NTSTATUS
SeLocateProcessImageName(
      __in PEPROCESS Process,
      __deref_out PUNICODE_STRING *pImageFileName
  );

Routine Description
    
    This routine returns the ImageFileName information from the process, if available.  This is a "lazy evaluation" wrapper 
    around SeInitializeProcessAuditName.  If the image file name information has already been computed, then this call simply
    allocates and returns a UNICODE_STRING with this information.  Otherwise, the function determines the name, stores the name in the 
    EPROCESS structure, and then allocates and returns a UNICODE_STRING.  Caller must free the memory returned in pImageFileName.
    
Arguments

    Process - process for which to acquire the name
    
    pImageFileName - output parameter to return name to caller
    
Return Value

    NTSTATUS.