pub unsafe extern "system" fn RtlCheckTokenCapability(
    TokenHandle: HANDLE,
    CapabilitySidToCheck: PSID,
    HasCapability: PBOOLEAN
) -> NTSTATUS