GetFileNameFormHandle: nt api

uses
 Windows, SysUtils;

type
 NTStatus = cardinal;

 PIO_STATUS_BLOCK = ^IO_STATUS_BLOCK;

  IO_STATUS_BLOCK = packed record
    Status: NTStatus;
    Information: dword;
  end;

  PFILE_NAME_INFORMATION = ^FILE_NAME_INFORMATION;

  FILE_NAME_INFORMATION = packed record
    FileNameLength: ULONG;
    FileName: array [0 .. MAX_PATH - 1] of WideChar;
  end;

function NtQueryInformationFile(FileHandle: THandle;
  IoStatusBlock: PIO_STATUS_BLOCK; FileInformation: pointer; Length: dword;
  FileInformationClass: dword): NTStatus; stdcall; external 'ntdll.dll';

function GetFileNameFromHandle(const hFile: THandle): string; // This "hFile" i get from of: de.LoadDll.hFile
var
  IO_STATUSBLOCK: IO_STATUS_BLOCK;
  FileNameInfo: FILE_NAME_INFORMATION;
  szFile: String;
begin
  FillChar(FileNameInfo.FileName, SizeOf(FileNameInfo.FileName), 0);
  NtQueryInformationFile(hFile, @IO_STATUSBLOCK, @FileNameInfo, 500, 9);
  szFile := WideCharToString(FileNameInfo.FileName);
  Result := szFile; // This returns for example with notepad.exe: \Windows\SysWOW64\notepad.exe, without the C:

end;