RtlIsElevatedRid

INT8 __fastcall RtlIsElevatedRid(INT64 a1){
  INT64 v1; 
  unsigned __int8 *v2; 
  int v3; 
  _DWORD *v4; 
  int *v5; 
  int v6; 
  int v7; 
  __int64 *i; 

  if( !a1 )
    return 0;
  if( (*(_DWORD *)(a1 + 8) & 0x30) != 0 )
    return 0;
  v1 = *(_QWORD *)a1;
  LODWORD(v2) = RtlSubAuthorityCountSid(*(_QWORD *)a1);
  v3 = *v2;
  if( !(_BYTE)v3 )
    return 0;
  LODWORD(v4) = RtlSubAuthoritySid(v1, 0i64);
  if( (unsigned int)(*v4 - 80) <= 0x1F )
    return 0;
  LODWORD(v5) = RtlSubAuthoritySid(v1, (unsigned int)(v3 - 1));
  v6 = 0;
  v7 = *v5;
  for( i = qword_1400178E0; v7 != *(_DWORD *)i; i = (__int64 *)((char *)i + 4) )
  {
    if( (unsigned int)++v6 >= 0x13 )
      return 0;
  }
  return 1;
}

Referenced by: