__in PEPROCESS Process,
      __deref_out PUNICODE_STRING *pImageFileName

Routine Description
    This routine returns the ImageFileName information from the process, if available.  This is a "lazy evaluation" wrapper 
    around SeInitializeProcessAuditName.  If the image file name information has already been computed, then this call simply
    allocates and returns a UNICODE_STRING with this information.  Otherwise, the function determines the name, stores the name in the 
    EPROCESS structure, and then allocates and returns a UNICODE_STRING.  Caller must free the memory returned in pImageFileName.

    Process - process for which to acquire the name
    pImageFileName - output parameter to return name to caller
Return Value