PsGetAllocatedFullProcessImageName

NTSTATUS __stdcall PsGetAllocatedFullProcessImageName(_EPROCESS *Process, _UNICODE_STRING **ImageName){
  _OBJECT_NAME_INFORMATION *ImageFileName; 
  VOID **PoolWithTag; 
  NTSTATUS v5; 
  _UNICODE_STRING *v6; 

  ImageFileName = Process->SeAuditProcessCreationInfo.ImageFileName;
  PoolWithTag = ExAllocatePoolWithTag(0x200ui64, *((unsigned __int16 *)ImageFileName + 1) + 16i64, 1850307408i64);
  v5 = 0;
  v6 = (_UNICODE_STRING *)PoolWithTag;
  if( !PoolWithTag )
    return -1073741801;
  *(_OWORD *)PoolWithTag = *(_OWORD *)ImageFileName;
  if( PoolWithTag[1] )
  {
    PoolWithTag[1] = PoolWithTag + 2;
    memmove(PoolWithTag + 2, *((const VOID **)ImageFileName + 1), *((unsigned __int16 *)ImageFileName + 1));
  }
  *ImageName = v6;
  return v5;
}

Referenced by: