RtlpCapabilityCheckSystemCapability

NTSTATUS __stdcall RtlpCapabilityCheckSystemCapability(_HANDLE ExistingTokenHandle, PCUNICODE_STRING Source){
  _BYTE *v2; 
  VOID *v3; 
  _BYTE *v4; 
  NTSTATUS PolicyValueForSystemCapability; 
  int IsAppContainer; 
  _DWORD *v7; 
  _DWORD *v8; 
  _DWORD *v9; 
  UINT8 IsMember; 
  BOOL v12; 
  _SID_IDENTIFIER_AUTHORITY IdentifierAuthority; 
  _UNICODE_STRING UnicodeString; 
  char Sid[16]; 

  *(_DWORD *)IdentifierAuthority.Value = 0;
  v3 = *(VOID **)&ExistingTokenHandle;
  *(_WORD *)&IdentifierAuthority.Value[4] = 1280;
  IsMember = 0;
  v12 = 0;
  v4 = v2;
  UnicodeString = 0i64;
  PolicyValueForSystemCapability = RtlpGetPolicyValueForSystemCapability(Source, &UnicodeString);
  IsAppContainer = PolicyValueForSystemCapability;
  if( PolicyValueForSystemCapability == -1073741772 )
  {
    IsAppContainer = 0;
  }
  else
  {
    *v4 = 0;
    if( PolicyValueForSystemCapability >= 0 )
    {
      if( RtlCompareUnicodeString(&UnicodeString, &stru_140009638 + 2, 0) )
      {
        if( RtlCompareUnicodeString(&UnicodeString, &stru_140009638, 0) )
        {
          IsAppContainer = -1073741823;
          goto LABEL_14;
        }
        RtlInitializeSid(Sid, &IdentifierAuthority, 1u);
        LODWORD(v9) = RtlSubAuthoritySid((INT64)Sid, 0i64);
        *v9 = 4;
      }
      else
      {
        RtlInitializeSid(Sid, &IdentifierAuthority, 2u);
        LODWORD(v7) = RtlSubAuthoritySid((INT64)Sid, 0i64);
        *v7 = 32;
        LODWORD(v8) = RtlSubAuthoritySid((INT64)Sid, 1ui64);
        *v8 = 583;
      }
      IsAppContainer = RtlCheckTokenMembershipEx(v3, Sid, 2ui64, &IsMember);
      if( IsAppContainer >= 0 )
      {
        if( IsMember )
        {
          IsAppContainer = RtlpIsAppContainer(v3, &v12);
          if( IsAppContainer >= 0 )
          {
            if( v12 )
              *v4 = 1;
          }
        }
      }
    }
  }
LABEL_14:
  RtlFreeAnsiString(&UnicodeString);
  return IsAppContainer;
}

Referenced by: