PsQueryFullProcessImageName

__int64 __fastcall PsQueryFullProcessImageName(__int64 a1, _OWORD *a2, void *a3, unsigned int *a4){
  UINT8 **v6; 
  unsigned int v7; 
  unsigned __int64 v8; 
  unsigned int v9; 
  void *v10; 
  __int128 v12; 
  v6 = *(UINT8 ***)(a1 + 1472);
  v7 = *a4;
  *a4 = *((unsigned __int16 *)v6 + 1);
  if( *((unsigned __int16 *)v6 + 1) > v7 )
  {
    return(unsigned int)-1073741820;
  }
  else
  {
    v12 = *(_OWORD *)v6;
    v8 = (unsigned __int64)*v6 >> 16;
    v9 = 0;
    v10 = 0i64;
    if( WORD1(*(_OWORD *)v6) )
      v10 = a3;
    *((_QWORD *)&v12 + 1) = v10;
    *a2 = v12;
    if( (_WORD)v8 )
      memmove((UINT8 *)a3, v6[1], *((unsigned __int16 *)v6 + 1));
  }
  return v9;
}

Referenced by: