         f
         NtQueryInformationProcess drop
     ] keep ;
-    
+
 :: read-process-memory ( HANDLE alien offset len -- byte-array )
     HANDLE
     offset alien <displaced-alien>

            utf16n decode
        ] if
    ] [ drop f ] if* ;
    
: process-list ( -- assoc )
    [
        TH32CS_SNAPALL do-snapshot

        [ dup query-information-process PebBaseAddress>> read-peb ] bi
    ] with-destructors ;

:: read-args ( handle -- string/f )
    handle <win32-handle> &dispose drop
    handle query-information-process :> process-basic-information
    handle process-basic-information PebBaseAddress>>
    [
        "ProcessParameters" PEB offset-of
        PVOID heap-size
        read-process-memory
        PVOID deref :> args-offset
