type
 PROCESS_BASIC_INFORMATION = packed record
   ExitStatus: DWORD;
   PebBaseAddress: Pointer;
   AffinityMask: DWORD;
   BasePriority: DWORD;
   uUniqueProcessId: Ulong;
   uInheritedFromUniqueProcessId: Ulong;
 end;

function NtQueryInformationProcess(ProcessHandle: THandle; ProcessInformationClass: Byte; ProcessInformation: Pointer;
                                  ProcessInformationLength: ULONG; ReturnLength: PULONG): DWORD; stdcall; external 'ntdll.dll';

function ParentProcName: string;
var
 Info: PROCESS_BASIC_INFORMATION;
 ProcessName: string;
 Hndl: THandle;
begin
 result:= 'noname';
 if NtQueryInformationProcess(GetCurrentProcess, 0, @Info, SizeOf(Info), nil) = NO_ERROR
   then begin
     Hndl:= OpenProcess(PROCESS_QUERY_INFORMATION or PROCESS_VM_READ, False, Info.uInheritedFromUniqueProcessId);
     if Hndl <> 0 then
       try
         SetLength(ProcessName, MAX_PATH);
         if GetModuleBaseNameA(Hndl, 0, PChar(ProcessName), MAX_PATH) > 0
           then result:= PChar(ProcessName);
       finally
         CloseHandle(Hndl);
       end;
   end;
end;

uses ... TlHelp32;

function ParentProcName2: string;
var
 i: integer;
 ProcessID, ParentProcessID: DWORD;
 hSnapshot: THandle;
 ProcessEntry: TProcessEntry32;
 ProcessList: TStringList;
begin
 result:= 'noname';

 ProcessList:= TStringList.Create;
 try
   ProcessID:= GetCurrentProcessID;
   ParentProcessID:= 0;
   hSnapshot:= CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
   if hSnapshot <> INVALID_HANDLE_VALUE then try
     ProcessEntry.dwSize:= SizeOf(ProcessEntry);
     if Process32First(hSnapshot, ProcessEntry) then begin
       repeat
         ProcessList.AddObject(ProcessEntry.szExeFile, TObject(ProcessEntry.th32ProcessID));
         if ProcessEntry.th32ProcessID = ProcessID then
           ParentProcessID:= ProcessEntry.th32ParentProcessID;
       until not Process32Next(hSnapshot, ProcessEntry)
     end
   finally
     CloseHandle(hSnapshot)
   end;
   if ParentProcessID <> 0 then begin
     i:= ProcessList.IndexOfObject(TObject(ParentProcessID));
     if i <> -1 then
       result:= ProcessList.Strings[i]
   end;
 finally
   ProcessList.Free
 end;
end;

function GetProcessImageFileName(hProcess: tHANDLE; lpImageFileName: LPTSTR; nSize: DWORD): DWORD; stdcall; external 'psapi.dll' name 'GetProcessImageFileNameA';

function ParentProcName: string;
var
 Info: PROCESS_BASIC_INFORMATION;
 ProcessName: string;
 Hndl: THandle;

 function GetModuleFileNameEx(hProcess: THandle; lpFilename: PChar; nSize: DWORD): DWORD;

   function DevicePathToWin32Path(lpFilename: PChar): DWORD;
   var
     c: char;
     sPath, sRes, s: string;
     i: integer;
   begin
     sPath:= lpFilename;

     i:= PosEx('\', sPath, 2);
     i:= PosEx('\', sPath, i + 1);
     sRes:= Copy(sPath, i, Length(sPath));
     Delete(sPath, i, Length(sPath));

     for c:= 'A' to 'Z' do begin
       SetLength(s, MAX_PATH);
       if QueryDosDevice(PChar(String(c) + ':'), PChar(s), 1000) <> 0 then begin
         s:= PChar(s);
         if SameText(sPath, s) then begin
           sRes:= c + ':' + sRes;
           result:= Length(sRes);
           Move(sRes[1], lpFilename[0], result + 1);
           Exit;
         end;
       end;
     end;

     result:= 0;
   end;

 begin
   result:= GetProcessImageFileName(hProcess, lpFilename, nSize);
   if result > 0 then
     result:= DevicePathToWin32Path(lpFilename);
 end;

begin
 result:= 'noname';
 if NtQueryInformationProcess(GetCurrentProcess, 0, @Info, SizeOf(Info), nil) = NO_ERROR
   then begin
     Hndl:= OpenProcess(PROCESS_QUERY_INFORMATION or PROCESS_VM_READ, False, Info.uInheritedFromUniqueProcessId);
     if Hndl <> 0 then
       try
         SetLength(ProcessName, MAX_PATH);

         if GetModuleFileNameEx(Hndl, PChar(ProcessName), MAX_PATH) > 0
           then result:= PChar(ProcessName);
       finally
         CloseHandle(Hndl);
       end;
   end;
end;

C:\Program Files (x86)\Embarcad Files (x86)\Embarcadero\RAD Studio\7.0\bin\bds.exe

C:\Windows\ediskVolume1\Windows\explorer.exe

C:\Program Files\InterneProgram Files\Internet Explorer\iexplore.exe

C:\Program Files (x86)\Integram Files (x86)\Internet Explorer\iexplore.exe

procedure EnableAllPrivileges;
var c1, c2 : dword;
   ptp : PTokenPrivileges;
   i1 : integer;
begin
 if OpenProcessToken(windows.GetCurrentProcess, TOKEN_ADJUST_PRIVILEGES or TOKEN_QUERY, c1) then
   try
     c2 := 0;
     GetTokenInformation(c1, TokenPrivileges, nil, 0, c2);
     if c2 <> 0 then begin
       ptp := AllocMem(c2);
       if GetTokenInformation(c1, TokenPrivileges, ptp, c2, c2) then begin
         for i1 := 0 to integer(ptp^.PrivilegeCount) - 1 do
           ptp^.Privileges[i1].Attributes := ptp^.Privileges[i1].Attributes or SE_PRIVILEGE_ENABLED;
         AdjustTokenPrivileges(c1, false, ptp^, c2, PTokenPrivileges(nil)^, cardinal(pointer(nil)^));
       end;
       FreeMem(ptp);
     end;
   finally CloseHandle(c1) end;
end;

function ChangeFSRedirection(bDisable: Boolean): Boolean;
type
    TWow64DisableWow64FsRedirection = Function(Var Wow64FsEnableRedirection: LongBool): LongBool; StdCall;
    TWow64EnableWow64FsRedirection = Function(var Wow64FsEnableRedirection: LongBool): LongBool; StdCall;
var
   hHandle: THandle;
   Wow64DisableWow64FsRedirection: TWow64DisableWow64FsRedirection;
   Wow64EnableWow64FsRedirection: TWow64EnableWow64FsRedirection;
   Wow64FsEnableRedirection: LongBool;
begin
 Result := false;

// if not IsWindows64 then
  //  Exit;

 try
   hHandle := GetModuleHandle('kernel32.dll');
   @Wow64EnableWow64FsRedirection := GetProcAddress(hHandle, 'Wow64EnableWow64FsRedirection');
   @Wow64DisableWow64FsRedirection := GetProcAddress(hHandle, 'Wow64DisableWow64FsRedirection');

   if bDisable then
   begin
    if (hHandle <> 0) and (@Wow64DisableWow64FsRedirection <> nil) then
    begin
      Wow64DisableWow64FsRedirection(Wow64FsEnableRedirection);
      Result := True;
    end;
   end else
   begin
    if (hHandle <> 0) and (@Wow64EnableWow64FsRedirection <> nil) then
    begin
      Wow64EnableWow64FsRedirection(Wow64FsEnableRedirection);
      Result := True;
    end;
   end;
 Except
 end;
end;

C:\Windows\explorer.exe

 uses ... TlHelp32;
 function GetModuleFileName(pID: DWORD): string;
 var
   hSnapshot: THandle;
   mEntr: tagMODULEENTRY32;
 begin
   result:= 'noname';
   hSnapshot:= CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, pID);
   if hSnapshot <> INVALID_HANDLE_VALUE then
   try
     mEntr.dwSize:= SizeOf(mEntr);
     if Module32First(hSnapshot, mEntr) then
       result:= mEntr.szExePath;
   finally
     CloseHandle(hSnapshot)
   end;
 end;

 function ParentProcName: string;
 var
   pID: DWORD;
   hSnapshot: THandle;
   ProcessEntry: TProcessEntry32;
 begin
   result:= 'noname';
   hSnapshot:= CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
   if hSnapshot <> INVALID_HANDLE_VALUE then
   try
     ProcessEntry.dwSize:= SizeOf(ProcessEntry);
     if Process32First(hSnapshot, ProcessEntry) then begin
       pID:= GetCurrentProcessID;
       repeat
         if ProcessEntry.th32ProcessID = pID then begin
           result:= GetModuleFileName(ProcessEntry.th32ParentProcessID);
           Break;
         end;
       until not Process32Next(hSnapshot, ProcessEntry);
     end;
   finally
     CloseHandle(hSnapshot)
   end;
 end;