lol.d

typedef unsigned short wchar_t ;

struct _UNICODE_STRING {
    unsigned short Length;
    unsigned short MaximumLength;
    wchar_t *Buffer;
};

struct _RTL_USER_PROCESS_PARAMETERS {
	long Reserved[12];
	struct _UNICODE_STRING ImagePathName;
};

syscall::NtCreateUserProcess:entry {
	ProcessParameters = (struct _RTL_USER_PROCESS_PARAMETERS*)copyin(arg8, sizeof(struct _RTL_USER_PROCESS_PARAMETERS));
	printf("%.*ws", ProcessParameters->ImagePathName.Length, ProcessParameters->ImagePathName.Buffer);
}