheckSystemCapability
RtlpSetSecurityObject
SepVariableInitialization
SmKmStoreFileMakeSecurityDescriptor
SysCtxRegOpenCurrentUserKey
WdipAccessCheck