RtlDeriveCapabilitySidsFromName

NTSTATUS __stdcall RtlDeriveCapabilitySidsFromName(
        UNICODE_STRING *CapName,
        PVOID CapabilityGroupSid,
        PVOID CapabilitySid){
  NTSTATUS result; 
  UINT64 v6; 
  __int128 v7; 
  __int128 v8; 
  unsigned int v9; 
  unsigned int v10; 
  UINT64 v11; 
  UINT64 v12; 
  __int128 v13; 
  __int128 v14; 
  struct _UNICODE_STRING DestinationString; 
  UINT8 pbResult[16]; 
  __int128 v17; 
  DestinationString = 0i64;
  if( !CapName || !CapabilityGroupSid || !CapabilitySid )
    __fastfail(5u);
  *(_OWORD *)CapabilitySid = 0i64;
  *((_OWORD *)CapabilitySid + 1) = 0i64;
  *((_OWORD *)CapabilitySid + 2) = 0i64;
  *(_OWORD *)CapabilityGroupSid = 0i64;
  *((_OWORD *)CapabilityGroupSid + 1) = 0i64;
  *((_QWORD *)CapabilityGroupSid + 4) = 0i64;
  *((_DWORD *)CapabilityGroupSid + 10) = 0;
  result = RtlUpcaseUnicodeString(&DestinationString, CapName, 1u);
  if( result >= 0 )
  {
    SymCryptSha256((UINT8 *)DestinationString.Buffer, DestinationString.Length, pbResult);
    LOBYTE(v6) = 9;
    RtlInitializeSid(CapabilityGroupSid, (SID_IDENTIFIER_AUTHORITY *)&RtlpNtAuthority, v6);
    v7 = *(_OWORD *)pbResult;
    *((_DWORD *)CapabilityGroupSid + 2) = 32;
    v8 = v17;
    *(_OWORD *)((char *)CapabilityGroupSid + 12) = v7;
    *(_OWORD *)((char *)CapabilityGroupSid + 28) = v8;
    v9 = 0;
    while( 1 )
    {
      v10 = v9 + 1;
      if( RtlEqualUnicodeString(&DestinationString, (UNICODE_STRING *)&RtlpLegacyApplicationCapabilityNames[2 * v9], 0) )
        break;
      ++v9;
      if( v10 >= 0xC )
        goto LABEL_8;
    }
    LOBYTE(v11) = 2;
    RtlInitializeSid(CapabilitySid, (SID_IDENTIFIER_AUTHORITY *)&RtlpAppPackageAuthority, v11);
    *((_DWORD *)CapabilitySid + 2) = 3;
    *((_DWORD *)CapabilitySid + 3) = v10;
LABEL_8:
    RtlFreeAnsiString(&DestinationString);
    if( v9 == 12 )
    {
      LOBYTE(v12) = 10;
      RtlInitializeSid(CapabilitySid, (SID_IDENTIFIER_AUTHORITY *)&RtlpAppPackageAuthority, v12);
      v13 = *(_OWORD *)pbResult;
      *((_DWORD *)CapabilitySid + 2) = 3;
      v14 = v17;
      *((_DWORD *)CapabilitySid + 3) = 1024;
      *((_OWORD *)CapabilitySid + 1) = v13;
      *((_OWORD *)CapabilitySid + 2) = v14;
    }
    return 0;
  }
  return result;
}

Referenced by: