RtlIsValidProcessTrustLabelSid

UINT8 __stdcall RtlIsValidProcessTrustLabelSid(VOID *Sid){
  int v1; 

  if( *((_BYTE *)Sid + 1) != 2 || *(_BYTE *)Sid != 1 )
    return 0;
  v1 = *(_DWORD *)((char *)Sid + 2);
  if( !v1 )
    v1 = *((unsigned __int16 *)Sid + 3) - 4864;
  return !v1 && (*((_DWORD *)Sid + 2) || !*((_DWORD *)Sid + 3));
}

Referenced by:

RtlAddAccessFilterAce
RtlAddProcessTrustLabelAce
RtlSidDominatesForTrust
SepReconcileTrustSidWithProcessProtection