Function NtFilterToken 

pub unsafe extern "system" fn NtFilterToken(
    ExistingTokenHandle: HANDLE,
    Flags: ULONG,
    SidsToDisable: PTOKEN_GROUPS,
    PrivilegesToDelete: PTOKEN_PRIVILEGES,
    RestrictedSids: PTOKEN_GROUPS,
    NewTokenHandle: PHANDLE,
) -> NTSTATUS