Query the child process and find its image base address from its Process Environment Block (PEB) https://github.com/winlabs/gowin32/blob/0b6f3bef0b7501b26caaecab8d52b09813224373/wrappers/winternl.go#L37 http://bytepointer.com/resources/tebpeb32.htm https://www.nirsoft.net/kernel_struct/vista/PEB.htm
source not stored for this graph (policy: none)
nothing calls this directly
no outgoing calls
no test coverage detected