Прочитать параметры запуска чужого процесса

Option Explicit
Private Type PROCESS_BASIC_INFORMATION
    ExitStatus As Long
    PebBaseAddress As Long
    AffinityMask As Long
    BasePriority As Long
    UniqueProcessId As Long
    InheritedFromUniqueProcessId As Long
End Type
Private Type UNICODE_STRING
    Length As Integer
    MaxLength As Integer
    lpBuffer As Long
End Type
Private Declare Function OpenProcess Lib "kernel32" (ByVal dwDesiredAccess As Long, ByVal bInheritHandle As Long, ByVal dwProcessId As Long) As Long
Private Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Long) As Long
Private Declare Function NtQueryInformationProcess Lib "ntdll" (ByVal ProcessHandle As Long, ByVal InformationClass As Long, ByRef ProcessInformation As Any, ByVal ProcessInformationLength As Long, ByRef ReturnLength As Any) As Long
Private Declare Function ReadProcessMemory Lib "kernel32" (ByVal hProcess As Long, lpBaseAddress As Any, lpBuffer As Any, ByVal nSize As Long, lpNumberOfBytesWritten As Long) As Long
 
 
Private Const PROCESS_QUERY_INFORMATION As Long = &H400&
Private Const PROCESS_VM_READ As Long = &H10&
 
Private Sub Form_Load()
    MsgBox GetCommandLineFromPID(2956)
End Sub
Private Function GetCommandLineFromPID(PID As Long) As String
    Dim hProcess As Long
    Dim pbi As PROCESS_BASIC_INFORMATION
    Dim lpPP As Long                ' Óêàçàòåëü íà ïàðàìåòðû ïðîöåññà
    Dim cmd As UNICODE_STRING       ' Ñòðóêòóðà äëÿ õðàíåíèÿ þíèêîäíîé ñòðîêè
 
    ' Ïîëó÷àåì õåíäë
    hProcess = OpenProcess(PROCESS_QUERY_INFORMATION Or PROCESS_VM_READ, False, PID)
    If hProcess Then
        ' Ïîëó÷àåì óêàçàòåëü íà PEB
        If NtQueryInformationProcess(hProcess, 0, pbi, Len(pbi), ByVal 0) Then Exit Function
        ' Ïîëó÷àåì óêàçàòåëü íà ïàðàìåòðû ïðîöåññà
        If ReadProcessMemory(hProcess, ByVal pbi.PebBaseAddress + &H10, lpPP, 4, 0) = 0 Then Exit Function
        ' Ïîëó÷àåì ñòðóêòóðó UNICODE_STRING ñîäåðæàùóþ êîììàíäíóþ ñòðîêó
        If ReadProcessMemory(hProcess, ByVal lpPP + &H40, cmd, Len(cmd), 0) = 0 Then Exit Function
        ' ×èòàåì ñòðîêó
        GetCommandLineFromPID = Space(cmd.Length \ 2) ' Âûäåëÿåì áóôåð äîñòàòî÷íîé äëèíû
        If ReadProcessMemory(hProcess, ByVal cmd.lpBuffer, ByVal StrPtr(GetCommandLineFromPID), cmd.Length, 0) = 0 Then Exit Function
        CloseHandle hProcess
    End If
End Function