PspSetMinimalProcessName

NTSTATUS __stdcall PspSetMinimalProcessName(_EPROCESS *Process, _UNICODE_STRING *ProcessName){
  VOID **PoolWithTag; 
  _OBJECT_NAME_INFORMATION *v5; 
  _OBJECT_NAME_INFORMATION *ImageFileName; 

  PoolWithTag = ExAllocatePoolWithTag(0x200ui64, ProcessName->Length + 16i64, 1850307408i64);
  v5 = (_OBJECT_NAME_INFORMATION *)PoolWithTag;
  if( !PoolWithTag )
    return -1073741801;
  PoolWithTag[1] = PoolWithTag + 2;
  *(_WORD *)PoolWithTag = ProcessName->Length;
  *((_WORD *)PoolWithTag + 1) = ProcessName->Length;
  memmove(PoolWithTag + 2, ProcessName->Buffer, ProcessName->Length);
  ImageFileName = Process->SeAuditProcessCreationInfo.ImageFileName;
  if( ImageFileName )
    ExFreePoolWithTag(ImageFileName, 0);
  Process->SeAuditProcessCreationInfo.ImageFileName = v5;
  PspSetProcessShortName(Process, ProcessName);
  return 0;
}

Referenced by: