PsGetAllocatedFullProcessImageNameEx

NTSTATUS __stdcall PsGetAllocatedFullProcessImageNameEx(_EPROCESS *Process, _UNICODE_STRING **ImageName){
  NTSTATUS result; 

  result = -1073741275;
  if( Process->PicoContext && (_QWORD)xmmword_140C1DE80 )
    return((__int64(__fastcall *)(_EPROCESS *, _UNICODE_STRING **))xmmword_140C1DE80)(Process, ImageName);
  if( Process->SeAuditProcessCreationInfo.ImageFileName )
    return PsGetAllocatedFullProcessImageName(Process, ImageName);
  return result;
}

Referenced by: