ntrtl.h shows RtlGetExePath as a function that takes no parameters and returns a pointer to a wide string.
Disassembly (of Win10 21H1) shows RtlGetExePath takes two parameters and returns an NTSTATUS.
Comments welcome.
Process Hacker Discussion Forum