IopFileUtilRename

NTSTATUS __stdcall IopFileUtilRename(
        _UNICODE_STRING *SourcePathName,
        _UNICODE_STRING *DestinationPathName,
        UINT8 ReplaceIfPresent){
  __int64 Length; 
  UINT64 v7; 
  VOID **PoolWithTag; 
  INT64 v9; 
  INT64 v10; 
  int v11; 
  int v13; 
  NTSTATUS v14; 
  UINT64 ShareAccess; 
  UINT64 ShareAccessa; 
  UINT64 OpenOptions; 
  _IO_STATUS_BLOCK IoStatusBlock; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  VOID *FileHandle; 

  FileHandle = 0i64;
  Length = DestinationPathName->Length;
  *(&ObjectAttributes.Length + 1) = 0;
  *(&ObjectAttributes.Attributes + 1) = 0;
  IoStatusBlock = 0i64;
  PoolWithTag = ExAllocatePoolWithTag(1ui64, Length + 24, 1967550281i64);
  if( !PoolWithTag )
    return -1073741670;
  if( ReplaceIfPresent )
    IopFileUtilClearAttributes(
      DestinationPathName,
      v7,
      v9,
      v10,
      ShareAccess,
      OpenOptions,
      (INT64)IoStatusBlock.Pointer,
      IoStatusBlock.Information);
  ObjectAttributes.RootDirectory = 0i64;
  LODWORD(OpenOptions) = 2113570;
  ObjectAttributes.Length = 48;
  ObjectAttributes.Attributes = 576;
  ObjectAttributes.ObjectName = SourcePathName;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  LODWORD(ShareAccess) = 7;
  v11 = ZwOpenFile(&FileHandle, 0x110080ui64, &ObjectAttributes, &IoStatusBlock, ShareAccess, OpenOptions);
  if( v11 >= 0 )
  {
    memmove((char *)PoolWithTag + 20, DestinationPathName->Buffer, DestinationPathName->Length);
    PoolWithTag[1] = 0i64;
    *(_BYTE *)PoolWithTag = ReplaceIfPresent;
    v13 = DestinationPathName->Length;
    *((_DWORD *)PoolWithTag + 4) = v13;
    LODWORD(ShareAccessa) = 10;
    v14 = ZwSetInformationFile(
            (UINT64)FileHandle,
            (UINT64)&IoStatusBlock,
            (INT8 *)PoolWithTag,
            (unsigned int)(v13 + 24),
            ShareAccessa);
    ExFreePoolWithTag(PoolWithTag, 0);
    ZwClose((_HANDLE)FileHandle);
    return v14;
  }
  else
  {
    ExFreePoolWithTag(PoolWithTag, 0);
    return v11;
  }
}

Referenced by: