RtlAllocateAndInitializeSidEx

NTSTATUS __stdcall RtlAllocateAndInitializeSidEx(
        PSID_IDENTIFIER_AUTHORITY IdentifierAuthority,
        UINT8 SubAuthorityCount,
        PULONG SubAuthorities,
        PSID *Sid){
  char *PoolWithQuotaTag; 
  __int64 v9; 
  signed __int64 v10; 
  PoolWithQuotaTag = (char *)ExAllocatePoolWithQuotaTag((POOL_TYPE)520, 0x10ui64, 0x62507452ui64);
  if( !PoolWithQuotaTag )
    return -1073741801;
  *PoolWithQuotaTag = 1;
  v9 = 2i64;
  *(_DWORD *)(PoolWithQuotaTag + 2) = *(_DWORD *)IdentifierAuthority->Value;
  v10 = PoolWithQuotaTag - (char *)SubAuthorities;
  *((_WORD *)PoolWithQuotaTag + 3) = *(_WORD *)&IdentifierAuthority->Value[4];
  PoolWithQuotaTag[1] = 2;
  do
  {
    *(PULONG)((char *)SubAuthorities + v10 + 8) = *SubAuthorities;
    ++SubAuthorities;
    --v9;
  }
  while( v9 );
  *Sid = PoolWithQuotaTag;
  return 0;
}

Referenced by: