PsGetAllocatedFullProcessImageNameEx

__int64 __fastcall PsGetAllocatedFullProcessImageNameEx(__int64 a1, _QWORD *a2){
  __int64 result; 
  result = 3221226021i64;
  if( *(_QWORD *)(a1 + 2240) && (_QWORD)xmmword_140C1DE80 )
    return((__int64(__fastcall *)(__int64, _QWORD *))xmmword_140C1DE80)(a1, a2);
  if( *(_QWORD *)(a1 + 1472) )
    return PsGetAllocatedFullProcessImageName(a1, a2);
  return result;
}

Referenced by:

CmpReportAuditVirtualizationEvent
SeAdtRegistryValueChangedAuditAlarm
SeAuditFipsCryptoSelftests
SeAuditProcessCreation
SeAuditProcessExit
SeAuditSystemTimeChange
SeAuditTransactionStateChange
SeCheckForCriticalAceRemoval
SeLocateProcessImageName
SeOperationAuditAlarm
SepAdtCloseObjectAuditAlarm
SepAdtDeleteObjectAuditAlarm
SepAdtOpenObjectAuditAlarm
SepAdtPrivilegeObjectAuditAlarm
SepAdtPrivilegedServiceAuditAlarm
SepAdtSecurityDescriptorChangedAuditAlarm
SepAdtStagingEvent
SepAdtTokenRightAdjusted
SepAuditAssignPrimaryToken
SepQueryNameString