PsQueryFullProcessImageName

NTSTATUS __stdcall PsQueryFullProcessImageName(
        _EPROCESS *Process,
        _UNICODE_STRING *ProcessInformation,
        WCHAR *ProcessString,
        UINT64 *DataLength){
  _OBJECT_NAME_INFORMATION *ImageFileName; 
  unsigned int v7; 
  __int64 v8; 
  NTSTATUS v9; 
  WCHAR *v10; 
  _UNICODE_STRING v12; 

  ImageFileName = Process->SeAuditProcessCreationInfo.ImageFileName;
  v7 = *(_DWORD *)DataLength;
  *(_DWORD *)DataLength = *((unsigned __int16 *)ImageFileName + 1);
  if( *((unsigned __int16 *)ImageFileName + 1) > v7 )
    return -1073741820;
  v12 = *(_UNICODE_STRING *)ImageFileName;
  v8 = *(_QWORD *)ImageFileName >> 16;
  v9 = 0;
  v10 = 0i64;
  if( WORD1(*(_OWORD *)ImageFileName) )
    v10 = ProcessString;
  v12.Buffer = v10;
  *ProcessInformation = v12;
  if( (_WORD)v8 )
    memmove(ProcessString, *((const VOID **)ImageFileName + 1), *((unsigned __int16 *)ImageFileName + 1));
  return v9;
}

Referenced by: