RtlGetAppContainerSidType
__int64 __fastcall RtlGetAppContainerSidType(PSID Sid, _DWORD *a2){
UINT8 v4;
if( *((_BYTE *)Sid + 1) >= 2u
&& *(_BYTE *)Sid == 1
&& RtlCompareMemory((char *)Sid + 2, (VOID *)&RtlpAppPackageAuthority, 6ui64) == 6
&& *((_DWORD *)Sid + 2) == 2 )
{
v4 = *RtlSubAuthorityCountSid(Sid);
if( v4 == 8 )
{
*a2 = 2;
return 0i64;
}
if( v4 == 12 )
{
*a2 = 1;
return 0i64;
}
*a2 = 3;
}
else
{
*a2 = 0;
}
return 3221266944i64;
}Referenced by:
NtCreateLowBoxToken
RtlGetAppContainerParent
RtlIsParentOfChildAppContainer
RtlpGetTokenNamedObjectPath
SepValidateReferencedCachedHandles