we have some problems with MCH driver's GetExeFileName function in W10 32b.
I looked at your code and there is huge difference how you get process name from the system because of w2000 support.
Lets say we have an application with NBS path \\server\\apps\app.exe. We map this path as a disk (\\server\\apps is now Y:). There is a difference between your 32b and 64b code. If I run this app as \\server\\apps\app.exe it is OK on both versions. If I run Y:\app.exe it is matched as a Y:\app.exe on 32b, but it is matched as \\server\\apps\app.exe on 64b. I believe that 64b code is correct, because it is easier to setup network app rule simply as: "\\server\\apps\app.exe" and not to care about any mountpoint that was set up.
If I delete that _WIN64 define and user the 64b code for 32b and 64b it works correctly in all cases.
So I suggest to drop w2000 support.