Function NtCreateLowBoxToken 

pub unsafe extern "system" fn NtCreateLowBoxToken(
    TokenHandle: PHANDLE,
    ExistingTokenHandle: HANDLE,
    DesiredAccess: ACCESS_MASK,
    ObjectAttributes: POBJECT_ATTRIBUTES,
    PackageSid: PSID,
    CapabilityCount: ULONG,
    Capabilities: PSID_AND_ATTRIBUTES,
    HandleCount: ULONG,
    Handles: *mut HANDLE,
) -> NTSTATUS