PsGetAllocatedFullProcessImageName

__int64 __fastcall PsGetAllocatedFullProcessImageName(__int64 a1, _QWORD *a2){
  __int64 v2; 
  char *PoolWithTag; 
  unsigned int v5; 
  char *v6; 
  v2 = *(_QWORD *)(a1 + 1472);
  PoolWithTag = (char *)ExAllocatePoolWithTag(NonPagedPoolNx, *(unsigned __int16 *)(v2 + 2) + 16i64, 0x6E497350ui64);
  v5 = 0;
  v6 = PoolWithTag;
  if( PoolWithTag )
  {
    *(_OWORD *)PoolWithTag = *(_OWORD *)v2;
    if( *((_QWORD *)PoolWithTag + 1) )
    {
      *((_QWORD *)PoolWithTag + 1) = PoolWithTag + 16;
      memmove((UINT8 *)PoolWithTag + 16, *(UINT8 **)(v2 + 8), *(unsigned __int16 *)(v2 + 2));
    }
    *a2 = v6;
  }
  else
  {
    return(unsigned int)-1073741801;
  }
  return v5;
}

Referenced by: